Web-API, DelegatingHandler and security. Principal is reset in Controller

Question

I've a DelegatingHandler in my Web-API service that, based on the headers provided, set a custom IPrincipal (ServicePrincipal) on the Thread.CurrentPrincipal and on the HttpContext.Current.User. This is all done on a call to SendAsync.

However, when the call get's into the Controller, the User property, the HttpContext.User and the Thread.CurrentPrincipal have all been mysteriously set to a RolePrincipal.

Does anyone know either what I'm doing wrong, or how to prevent the additional principal being set?

Thanks,
Kieron

It's better...the HttpContext.User is now correct, but the Thread.CurrentPrincipal is still a RolePrincipal - so the request still fails to authenticate... — Kieron, Jul 19 '13 at 08:09
Did you ever find a resolution? I have a tangental problem that might benefit from your solution. — JohnC, Aug 18 '14 at 18:35

score 3 · Answer 1 · answered Feb 29 '16 at 21:04

I know this question is old, but I was having a similar issue trying to get the current user from within a function overriding DelegatingHandler.SendAsync(). The IPrincipal object doesn't seem to get initialized until after the call to base.SendAsync(). After that line is called, the IPrincipal object should have the user information.

I used request.GetRequestContext().Principal to retrieve it, but I'm guessing Thread.CurrentPrincipal would work too.

Web-API, DelegatingHandler and security. Principal is reset in Controller

1 Answers1