SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering if it is possible to pass credentials of current user to ExchangeService object.

Currently I am providing specific UserName/Password to WebCredentials in order to authenticate the ExchangeService access but instead I want to use credential of current user by using SPContext.Current.Web.CurrentUser.UserToken.

Here my code which create appointments:

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010_SP1);
service.Credentials = new WebCredentials("UserName", "password", "");
service.Url = new Uri("");

Appointment appointment = new Appointment(service);
foreach (MailAddress MailAddress in MailAddresses)

appointment.Subject = Title;
appointment.Body = Summary;
appointment.Start = StartDate;
appointment.End = EndDate;
appointment.IsResponseRequested = true;
share|improve this question
did you find any solution? – Schiavini Sep 25 '12 at 11:44
Yes, I decided to go with impersonation and it's working great for last six months now. – Firoz Ansari Sep 25 '12 at 14:15
up vote 6 down vote accepted

You can impersonate the user account.

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010_SP1);
service.Credentials = new NetworkCredential("serviceAccount", "serviceAccountPassword", "domain");
service.Url = new Uri(""); 
service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress,"userEmail");

Refer to msdn for more information. Hope this helps.

share|improve this answer
Thanks for your reply. To use impersonation, I will require to enable impersonation property for serviceAccount user. Will it not create any security risk in whole organization? Any developer with serviceAccount/Password can access others mail-box without their consent. – Firoz Ansari Feb 14 '12 at 16:23

This should work:

share|improve this answer
Thanks Amit. I am getting this error with DefaultCredentials. Erorr: "When making a request as an account that does not have a mailbox, you must specify the mailbox primary SMTP address for any distinguished folder Ids." – Firoz Ansari Feb 14 '12 at 17:46

If your authentication is set to NTLM then this is not an option due to the well-known double hop issue. In this case, you must create a new token in the middle layer as you are doing now. This does open a security hole as anyone with access to the code can see the user ID and Password needed to access Exchange. You could always encrypt and store these values somewhere (like the registry) and pull them from there instead of hard-coding them. This is a better option but still not ideal.

If you are using Kerberos then passing the token should work, provided that both your site and the Exchange server are also configured properly.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.