views:

1901

answers:

4

I'm creating an intranet asp.net mvc application that everyone in the company should have access to. I need to run the website impersonated for database access etc., but I want to know who each user is.

When I look at Page.User.Identity.Name it's blank. Is it possible to get the user's windows account name even though the site is running impersonated?

Edit: Here's a little more info. I have a site in IIS 6 running with anonymous access enabled. The site is running under a system account that has access to the database (because all of the employees do not have access to the database).

My web.config has <authentication mode="Windows" /> and <identity impersonate="true"/ >.

My goal is that the users won't have to log in - that fact that they are logged into our network (and the fact that the site is not on an external IP) is enough authentication. I would just like to know who the user is in order to track changes they make, etc.

+2  A: 

try this

Principal.WindowsIdentity.GetCurrent.Name

It should return a string with the users login name

Gavin Draper
Thanks Gav - I tried this and it displays the name of the account that my site is setup to run under (see the Edit in the question for more info).
MrDustpan
Think your going to need to disable annonymous access in IIS, when they visit the site assuming they are logged into the domain IIS will use their current login. The code above should then display their UserID rather than the one IIS runs under.
Gavin Draper
A: 

Unless this functionality has changed under the MVC framework, and I don't think it has, Page.User.Identity.Name should still work. Sounds like your site is set up to allow anonymous authentication. If so, try disabling it.

Ryan
Thanks Ryan. I added some more detail to the question, but basically I need anonymous authentication.
MrDustpan
Given the additional information, you want `<identity impersonate="false"/ >`. You want the web app to run under the identity provided by IIS. `impersonate="false"` makes sure this is the case. You also want to turn Integrated Authentication on and disable anonymous authentication. This insures that Page.User.Identity will be the identity of the user viewing the page. They shouldn't have to actually provide credentials if the server and users are on the same domain.
Ryan
And sorry for taking so long to reply. I haven't had a chance to participate here in a while.
Ryan
A: 

Via the Environment.UserName property?

Gregoire
+4  A: 

With <authentication mode="Windows"/> in your application and Anonymous access enabled in IIS, you will see the following results:

System.Environment.UserName: Computer Name
Page.User.Identity.Name: Blank
System.Security.Principal.WindowsIdentity.GetCurrent().Name: Computer Name

With <authentication mode="Windows"/> in your application, and ‘Anonymous access’ disabled and only ‘Integrated Windows Authentication’ in IIS, you will see the following results:

System.Environment.UserName: ASPNET (user account used to run ASP.NET service)
Page.User.Identity.Name: Domain\ Windows Account Name 
System.Security.Principal.WindowsIdentity.GetCurrent().Name: Computer Name\ASPNET

With <authentication mode="Windows"/> and <identity impersonate ="true"/> in your application, and ‘Anonymous access’ disabled and only ‘Integrated Windows Authentication’ in IIS, you will see the following results:

System.Environment.UserName: Windows Account Name 
Page.User.Identity.Name: Domain\ Windows Account Name 
System.Security.Principal.WindowsIdentity.GetCurrent().Name: Domain\ Windows Account Name
gokul