How to pass user's identity to Client Object Model when using ASP.net?

Question

How can I pass an authenticated user's identity through the Client-Object Model?

SP 2010, Client Object Model code is on an IIS server. I want to pass the already authenticated Windows user to SharePoint.

 lblCredentials.Text = HttpContext.Current.User.Identity.Name;
    //lblCredentials.Visible = true;

    using (ClientContext context = new ClientContext("https://myserver.com"))
    {
        context.Credentials = CredentialCache.DefaultNetworkCredentials;  // has no effect
        context.Load(context.Web.CurrentUser);
        context.ExecuteQuery();
        lblProdUserName.Text = context.Web.CurrentUser.LoginName;
    }    

In the code above my HttpContext.Current.User.Identity.Name is the user name from the browser. While the context.Web.CurrentUser is the username that is running the IIS Website (e.g. the Application Pool).

How can I specify that my COM code uses the HttpContext.Current.User.Identity.Name user?

I know I could use context.Credentials = new NetworkCredential("user", "password", "domain");

However, this is a windows account and I don't have the users password.

Answer 1

As per my understanding you cannot do this due to double hop issue. Basically you cannot impersonate currently logged in user to SharePoint CSOM. Though you turn on impersonation of your asp.net application on which your CSOM would run. It will only authenticate current asp.net application but it won't pass this credentials to remote server.

According to a Microsoft KB article: The double-hop issue is when the ASPX page tries to use resources that are located on a server that is different from the IIS server.

Below is some write up from a article which explains in details.

Web application (or rather windows) simply refused to forward impersonated credentials. And if it did, windows wouldn’t carry them across properly, so the web application calling the web service(CSOM in your case) wouldn’t even get across the windows authentication in IIS.

The reason for this was the so called double-hop issue. Basically, what this means is that although windows will allow you to use impersonated credentials to access local resources, it won’t allow you to delegate the impersonated credentials to another remote resource (such as our CSOM). The reason the whole thing worked when I was testing it was because in my case only a single hop was involved because my web server and user agent were on the same machine. So the only single hop was from the client/web server machine to the SharePoint server.

Though you won't like it but you need to pass a super-user credentials via option you know

context.Credentials = new NetworkCredential("user", "password", "domain");