6

I am wondering if it is possible to pass credentials of current user to ExchangeService object.

Currently I am providing specific UserName/Password to WebCredentials in order to authenticate the ExchangeService access but instead I want to use credential of current user by using SPContext.Current.Web.CurrentUser.UserToken.

Here my code which create appointments:

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010_SP1);
service.Credentials = new WebCredentials("UserName", "password", "domain.contoso.com");
service.Url = new Uri("https://computername.domain.contoso.com/EWS/Exchange.asmx");

Appointment appointment = new Appointment(service);
foreach (MailAddress MailAddress in MailAddresses)
{
    appointment.RequiredAttendees.Add(MailAddress.Address);
}

appointment.Subject = Title;
appointment.Body = Summary;
appointment.Start = StartDate;
appointment.End = EndDate;
appointment.IsResponseRequested = true;
appointment.Save(SendInvitationsMode.SendToAllAndSaveCopy);
2
  • did you find any solution? – Schiavini Sep 25 '12 at 11:44
  • Yes, I decided to go with impersonation and it's working great for last six months now. – Firoz Ansari Sep 25 '12 at 14:15
6

You can impersonate the user account.

ExchangeService service = new ExchangeService(ExchangeVersion.Exchange2010_SP1);
service.Credentials = new NetworkCredential("serviceAccount", "serviceAccountPassword", "domain");
service.Url = new Uri("https://computername.domain.contoso.com/EWS/Exchange.asmx"); 
service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress,"userEmail");

Refer to msdn for more information. Hope this helps.

1
  • 1
    Thanks for your reply. To use impersonation, I will require to enable impersonation property for serviceAccount user. Will it not create any security risk in whole organization? Any developer with serviceAccount/Password can access others mail-box without their consent. – Firoz Ansari Feb 14 '12 at 16:23
2

This should work:

service.Credentials=CredentialCache.DefaultCredentials;
2
  • 1
    Thanks Amit. I am getting this error with DefaultCredentials. Erorr: "When making a request as an account that does not have a mailbox, you must specify the mailbox primary SMTP address for any distinguished folder Ids." – Firoz Ansari Feb 14 '12 at 17:46
  • @FirozAnsari - When you use any WellKnownFolderName you need to make a FolderId with the smtp address of the mailbox. e.g. new FolderId(WellKnownFolderName.Calendar, "primary@contoso.com"); see msdn.microsoft.com/en-us/library/office/…. This is called 'delegate' access, where you're using permissions given to the identity you're connecting as. This is an alternative to 'impersonation' that means you're assuming the identity of the mailbox you're connecting to. – Rory Oct 13 '16 at 13:18
1

If your authentication is set to NTLM then this is not an option due to the well-known double hop issue. In this case, you must create a new token in the middle layer as you are doing now. This does open a security hole as anyone with access to the code can see the user ID and Password needed to access Exchange. You could always encrypt and store these values somewhere (like the registry) and pull them from there instead of hard-coding them. This is a better option but still not ideal.

If you are using Kerberos then passing the token should work, provided that both your site and the Exchange server are also configured properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.