I've created a website using .NET Core MVC. This will only be used inside a company network, so it uses Windows authentication.
If I try to display the user's username in a web page (using the following code), the actual user's name is displayed:
var identity = (WindowsIdentity)HttpContext.User.Identity;
viewModel.UserName = identity.Name; //Page displays "DOMAINNAME/username"
However, connections to an SQL Server database using Integrated Security are made under the same user regardless of who is logged in on the website. The connection string is similar to the following:
Data Source=ServerName;Initial Catalog=DbName;Integrated Security=True
I would prefer the name of the actual user to be passed to the database, so that actions logged using suser_name()
will report the correct user.
In previous versions of ASP.NET, I believe the "impresonation" setting handled this. However, Core uses IIS only as a proxy and runs on its own Kestrel server, so it doesn't seem like this setting applies.
Is there a way to use Integrated Security with the user that's logged into the website?