0

I have searched all over for an answer to this, and not found anything that seems to answer my question. Which feels like it should be an easy one (but clearly isn't).

I have an API which authenticates using a token. This token I generate from my application - more specifically, I have a new Token Generation web call that will return a token. Currently, I pass in a cookie with the user and password information, and it uses this to identify who I am and what I should be allowed to do. This is all working absolutely fine and hunky-dory.

I am achieving this process by making the Token Generation use OWIN Cookie Authentication, which means that the cookie is read and the Identity is set. I am then able to use this identity to confirm whether the user is allowed to access the system.

What I now want to do is replace this Cookie Authentication process by authenticating against a Windows User (everything is windows based, and this will be an option so non-windows users can still use the cookie authentication route). But I cannot discover how to straightforwardly do this.

Note that I don't actually need to validate that the user is genuine or refer back to the AD at all. If you provide a windows user that matches a user in the system, you can log in.

So how can I - easily - get the requesting user into the Identity Name? Or is this not possible?

Schroedingers Cat
  • 3,099
  • 1
  • 15
  • 33
  • did you check this? : https://stackoverflow.com/questions/30105780/mvc-mixed-auth-owin-windows-auth – Vince Jan 13 '20 at 10:28
  • Yes - I have looked at that. First issue is that i don;t want BOTH, I want one or the other. I tried adding in this: HttpListener listener = (HttpListener)app.Properties["System.Net.HttpListener"]; listener.AuthenticationSchemes = AuthenticationSchemes.IntegratedWindowsAuthentication; But I don't have a listener object (because it is IIS hosted, not self-hosted) – Schroedingers Cat Jan 13 '20 at 10:32
  • But if i have missed something there please point it out to me! – Schroedingers Cat Jan 13 '20 at 10:33

1 Answers1

0

If you are looking for information on the current user accessing your program, assuming the program is running on the user's machine and is windows based, you can simply query windows for the user's username or any other publicly available information about the user.

Refer to https://learn.microsoft.com/en-us/dotnet/api/system.environment?view=netframework-4.8 for information on the Enviroment class and what it's features are.

If you could provide some code or further clarity I could help you further.

Marc
  • 19
  • 3
  • I am after current user - but this is a web API. So (for example) you make a call to the API from your windows machine, running something or other, and the API code picks up your Windows User, and sets the identity to this. And if you don't have a windows user then you are unauthenticated. Once I have the user, I can them get the system user and all of the required permissions based on this. But I need to know the user making this request (who may not be accessible on the host machine). – Schroedingers Cat Jan 17 '20 at 11:53