4

I created a webpart that is able to consume a service provided by Dynamics NAV 2009 R2. I documented in short what I did so far: http://shb.vps.bitfolk.com/nav-sharepoint.html

I use the following method to get a swsEmployeeCard-Object:

private swsEmployeeCard GetTestEmployeeCard()
{
    swsEmployeeCard_Service service = new swsEmployeeCard_Service();
    String companyName = "CRONUS-Schweiz-AG";
    service.Url = "http://localhost:7047/DynamicsNAV/WS/"
        +companyName
        +"/Page/swsEmployeeCard";
    service.Credentials =
        new System.Net.NetworkCredential("USER", "PASSWD", "DOMAIN");
    return service.Read("1000");
}

Now, it comes to where I get stuck. I have to pass credentials to the webservice (see service.Credentials = ... in code above). Needless to say that hard coded credentials are not very much what we want. So my question is: "How do I get User, Password and Domain from Sharepoint in which my webpart runs?"

I tried something like

private SPUser GetCurrentUser()
{
    SPWeb currentWeb = SPContext.Current.Web;
    SPUser currentUser = currentWeb.CurrentUser;
    return currentUser;
}

but I could not figure out how to get the above mentioned parameters out of this SPUser object.

Edit

I followed the link (configuring-kerberos-authentication-in-sharepoint) mentioned above. I changed code from

private swsEmployeeCard GetTestEmployeeCard()
{
    // snip
    service.Credentials =
        new System.Net.NetworkCredential("USER", "PASSWD", "DOMAIN");
    // snip

to

private swsEmployeeCard GetTestEmployeeCard()
{
    // snip
    service.UseDefaultCredentials = true;
    // snip

And I got an error in Sharepoint like

// snip
System.Web.Services.Protocols.SoapException:
The login failed when connecting to SQL Server MYSERVER.
// snip

Obviously I am not using the proper way to pass credentials. What do I have to do, now I have Kerberos.

Edit (David):

On further investigation, it seems that UseCurrentCredentials may be using NT AUTHORITY\IUSR, the IIS user. There is an additional configuration which we are missing here.

Additionally, the below does not work either:

//Create the Windows Identity for impersonation
    WindowsIdentity windowsIdentity = null;

    string upnFromClaim = null;
    foreach (Microsoft.IdentityModel.Claims.Claim claim in currentIdentity.Claims)
    {
        if (StringComparer.Ordinal.Equals(System.IdentityModel.Claims.ClaimTypes.Upn, claim.ClaimType))
        {
            upnFromClaim = claim.Value;
            break;
        }
    }

    SPSecurity.RunWithElevatedPrivileges(
        delegate
        {
            windowsIdentity = S4UClient.UpnLogon(upnFromClaim); //TODO Continue here

            //Check the C2WTS Windows Identity
            if (windowsIdentity != null)
            {
                //Make call as impsersonated user.
                using (WindowsImpersonationContext ctx = windowsIdentity.Impersonate())
                {
                    //Call service here
                }
            }
2
  • the last part "doesn't work" means wrong identity?
    – Gwny
    Commented Aug 27, 2015 at 9:23
  • Exactly, the service gives an access denied error even though impersonation works
    – David
    Commented Aug 29, 2015 at 18:44

1 Answer 1

2

The SPUser object doesn't carry password information. That is sent alongside whatever authentication you're using. If it's NTLM, unfortunately (for your purposes, anyway; there are very good reasons for this), you aren't going to be able to retrieve the password. This stems from a problem called the Double Hop Issue.

One way, perhaps the easiest way to get around this if you're using NTLM-based authentication is to switch to Kerberos. It has a lot of steps, and sometimes if you skip one or two you get some weird results, but it's doable and it's still not rocket surgery:

http://blogs.msdn.com/b/russmax/archive/2009/10/20/configuring-kerberos-authentication-in-sharepoint-2010-part-1.aspx

Beyond that, if you just need any credentials, you could always hardcode something, of course.

3
  • John, I tried what you recommended (see my answer below). Have you got any other hints? Cheers Sam
    – user17714
    Commented Jun 21, 2013 at 12:49
  • @user17714 The "answer" is now moved to be a part of your question.
    – Benny Skogberg
    Commented Mar 24, 2014 at 7:32
  • Also, Kerberos is configured properly for the above.
    – David
    Commented Aug 26, 2015 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.