I've got a custom server control which does a web request to a HttpHandler (different site collection) on the same web application.

Everything works fine, except that the user account which does the web request is not the current SharePoint user but the IUSR account. I think this is called the double hop problem if I understood it right.

What I need is that the handler is called in the context of the current user, so that the handler can check who did the call.

My web application uses claims authentication, so I guess there should be a way to archive this.

2 Answers 2


Since you are using claims, I would guess you have SharePoint 2010. Have you configured the Secure Store? If you have, then you only need to set up an identity that will pass the credentials of the logged on user and call this identity in your control.

  • Thx for you reply. I'm using SP2010, but I don't see how the Secure Store would help me solving my issue or I don't know how to use it correctly. The problem I see is that I cannot set up entries in the secure store for each user that can do the web request (probably all) by hand.
    – Flo
    May 9, 2011 at 14:38
  • Another problem is, the user should really use their normal credentials to do the web request. So I won't know there password.
    – Flo
    May 9, 2011 at 15:04
  • You set up a single identity that will use the user's username and password as the credentials. It may initially prompt the user to enter those credentials, but will store the information.
    – Lori
    May 9, 2011 at 15:05
  • At any rate, the Secure Store is what you will have to use, unless you want to move to Kerberos to address the double hop issue (highly recommended).
    – Lori
    May 9, 2011 at 15:07

You could do the external request on the client via jQuery and then post the results to your server control. This would allow the external request to use the current user's permissions to get the data.

However, this approach could also allow tampering of the results prior to them being posted so you might want to include some level of encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.