I developed a SVC on SharePoint 2010 that uses MultipleBaseAddressWebServiceHostFactory. Inside of some methods I need to know who's the caller.

I find that I have two way to get it:

Thread.CurrentPrincipal.Identity.Name (for basic)
ServiceSecurityContext.Current.WindowsIdentity.Name (for windows auth)

This works great with IE. If I try to access the web service from Firefox or PowerPivot the values are null and so I cannot find out who is the caller.

I tried tons of web.config but the fact is:

  • If I disable Anonymous auth, SharePoint throws an Exception
  • If I disable Windows auth, SharePoint throws an Exception

I also tried to put some "denies" on Anonymous users without any result.

As is I have no web.config so the configuration of MultipleBaseAddressWebServiceHostFactory.

This is the interface of my service:

 public interface IGetListData
     [WebInvoke(Method = "GET", BodyStyle = WebMessageBodyStyle.Bare, ResponseFormat = WebMessageFormat.Xml, RequestFormat = WebMessageFormat.Xml)]
     System.IO.Stream GetData(string SiteUrl, string ListName, string ViewName);

Is there any way to tag the method as "only basic auth"? I tried with [HttpBasic...] without any result.

Thank you very much!!!

2 Answers 2


If you have deployed the .SVC in the SharePoint ISAPI folder then the web service should be running "in context" and you should be able to get the current user from the SPContext.Current.Web.User object.

  • SPContext.Current didn't contain a User object.. The unique way is use SPContext.Current.Web.CurrentUser that is null.. Do I need other reference / installation steps?
    – Ziba Leah
    Commented Jul 11, 2013 at 7:55
  • 1
    Is your web service endpoint under "_layouts" or "_vti_bin"? It makes a difference in terms of the SPContext object. Commented Jul 12, 2013 at 18:04
  • is deployed under the _vti_bin folder
    – Ziba Leah
    Commented Jul 15, 2013 at 7:17
  • 1
    Well... it works for me :) Commented Jul 20, 2013 at 7:42

After deploying the service under the TEMPLATE\LAYOUTS folder the impersonation has work correctly.

The Service now uses the factory config to define endpoints and so on, without custom configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.