Identify Current Authentication Method Being Used

Question

I am working on a solution that needs to act slightly differently if the incoming request is NTLM vs. Kerberos vs. ADFS, etc. Does anyone have an example of how to determine the incoming authentication method in C#?

Alternatively, is there a way to identify this by the current SPContext?

Thanks

EDIT: I have found that "HttpContext.Current.User.Identity.AuthenticationType" will return "NTLM" or "Kerberos" in a string. However, I still don't see a way to identify if using ADFS...

Answer 1

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this.

Here's the idea (point by point):

1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN

2) In Testing Whether ADFS User Is Authenticated they cast the user identity to the SingleSignOnIdentity object to test user authentication in ADFS. Which led me to the idea of "What happens if it isn't an SSO identity and you attempt to cast?"

3) And with that idea I found a couple posts that say that if a user's identity is not an SSO identity, an InvalidCastException will be thrown:

ADFS Identity Single Sign On Identity

ADFS System.Web.Security.SingleSignOn.SingleSignOnIdentity

4) So the C# would look something like:

bool isADFS;

try
{
    SingleSignOnIdentity tryADFS = (SingleSignOnIdentity)User.Identity;
    isADFS = true;
}
catch (InvalidCastException) // Not ADFS
{
    isADFS = false;
}

Or perhaps:

bool isADFS = false;
if (User.Identity is SingleSignOnIdentity)
    isADFS = true;

Like I said, I have no way to test it, but I think that should work. Let me know.

Answer 2

@James Love got this on the head, you need to take a look at the cookies

Check out this project "Remote authentication with claims" I believe the answer is here in the code.

It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.