Sharepoint 2013 web part does't impersonate current user, while SP 2010 does?

Question

I'm developing full trust web part deployed in GAC that access soap web service on localhost. Web service uses windows authentication. SP 2010 web part impersonates current user while SP 2013 sends app pool identity?

On both SP's NTML authentication is configured.

This is web.config portion for 2010

<authentication mode="Windows">
    <identity impersonate="true">
    <authorization>
       <allow users="*">
    </authorization>

And in 2013 I have this:

<authentication mode="Forms">
    <forms loginUrl="/_login/default.aspx">
</authentication>
<identity impersonate="true">
    <authorization>
         <allow users="*">
    </authorization>
    <add key="aspnet:AllowAnonymousImpersonation" value="false">

It does't help if I change it to windows auth like in 2010?

Impersonating spuser doesn't help olso:

SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite site = new SPSite(siteid, SPContext.Current.Web.CurrentUser.UserToken))
    {
        using (SPWeb web = site.OpenWeb(webid))
        {
            SOAPService ws = new SOAPService() { UseDefaultCredentials = true };
            var res = ws.BugGetAllBugs();

            GridView1.DataSource = res;
            GridView1.DataBind(); 
        }
    }
});

Answer 1

The difference is in "authentication mode" settings.

Windows authentication provides real windows user and then this would allow us to make resource requests from ASP.NET while impersonating the Windows identity of whoever was logged on.

With forms authentication ASP.NET itself makes requests for system resources using the Application Pool account. Look http://www.appetere.com/Blogs/SteveM/October-2011/Identity-impersonation-with-IIS-and-ASP-NET for details.

The RunWithElevatedPrivileges runs the code inside in a new thread. This new thread runs under the account of the current application pool. The usage of new SPSite with user token opens only the SPSite in the context of the defined user and does not start new thread. You can track the current user by calling WindowsIdentity.Current

Answer 2

At the end I used this code to impersonate current user to local web service:

try
{
    Guid siteid = SPContext.Current.Site.ID;
    Guid webid = SPContext.Current.Web.ID;

    using (SPSecurityContext.GetWindowsIdentity().Impersonate())
    {
        Label1.Text = WindowsIdentity.GetCurrent().Name;
        SOAPService ws = new SOAPService() { UseDefaultCredentials = true };
        var res = ws.GetAllBugs();

        GridView1.DataSource = res;
        GridView1.DataBind(); 
    }
}
catch (Exception ex)
{

    Response.Write("Error received: " + ex.Message);
}