How can I pass an authenticated user's identity through the Client-Object Model?

SP 2010, Client Object Model code is on an IIS server. I want to pass the already authenticated Windows user to SharePoint.

 lblCredentials.Text = HttpContext.Current.User.Identity.Name;
    //lblCredentials.Visible = true;

    using (ClientContext context = new ClientContext("https://myserver.com"))
        context.Credentials = CredentialCache.DefaultNetworkCredentials;  // has no effect
        lblProdUserName.Text = context.Web.CurrentUser.LoginName;

In the code above my HttpContext.Current.User.Identity.Name is the user name from the browser. While the context.Web.CurrentUser is the username that is running the IIS Website (e.g. the Application Pool).

How can I specify that my COM code uses the HttpContext.Current.User.Identity.Name user?

I know I could use context.Credentials = new NetworkCredential("user", "password", "domain");

However, this is a windows account and I don't have the users password.

1 Answer 1


As per my understanding you cannot do this due to double hop issue. Basically you cannot impersonate currently logged in user to SharePoint CSOM. Though you turn on impersonation of your asp.net application on which your CSOM would run. It will only authenticate current asp.net application but it won't pass this credentials to remote server.

According to a Microsoft KB article: The double-hop issue is when the ASPX page tries to use resources that are located on a server that is different from the IIS server.

Below is some write up from a article which explains in details.

Web application (or rather windows) simply refused to forward impersonated credentials. And if it did, windows wouldn’t carry them across properly, so the web application calling the web service(CSOM in your case) wouldn’t even get across the windows authentication in IIS.

The reason for this was the so called double-hop issue. Basically, what this means is that although windows will allow you to use impersonated credentials to access local resources, it won’t allow you to delegate the impersonated credentials to another remote resource (such as our CSOM). The reason the whole thing worked when I was testing it was because in my case only a single hop was involved because my web server and user agent were on the same machine. So the only single hop was from the client/web server machine to the SharePoint server.

Though you won't like it but you need to pass a super-user credentials via option you know

context.Credentials = new NetworkCredential("user", "password", "domain");
  • 1
    I was under the impression this issue was only for NTLM and if I use Kerberos it is not an issue. I am using Kerboeros Dec 21, 2016 at 18:07
  • you are right, in that case..you don't need to pass anything...or you can pass default credentails.... did you tried CredentialCache.DefaultCredentials ? Dec 21, 2016 at 18:15
  • Yes, I tried settingcontext.Credentials = CredentialCache.DefaultNetworkCredentials; Dec 21, 2016 at 18:25
  • not network..user "DefaultCredentials" and also try once without passing anything... Dec 21, 2016 at 18:27
  • context.Credentials = CredentialCache.DefaultNetworkCredentials; // If I have this, or don't have it I get the same behavior Dec 21, 2016 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.