Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am working on a solution that needs to act slightly differently if the incoming request is NTLM vs. Kerberos vs. ADFS, etc. Does anyone have an example of how to determine the incoming authentication method in C#?

Alternatively, is there a way to identify this by the current SPContext?

Thanks

EDIT: I have found that "HttpContext.Current.User.Identity.AuthenticationType" will return "NTLM" or "Kerberos" in a string. However, I still don't see a way to identify if using ADFS...

share|improve this question
1  
All three NTLM, Kerberos, and ADFS are represented by AuthenticationMode.Windows using SPSecurity.AuthenticationMode which is the OM property for this. Have you looked into accessing the cookies? I'm not even sure if they'd contain the right information for you... –  RJ Cuthbertson Oct 31 '12 at 16:54
    
Have you tried to see if there's any clues in cookies or headers set by SharePoint when logged in? FBA leaves a 'FedAuth' cookie, ADFS may leave the same, or something different, and the Response Header may (or may not) have a clue. –  James Love Nov 30 '12 at 22:04
    
I take it my solution worked? –  RJ Cuthbertson Dec 3 '12 at 14:42
add comment

2 Answers

up vote 3 down vote accepted

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this.

Here's the idea (point by point):

1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN

2) In Testing Whether ADFS User Is Authenticated they cast the user identity to the SingleSignOnIdentity object to test user authentication in ADFS. Which led me to the idea of "What happens if it isn't an SSO identity and you attempt to cast?"

3) And with that idea I found a couple posts that say that if a user's identity is not an SSO identity, an InvalidCastException will be thrown:

ADFS Identity Single Sign On Identity

ADFS System.Web.Security.SingleSignOn.SingleSignOnIdentity

4) So the C# would look something like:

bool isADFS;

try
{
    SingleSignOnIdentity tryADFS = (SingleSignOnIdentity)User.Identity;
    isADFS = true;
}
catch (InvalidCastException) // Not ADFS
{
    isADFS = false;
}

Or perhaps:

bool isADFS = false;
if (User.Identity is SingleSignOnIdentity)
    isADFS = true;

Like I said, I have no way to test it, but I think that should work. Let me know.

share|improve this answer
add comment

@James Love got this on the head, you need to take a look at the cookies

Check out this project "Remote authentication with claims" I believe the answer is here in the code.

It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.

share|improve this answer
    
I'm awarding you the bounty as your answer is also valid and if they don't go to someone, the points go to the Netherrealm. I just left it running a little while longer to see if anyone had a better answer. –  RJ Cuthbertson Dec 6 '12 at 21:56
    
No but I will bring it up at SharePoint Saturday and find out if there is. Love and peace thank you. –  Hugh Wood Dec 7 '12 at 8:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.