I am using SharePiont Server 2007 Enterprise with Windows Server 2008 Enterprise. I am developing using VSTS 2008 + C# + .Net 3.5. I am wondering whether SharePoint has any means to set an anonymous user to be some specific user by code automatically?

For example, I want to set the anonymous to be administrator automatically when the anonymous connects from a specific IP address to access default.aspx (i.e. no need to let the user know password of administrator if the user connects from a special machine with a special IP address). Another example is when anonymous user connects my site using special connection string, like http://mysite/default.aspx?specialtestuser=foo,then I will set current anonymous to be foo.Appreciate if any code samples to reference?

BTW: I am using Forms authentication, not sure whether in Forms authentication in SharePoint, there are any ways to set the anonymous user to someone based on some custom defined rules(e.g. IP address or http parameter)?

4 Answers 4


This method: FormsAuthentication.SetAuthCookie() has worked for me in the past when I was trying to create an NTLM login into FBA.

  • 1. If I call FormsAuthentication.SetAuthCookie("foo", false), then in the continuous interactions between the end user browser, the end user will be treated as "foo"? 2. Another confusion is, if I am using an XML file to store user name and password for my custom Forms Authentication, but no user called "foo", what will be happened if I call FormsAuthentication.SetAuthCookie("foo", false)?
    – George2
    Nov 26, 2009 at 17:54
  • 1. yes 2. I don't know, i'm assuming they will just continue being anonymous. Nov 26, 2009 at 21:35
  • Also, you should know that the auth cookie gets sent to the client together with the reponse. Between your call to SetAuthCookie() and the end of the response the client will not be authenticated. The client will have to make another request to the server which posts the cookie to the server which is required for the server to recognise the client as an authorised user. Nov 27, 2009 at 0:41

The above question sounds a bit scary to me. You do realize that IP's can be spoofed? It sounds like a very insecure way to handle administrative privileges. If i was in your IT department, i would be worried :-)

  • 1
    I agree, but he did say in the question that the scenerio was "For Example". Anything like this should go under extensive testing and security audits. Nov 26, 2009 at 21:37

Jumping on Anders wagon here. Doing that will create a security risk on your SharePoint environment and I would advise against it.


Even though it's dangerous, it can be quite powerful if you now what you are doing.

I have done something similar before, where people could switch the identity of the current user to another one simply by clicking on a username in a list of available users. Obviously this is something you would only use for dev and testing purposes and NOT FOR PRODUCTION.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.