We are creating a mobile web application that will run under ASP.Net and will connect to an internal SharePoint Server. We need to remotely authenticate users from this web application to see whether they have access to SharePoint Server data. The web application won't be connected to active directory. Do we have to use Authenticate.asmx in SharePoint? And one more detail, SharePoint Server can be running with Windows authentication or Forms Based authentication.

If someone sheds some light on this I will be grateful.

1 Answer 1


Authentication.asmx is the correct way of logging into SharePoint directly as you said. However occasionally you'll need to create your own Authentication ticket if you're working outside of SharePoint and need to pass something in via Kerberos.

This here is a good reference on the authentication.asmx webservice as it concerns .NET


Here is a reference for ASP.NET Windows Authentication if you'll need to pass a ticket in:


How to detect if you don't know what method to use? Authentication.asmx has a method Authentication.Mode() you should look at that returns what SharePoint sees so you can login accordingly. I imagine you could try to connect via .NET and if you get prompted with a 401, it's time to supply windows authentication.

(Footnote: This applies to SharePoint 2010, YMMV with other versions)

  • tekiegreg thank you. So after authenticating the users, when I have to run code on behalf of the user should I use SPUserToken? Commented May 14, 2011 at 18:16
  • Quite Simply yes, SPUserToken represents both the authentication type and user authenticated. Or see here: msdn.microsoft.com/en-us/library/…
    – tekiegreg
    Commented May 14, 2011 at 21:05
  • And what if the site is not configured for forms based auth? The docs says that Authentication.asmx is for FBA? Commented May 14, 2011 at 21:07
  • Authentication.Mode() Should return your authentication type no matter what your actual Authentication type is. After that, Authentication.asmx is useless if using Windows Authentication. But again if you get prompted for a 401 when going anywhere, you know you need to supply authentication via windows.
    – tekiegreg
    Commented May 14, 2011 at 21:09
  • So if authentication mode is Forms Based, then I will go ahead and authenticate with Authentication.asmx. If the mode is Windows authentication, then I should authenticate by impersonating the user? Commented May 14, 2011 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.