Why do Thread.CurrentPrincipal.Identity and WindowsIdentity.GetCurrent() differ when impersonation is turned on?

asp.net security impersonation windows-identity current-principal
Pavel Voronin picture Pavel Voronin · Aug 13, 2013 · Viewed 7.2k times · Source

I enabled impersonation and Windows authentication.

<authentication mode="Windows" />
<identity impersonate="true" userName="name" password="passord"/>

But Thread.CurrentPrincipal.Identity.Name returns the name of authenticated user and WindowsIdentity.GetCurrent() returns impersonated identity.

Shouldn't these identities be the same?

And under which credentials does the code run in this case?

Answer

Andrei Zubov picture Andrei Zubov · Aug 13, 2013

As far as I can understand the Thread.CurrentPrincipal contains the information of conditions the thread has been started with, including the WindowsIdentity. That's why Thread.CurrentPrincipal.Identity.Name returns the name of User who started the thread. To the contrary WindowsIdentity.GetCurrent() Returns a WindowsIdentity object that represents the current Windows user, which has been changed via Impersonation. I'm not 100% sure about it, but that's how I think it works.

Related questions

How to Start/Stop a Windows Service from an ASP.NET app - Security issues

Here's my Windows/.NET security stack: A Windows Service running as LocalSystem on a Windows Server 2003 box. A .NET 3.5 Website running on the same box, under "default" production server IIS settings (so probably as NETWORKSERVICE user?) On my default VS2008 …

Read More
What are all the user accounts for IIS/ASP.NET and how do they differ?

Under Windows Server 2008 with ASP.NET 4.0 installed there is a whole slew of related user accounts, and I can't understand which one is which, how to they differ, and which one is REALLY the one that my app runs under. …

Read More
X-Frame-Options Allow-From multiple domains

I have an ASP.NET 4.0 IIS7.5 site which I need secured using the X-Frame-Options header. I also need to enable my site pages to be iframed from my same domain as well as from my facebook app. Currently I have …

Read More