I know that a user can be impersonated by using an SPUserToken object when constructing an SPSite.

I need to authenticate the user before getting a token for the user as I am developing an application that will stand between the user and SharePoint 2010 server. Users will be authenticated by the application first. The application will then make calls to SharePoint with the user token.

Should I use WebSvcAuthentication to auhtenticate the user then get his token from AllUsers list? AFAIK WebSvcAuthentication works only with forms-based-authentication. Is that right?

Thanks in advance.

3 Answers 3


You could impersonate:

[DllImport("advapi32.dll", SetLastError = true)]
static extern bool LogonUser(string principal, string authority, string password, LogonSessionType logonType, LogonProvider logonProvider, out IntPtr token);

[DllImport("kernel32.dll", SetLastError = true)]
static extern bool CloseHandle(IntPtr handle);

enum LogonSessionType : uint {
    Interactive = 2,
    NetworkCleartext = 8,

enum LogonProvider : uint {
    Default = 0,
    WinNT40, //NTLM
    WinNT50  //Kerb or NTLM

public void DoSomething() {
    IntPtr token = IntPtr.Zero;
    WindowsImpersonationContext user = null;
    try {
        bool loggedin = LogonUser("principal", "authority", "password", LogonSessionType.Interactive, LogonProvider.Default, out token);
        if (loggedin) {
            WindowsIdentity id = new WindowsIdentity(token);
            user = id.Impersonate();
                    //do your stuff as the user
    } finally {
        if (user != null) {
        if (token != IntPtr.Zero) {
  • I want to rely on SharePoint for authentication because the web application might be configured with forms-based auth or windows auth. I thought of authenticating the user first with Authentication.asmx, if that succeeds impersonate the user with SPUserToken. Is this a correct solution? Commented Jan 14, 2011 at 14:15
  • Just found out this post, so I will leave a notice here. I just had to resort to a similar implementation to resolve a problem I had. Anyway, the impersonation wasn't working: it turned out that was because I used "9" as the LogonSessionType (as done in many examples on the web)... when I switched to 8 like in the above sample, all started working. So, if you experience a similar behaviour, thinker around with the LogonSessionType param and see if it helps.
    – SPArcheon
    Commented Feb 5, 2013 at 11:32

If your application is authenticating the user, and you want that same authentication to carry over to SharePoint, then your only choice is to configure SharePoint to trust the identity provider that your app is using.


Check here for the impersonation options :

Impersonation in SharePoint : An Extreme Overview

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.