Sharepoint 2016: IIS - using log-in credential identity instead of AppPool identity

Question

I have an aspx website which is deployed to a sharepoint 2016 server and have call to windows services (WCF) in another machine. I want to input a log-in credential and use this account for the request to windows services. But all requests have security token with AppPool identity, instead of my log-in account. My web.config:

<identity impersonate="true" />
<authentication mode="Forms" />
<authorization>
  <allow users="*" />
  <deny users="?" />
</authorization>

On IIS, I enable Windows Authentication, ASP.NET Impersonation and Anonymous Authentication (this is required by SP 2016 to access local resource).

When open the website, a log-in form is opened allow me to enter an account, I add log to default page to extract context's identity, and they are:

HttpContext, SPContext, Thread Principal, WindowsPrincipal users are all my log-in account --> OK as expected
But the WindowsIdentity is AppPool identity --> NOK
And WCF request token is AppPool identity --> NOK

So how can I configure/code to be able to setlog-in account to WCF request token?

Thank you.

Burst Burst · Accepted Answer · 2017-03-25T13:53:59

You have to construct the token required by an external service (WCF service in your case) by yourself.

In the standard SharePoint add-in project created from a Visual Studio SharePoint add-in template, all this code is provided by Microsoft as SharePointContext.cs and TokenHelper.cs files. You can study those 2 files as an example of how SharePoint add-in is supposed to build OAuth tokens, etc.

Sharepoint 2016: IIS - using log-in credential identity instead of AppPool identity

1 Answers