SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that a user can be impersonated by using an SPUserToken object when constructing an SPSite.

I need to authenticate the user before getting a token for the user as I am developing an application that will stand between the user and SharePoint 2010 server. Users will be authenticated by the application first. The application will then make calls to SharePoint with the user token.

Should I use WebSvcAuthentication to auhtenticate the user then get his token from AllUsers list? AFAIK WebSvcAuthentication works only with forms-based-authentication. Is that right?

Thanks in advance.

share|improve this question
up vote 1 down vote accepted

You could impersonate:

[DllImport("advapi32.dll", SetLastError = true)]
static extern bool LogonUser(string principal, string authority, string password, LogonSessionType logonType, LogonProvider logonProvider, out IntPtr token);

[DllImport("kernel32.dll", SetLastError = true)]
static extern bool CloseHandle(IntPtr handle);

enum LogonSessionType : uint {
    Interactive = 2,
    NetworkCleartext = 8,

enum LogonProvider : uint {
    Default = 0,
    WinNT40, //NTLM
    WinNT50  //Kerb or NTLM

public void DoSomething() {
    IntPtr token = IntPtr.Zero;
    WindowsImpersonationContext user = null;
    try {
        bool loggedin = LogonUser("principal", "authority", "password", LogonSessionType.Interactive, LogonProvider.Default, out token);
        if (loggedin) {
            WindowsIdentity id = new WindowsIdentity(token);
            user = id.Impersonate();
                    //do your stuff as the user
    } finally {
        if (user != null) {
        if (token != IntPtr.Zero) {
share|improve this answer
I want to rely on SharePoint for authentication because the web application might be configured with forms-based auth or windows auth. I thought of authenticating the user first with Authentication.asmx, if that succeeds impersonate the user with SPUserToken. Is this a correct solution? – Élodie Petit Jan 14 '11 at 14:15
Just found out this post, so I will leave a notice here. I just had to resort to a similar implementation to resolve a problem I had. Anyway, the impersonation wasn't working: it turned out that was because I used "9" as the LogonSessionType (as done in many examples on the web)... when I switched to 8 like in the above sample, all started working. So, if you experience a similar behaviour, thinker around with the LogonSessionType param and see if it helps. – SPArchaeologist Feb 5 '13 at 11:32

If your application is authenticating the user, and you want that same authentication to carry over to SharePoint, then your only choice is to configure SharePoint to trust the identity provider that your app is using.

share|improve this answer

Check here for the impersonation options :

Impersonation in SharePoint : An Extreme Overview

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.