I know that a user can be impersonated by using an SPUserToken object when constructing an SPSite.
I need to authenticate the user before getting a token for the user as I am developing an application that will stand between the user and SharePoint 2010 server. Users will be authenticated by the application first. The application will then make calls to SharePoint with the user token.
Should I use WebSvcAuthentication to auhtenticate the user then get his token from AllUsers list? AFAIK WebSvcAuthentication works only with forms-based-authentication. Is that right?
Thanks in advance.