Authenticate user before getting a SPUserToken object

Question

I know that a user can be impersonated by using an SPUserToken object when constructing an SPSite.

I need to authenticate the user before getting a token for the user as I am developing an application that will stand between the user and SharePoint 2010 server. Users will be authenticated by the application first. The application will then make calls to SharePoint with the user token.

Should I use WebSvcAuthentication to auhtenticate the user then get his token from AllUsers list? AFAIK WebSvcAuthentication works only with forms-based-authentication. Is that right?

Thanks in advance.

Answer 1

You could impersonate:

[DllImport("advapi32.dll", SetLastError = true)]
static extern bool LogonUser(string principal, string authority, string password, LogonSessionType logonType, LogonProvider logonProvider, out IntPtr token);

[DllImport("kernel32.dll", SetLastError = true)]
static extern bool CloseHandle(IntPtr handle);

enum LogonSessionType : uint {
    Interactive = 2,
    Network,
    Batch,
    Service,
    NetworkCleartext = 8,
    NewCredentials
}

enum LogonProvider : uint {
    Default = 0,
    WinNT35,
    WinNT40, //NTLM
    WinNT50  //Kerb or NTLM
}

public void DoSomething() {
    IntPtr token = IntPtr.Zero;
    WindowsImpersonationContext user = null;
    try {
        bool loggedin = LogonUser("principal", "authority", "password", LogonSessionType.Interactive, LogonProvider.Default, out token);
        if (loggedin) {
            WindowsIdentity id = new WindowsIdentity(token);
            user = id.Impersonate();
                    //do your stuff as the user
        }
    } finally {
        if (user != null) {
            user.Undo();
        }
        if (token != IntPtr.Zero) {
            CloseHandle(token);
        }
    }
}

Answer 2

If your application is authenticating the user, and you want that same authentication to carry over to SharePoint, then your only choice is to configure SharePoint to trust the identity provider that your app is using.

Answer 3

Check here for the impersonation options :

Impersonation in SharePoint : An Extreme Overview