I am working on a solution that needs to act slightly differently if the incoming request is NTLM vs. Kerberos vs. ADFS, etc. Does anyone have an example of how to determine the incoming authentication method in C#?

Alternatively, is there a way to identify this by the current SPContext?


EDIT: I have found that "HttpContext.Current.User.Identity.AuthenticationType" will return "NTLM" or "Kerberos" in a string. However, I still don't see a way to identify if using ADFS...

  • 1
    All three NTLM, Kerberos, and ADFS are represented by AuthenticationMode.Windows using SPSecurity.AuthenticationMode which is the OM property for this. Have you looked into accessing the cookies? I'm not even sure if they'd contain the right information for you... Commented Oct 31, 2012 at 16:54
  • Have you tried to see if there's any clues in cookies or headers set by SharePoint when logged in? FBA leaves a 'FedAuth' cookie, ADFS may leave the same, or something different, and the Response Header may (or may not) have a clue.
    – James Love
    Commented Nov 30, 2012 at 22:04
  • I take it my solution worked? Commented Dec 3, 2012 at 14:42

2 Answers 2


After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this.

Here's the idea (point by point):

1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN

2) In Testing Whether ADFS User Is Authenticated they cast the user identity to the SingleSignOnIdentity object to test user authentication in ADFS. Which led me to the idea of "What happens if it isn't an SSO identity and you attempt to cast?"

3) And with that idea I found a couple posts that say that if a user's identity is not an SSO identity, an InvalidCastException will be thrown:

ADFS Identity Single Sign On Identity

ADFS System.Web.Security.SingleSignOn.SingleSignOnIdentity

4) So the C# would look something like:

bool isADFS;

    SingleSignOnIdentity tryADFS = (SingleSignOnIdentity)User.Identity;
    isADFS = true;
catch (InvalidCastException) // Not ADFS
    isADFS = false;

Or perhaps:

bool isADFS = false;
if (User.Identity is SingleSignOnIdentity)
    isADFS = true;

Like I said, I have no way to test it, but I think that should work. Let me know.


@James Love got this on the head, you need to take a look at the cookies

Check out this project "Remote authentication with claims" I believe the answer is here in the code.

It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.

  • I'm awarding you the bounty as your answer is also valid and if they don't go to someone, the points go to the Netherrealm. I just left it running a little while longer to see if anyone had a better answer. Commented Dec 6, 2012 at 21:56
  • No but I will bring it up at SharePoint Saturday and find out if there is. Love and peace thank you.
    – Hugh Wood
    Commented Dec 7, 2012 at 8:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.