Impersonate Windows Identity in Entity Framework Core

Question

I have an ASP.NET Core application that operates on a SQL database using Entity Framework Core. However, instead of the application pool user I would like to log in to SQL as the user sending the http request (currently using Windows Authentication through IIS). Is this supported by Entity Framework?

services.AddDbContext<Data.MyDbContext>(o =>
    o.UseSqlServer(Configuration.GetConnectionString("MyConnectionString")));

My connection string is "Server=MYSERVER;Database=MyDatabase;Trusted_Connection=True;"

Is there any way to tell EF what credentials to use to log in to SQL, other than specifying a UserId and Password in the connection string? — Kyle McClellan, Dec 13 '17 at 20:51
Possible, an answer https://stackoverflow.com/questions/20216147/entity-framework-change-connection-at-runtime — Dmitriy, Dec 13 '17 at 21:01

score 1 · Accepted Answer · edited Jun 20 '20 at 09:12

It doesn't look like this is supported by EF. From user @divega here: https://github.com/aspnet/Home/issues/1805

Does EF have other ways to control the authentication process? Or other recommendations for authorizing individual user access to the database?

No, EF Core (as well as previous versions) is agnostic to this concern, i.e. it assumes that the underlying database connection will be capable of accessing the database."

Also explained there, as long as Windows Auth is used this can be done using WindowsIdentity.RunImpersonated() on an as-need basis, but all code within the action must be synchronous (until .NET Core adds async versions of RunImpersonated).

public void SaveChangesAsUser(WindowsIdentity identity)
{
    WindowsIdentity.RunImpersonated(identity.AccessToken, this.SaveChanges);
}

Impersonate Windows Identity in Entity Framework Core

1 Answers1