I'm currently looking to secure my ASP.NET Web API service using windows authentication. In terms of configuration, this is quite simple, and is explained here. Then, in order to secure your API, you place [Authorize]
attributes on your controllers or actions.
However, if I wanted to check if a user was authenticated in a custom message handler prior to the request being routed, how would I do that? How do you pull the Windows identity out of the HTTP request and then check the active directory to see if the user is authenticated (essentially, how do you manually do whatever the [Authorize]
attribute is doing)?