Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 1 down vote favorite

I've got a custom server control which does a web request to a HttpHandler (different site collection) on the same web application.

Everything works fine, except that the user account which does the web request is not the current SharePoint user but the IUSR account. I think this is called the double hop problem if I understood it right.

What I need is that the handler is called in the context of the current user, so that the handler can check who did the call.

My web application uses claims authentication, so I guess there should be a way to archive this.

share|improve this question

2 Answers

up vote 1 down vote

Since you are using claims, I would guess you have SharePoint 2010. Have you configured the Secure Store? If you have, then you only need to set up an identity that will pass the credentials of the logged on user and call this identity in your control.

share|improve this answer
Thx for you reply. I'm using SP2010, but I don't see how the Secure Store would help me solving my issue or I don't know how to use it correctly. The problem I see is that I cannot set up entries in the secure store for each user that can do the web request (probably all) by hand. – Flo May 9 '11 at 14:38
Another problem is, the user should really use their normal credentials to do the web request. So I won't know there password. – Flo May 9 '11 at 15:04
You set up a single identity that will use the user's username and password as the credentials. It may initially prompt the user to enter those credentials, but will store the information. – Lori May 9 '11 at 15:05
At any rate, the Secure Store is what you will have to use, unless you want to move to Kerberos to address the double hop issue (highly recommended). – Lori May 9 '11 at 15:07
up vote 0 down vote

You could do the external request on the client via jQuery and then post the results to your server control. This would allow the external request to use the current user's permissions to get the data.

However, this approach could also allow tampering of the results prior to them being posted so you might want to include some level of encryption.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.