Passing current user security token to ExchangeService

Question

I am wondering if it is possible to pass credentials of current user to ExchangeService object.

Currently I am providing specific UserName/Password to WebCredentials in order to authenticate the ExchangeService access but instead I want to use credential of current user by using SPContext.Current.Web.CurrentUser.UserToken.

Here my code which create appointments:

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010_SP1);
service.Credentials = new WebCredentials("UserName", "password", "domain.contoso.com");
service.Url = new Uri("https://computername.domain.contoso.com/EWS/Exchange.asmx");

Appointment appointment = new Appointment(service);
foreach (MailAddress MailAddress in MailAddresses)
{
    appointment.RequiredAttendees.Add(MailAddress.Address);
}

appointment.Subject = Title;
appointment.Body = Summary;
appointment.Start = StartDate;
appointment.End = EndDate;
appointment.IsResponseRequested = true;
appointment.Save(SendInvitationsMode.SendToAllAndSaveCopy);

Answer 1

You can impersonate the user account.

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010_SP1);
service.Credentials = new NetworkCredential("serviceAccount", "serviceAccountPassword", "domain");
service.Url = new Uri("https://computername.domain.contoso.com/EWS/Exchange.asmx"); 
service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress,"userEmail");

Refer to msdn for more information. Hope this helps.

Answer 2

This should work:

service.Credentials=CredentialCache.DefaultCredentials;

Answer 3

If your authentication is set to NTLM then this is not an option due to the well-known double hop issue. In this case, you must create a new token in the middle layer as you are doing now. This does open a security hole as anyone with access to the code can see the user ID and Password needed to access Exchange. You could always encrypt and store these values somewhere (like the registry) and pull them from there instead of hard-coding them. This is a better option but still not ideal.

If you are using Kerberos then passing the token should work, provided that both your site and the Exchange server are also configured properly.