views:

221

answers:

2

I have a web page that runs under an account named, WebUser (IIS runs under this account)

Now the problem here is that, when the webpage is accessed by users (intranet),
users are authenticated through Windows Authentication.

The webpage calls a stored procedure, SaveClientInfo. When I was trying to get the user's name (say, User1) who was calling SaveClientInfo,
I was getting WebUser instead of User1 through SYSTEM_USER

Is there a way to get User1 from SaveClientInfo without having to pass in the user name to the stored procedure?

Here is the relevant piece of sproc definition

create procedure SaveClientInfo
 @ClientID int
 ... --; other parameters
as
begin
 declare @UserName sysname
 --; returns the name of user name that IIS runs under
 --; But I would like to log the name of the person 
 --; who is accesing the site through Windows Authentication
 select @UserName = SYSTEM_USER 

 --; Save client data and the person who saved the info
 ...
end
GO
A: 

Retrieving the name of the user from the SQL should just give you the username associated with the connection - typically, the user account used by ASP.NET.

On the .NET side, You can use (C#)

string s = Environment.User.Identity.Name

to retrieve the name of the user logged into your site. We use this to track who's making changes to the db through our admin site, among other thngs.

David Lively
I am trying to avoid having to create a new parameter like @UserName for *every* sprocs that saves information.
Sung Meister
The problem is, as Chris J pointed out, that the logged in user isn't talking to the SQL server. ASP.NET is, using its own permissions. You're going to *have* to pass some parameter in identifying the user. Whether that's a session ID, username or what have you, there's no real way to avoid this.Also, IMHO, doing so is poor database and DAL design.
David Lively
+1  A: 

Unless you use impersonation in your web app, so the web application connects as the Windows authenticated user, no you can't.

Chris J