Myujth

I am not so into .NET and I am finding the following difficulies.

I have a use case similar to this one: How to get HttpClient to pass credentials along with the request?

Basically I have a .NET web application (on which users can log in) running in the Azure cloud (it is an application running into SharePoint, I don't know if it could be a relevant details).

Into the back end of this webapp I implemented an ApiController controller that have to call another second REST API.

This second API is running on another environment (it should be a machine on Azure) but both these environments should "share" credential in some way. I think that it is very important point, I try to explain the situation in practice:

• I have my .NET web application running on an environment A. The user can log into this application inserting his credential.




• On another environment B is running the API that the previous web application have to call. The endpoint is sometning like: *http://MY_MACHINE_NAME.westeurope.cloudapp.azure.com:8081/PI_WebAPI/API_TO_BE_CALLED (as you can see it runs on a azure VM).




• The web app and the API run on two different environments in the but they share credentials (I don't know the details but it works in this way, I think that they should be on a same domain). The proof of this assertion is that if I call my API (from the browser) it ask me my user credential (in a borwser popup). But if I first log into my web application (running on the environment A) and then I call my API (running on the environment B) on another browser tab it directly access because it know that I am logged in the system.

What I have to do is allow the back end of my web application (running on the environment A) to call this API (running on the environment B) using the credentials of the logged user.

So I was trying to implement the previous post strategy.

I implemented my controller in this way:

[SharePointContextWebAPIFilter]
[HttpGet]
[ActionName("GetAooList2")]
public IHttpActionResult GetAooList2()

 Console.WriteLine("INTO GetAooList2()");

 string jsonRequest = urlBaseProtocolloApi + "/api/ProtocollaMail/GetListAOO";

 var wi = (System.Security.Principal.WindowsIdentity)HttpContext.Current.User.Identity;
 var wic = wi.Impersonate();

 ..............................................................
 ..............................................................
 ..............................................................

 return Ok("TEST");

My idea is to obtain the logged user credential and impersonate these credential before perform my call.

The problem is that when the Impersonate() method is performed I obtain the following exception:

System.InvalidOperationException: 'An anonymous identity cannot perform an impersonation.'

So I think that it can't retrieve the identity. Looking into the wi object (the one on which I call the impersonate() method) I found the IsAnonymous property setted to true and it seems to me that it is not containing info on the logged user.

As explained I am not into .NET and probably I am missing something, what?

Using this code what user am I tryng to impersonate?

I also tried to do it using this other implementation:

public class MailProtocolloController : ApiController


 private String urlBaseProtocolloApi = "http://MY_MACHINE_NAME.westeurope.cloudapp.azure.com:8081/PI_WebAPI";

 [SharePointContextWebAPIFilter]
 [HttpGet]
 [ActionName("GetAooList")]
 public IHttpActionResult GetAooList()
 
 string jsonRequest = urlBaseProtocolloApi + "/API_TO_BE_CALLED";

 CredentialCache credCache = new CredentialCache();

 credCache.Add(new Uri(jsonRequest), "NTLM", CredentialCache.DefaultNetworkCredentials);

 HttpWebRequest spRequest = (HttpWebRequest)HttpWebRequest.Create(jsonRequest);
 spRequest.Credentials = credCache;
 spRequest.UserAgent = "Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0";
 spRequest.Method = "GET";
 spRequest.Accept = "application/json;odata=verbose";

 HttpWebResponse endpointResponse = (HttpWebResponse)spRequest.GetResponse();

 ...............................................................................
 ...............................................................................
 ...............................................................................
 

As you can see I am trying to retrieve the DefaultNetworkCredentials of my web app (that I expected to be the logged user credential that I should use to perform the call to my second REST API). But it is not working, infact doing in this way when this line is performed:

HttpWebResponse endpointResponse = (HttpWebResponse)spRequest.GetResponse();

I obtain the following exception:

System.Net.WebException: 'The remote server returned an error: (401) Unauthorized.'

But I think that maybe it could be something near to "the good way" (using the NTLM protocol) because if instead to use the DefaultNetworkCredentials I manually set my credential in the code it works fine and I correctly obtain the REST API response.

I have done it in this way:

[SharePointContextWebAPIFilter]
[HttpGet]
[ActionName("GetAooList")]
public IHttpActionResult GetAooList()

 Console.WriteLine("INTO GetAooList()");

 string jsonRequest = urlBaseProtocolloApi + "/API_TO_BE_CALLED";

 NetworkCredential myCreds = new NetworkCredential("MY_USERNAME", "MY_PSWD", "THE_DOMAIN");

 CredentialCache credCache = new CredentialCache();

 credCache.Add(new Uri(jsonRequest), "NTLM", myCreds);

 //credCache.Add(new Uri(jsonRequest), "NTLM", CredentialCache.DefaultNetworkCredentials);

 HttpWebRequest spRequest = (HttpWebRequest)HttpWebRequest.Create(jsonRequest);
 spRequest.Credentials = credCache;
 spRequest.UserAgent = "Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0";
 spRequest.Method = "GET";
 spRequest.Accept = "application/json;odata=verbose";

 HttpWebResponse endpointResponse = (HttpWebResponse)spRequest.GetResponse();

 ..........................................................................................
 ..........................................................................................
 ..........................................................................................

As you can see using this line:

NetworkCredential myCreds = new NetworkCredential("MY_USERNAME", "MY_PSWD", "THE_DOMAIN");

in which I am setting username, password and the DOMAIN (the web app and the API should run on different environments but on the same domain) it works fine and the API is correctly called.

Obviously I can not mock these information into my controller method code. I need a way to retrieve these credential info and use it.

Some idea? How can I do it? What am I missing?