3

I have an application deployed on IIS 8 having forms authentication mode. Now there is a requirement where business wants to show a popup message and create an audit log if the Windows User and the Application user is different.

For this I want to get the Windows Logged in user on logincontrol of the applicaiton. I have tried many ways but nothing is helping.

Please guide me if it is possible or not.

Guys anyone.. Please help me...

Atish Singh
  • 85
  • 1
  • 2
  • 10
  • How about http://stackoverflow.com/questions/6615680/asp-net-getting-current-user-name (last post)? – Reporter Dec 19 '14 at 10:17
  • This can help you [Link](http://stackoverflow.com/questions/5417125/how-to-get-current-user-whos-accessing-asp-net-app) – LPs Dec 19 '14 at 10:20
  • If you are using forms auth then the app has no knowledge of a windows user. In theory there may not be one, even if in practice there is. From the point of view of the web app the user is the forms auth user, there is no windows user. If you used windows authentication then it is trivial. – Ben Robinson Dec 19 '14 at 10:22
  • None of the above are working for me. – Atish Singh Dec 19 '14 at 10:40
  • Forms authentication != windows authentication. The client browser will not tell you who they are if you do not request it (by running windows authentication or sending headers causing the same authentication). – sisve Dec 19 '14 at 12:16
  • make sure Anonymous Authentication is turned off – Tom Stickel Jul 07 '16 at 23:54

1 Answers1

16

I use this site as a reference:

http://richhewlett.com/2011/02/15/getting-a-users-username-in-asp-net/

(reposted summary in case site goes down)

Scenario 1: Anonymous Authentication in IIS with impersonation off. 

HttpContext.Current.Request.LogonUserIdentity.Name  COMPUTER1\IUSR_COMPUTER1
HttpContext.Current.Request.IsAuthenticated False
HttpContext.Current.User.Identity.Name  -
System.Environment.UserName ASPNET
Security.Principal.WindowsIdentity.GetCurrent().Name    COMPUTER1\ASPNET

Scenario 2: Windows Authentication in IIS, impersonation off. 

HttpContext.Current.Request.LogonUserIdentity.Name  MYDOMAIN\USER1
HttpContext.Current.Request.IsAuthenticated True
HttpContext.Current.User.Identity.Name  MYDOMAIN\USER1
System.Environment.UserName ASPNET
Security.Principal.WindowsIdentity.GetCurrent().Name    COMPUTER1\ASPNET

Scenario 3: Anonymous Authentication in IIS, impersonation on 

HttpContext.Current.Request.LogonUserIdentity.Name  COMPUTER1\IUSR_COMPUTER1
HttpContext.Current.Request.IsAuthenticated False
HttpContext.Current.User.Identity.Name  -
System.Environment.UserName IUSR_COMPUTER1
Security.Principal.WindowsIdentity.GetCurrent().Name    COMPUTER1\IUSR_COMPUTER1

Scenario 4: Windows Authentication in IIS, impersonation on

HttpContext.Current.Request.LogonUserIdentity.Name  MYDOMAIN\USER1
HttpContext.Current.Request.IsAuthenticated True
HttpContext.Current.User.Identity.Name  MYDOMAIN\USER1
System.Environment.UserName USER1
Security.Principal.WindowsIdentity.GetCurrent().Name    MYDOMAIN\USER1
brothers28
  • 1,196
  • 17
  • 23
user3036342
  • 1,023
  • 7
  • 15
  • OP is using forms auth, so none of these is helpful. – Ben Robinson Dec 19 '14 at 10:23
  • None of these are helping me. I also tried using Request.ServerVariables["LOGON_USER"] but it is also returning empty string because the Anonymous Authentication is enabled in IIS. If I disable the Anonymous authentication, then the Forms Auth doesn't work. Guys Please help me. – Atish Singh Dec 19 '14 at 10:37
  • Are you using MVC at all? Because you can specify which actions are anonymous and which aren't based off of that. – user3036342 Dec 19 '14 at 11:05
  • BTW, I have forms authentication on my website without anonymous rights. Let the Application Pool run under "Network Service" instead of "Local Service" and turn off anonymous and see. That's how I have it setup (forms + windows. no anonymous. network service on application pool) – user3036342 Dec 19 '14 at 11:07
  • I force forms auth on my web.config btw – user3036342 Dec 19 '14 at 11:09
  • I am not using MVC. App Pool is running under Network Service account. If I disable the Anonymous authentication and browse my application, Login page doesn't come up instead HTTP error "Page Not Found" come up. I have authorization tag in my web.config with Deny Users=?. – Atish Singh Dec 19 '14 at 11:27
  • 1
    Turn on Windows Authentication with Forms Authentication. Your application will default to Forms authentication but you should be able to pickup the logged in user and keep anonymous off. That's how I have it in production. Actually, I check if I can find the logged in user, and automatically log them in. If I can't find the user, I show them the form. – user3036342 Dec 19 '14 at 11:30
  • As soon as I turned off the Anonymous authentication, I get the error "404 - File or directory not found." – Atish Singh Dec 19 '14 at 11:36
  • I know this is an old post but just to confirm I had the same issue and the advice from @user3036342 worked for me even though IIS8 said that you can't have both FORMS and WINDOWS AUTHENTICATION enabled. – Mych Oct 05 '15 at 10:15
  • This displays the wrong user for me and not only that, I can't use it in javascript just to format the username. – Nathan McKaskle Dec 27 '17 at 16:40