SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using SharePiont Server 2007 Enterprise with Windows Server 2008 Enterprise. I am developing using VSTS 2008 + C# + .Net 3.5. I am wondering whether SharePoint has any means to set an anonymous user to be some specific user by code automatically?

For example, I want to set the anonymous to be administrator automatically when the anonymous connects from a specific IP address to access default.aspx (i.e. no need to let the user know password of administrator if the user connects from a special machine with a special IP address). Another example is when anonymous user connects my site using special connection string, like http://mysite/default.aspx?specialtestuser=foo,then I will set current anonymous to be foo.Appreciate if any code samples to reference?

BTW: I am using Forms authentication, not sure whether in Forms authentication in SharePoint, there are any ways to set the anonymous user to someone based on some custom defined rules(e.g. IP address or http parameter)?

share|improve this question
up vote 1 down vote accepted

This method: FormsAuthentication.SetAuthCookie() has worked for me in the past when I was trying to create an NTLM login into FBA.

share|improve this answer
1. If I call FormsAuthentication.SetAuthCookie("foo", false), then in the continuous interactions between the end user browser, the end user will be treated as "foo"? 2. Another confusion is, if I am using an XML file to store user name and password for my custom Forms Authentication, but no user called "foo", what will be happened if I call FormsAuthentication.SetAuthCookie("foo", false)? – George2 Nov 26 '09 at 17:54
1. yes 2. I don't know, i'm assuming they will just continue being anonymous. – Steve Lineberry Nov 26 '09 at 21:35
Also, you should know that the auth cookie gets sent to the client together with the reponse. Between your call to SetAuthCookie() and the end of the response the client will not be authenticated. The client will have to make another request to the server which posts the cookie to the server which is required for the server to recognise the client as an authorised user. – Jaap Vossers Nov 27 '09 at 0:41
Thanks Jaap, question answered! – George2 Dec 6 '09 at 9:51

The above question sounds a bit scary to me. You do realize that IP's can be spoofed? It sounds like a very insecure way to handle administrative privileges. If i was in your IT department, i would be worried :-)

share|improve this answer
I agree, but he did say in the question that the scenerio was "For Example". Anything like this should go under extensive testing and security audits. – Steve Lineberry Nov 26 '09 at 21:37

Jumping on Anders wagon here. Doing that will create a security risk on your SharePoint environment and I would advise against it.

share|improve this answer

Even though it's dangerous, it can be quite powerful if you now what you are doing.

I have done something similar before, where people could switch the identity of the current user to another one simply by clicking on a username in a list of available users. Obviously this is something you would only use for dev and testing purposes and NOT FOR PRODUCTION.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.