ADFS3.0 Thread.CurrentPrincipal.Identity.Name returned as empty string between requests

Question

I've built a custom ASP.Net MVC5 application deployed in a DMZ (organization's perimeter network) authenticating users via ADFS 3.0 (Active Directory Federation Services). The application is deployed in IIS with Anonymous authentication turned on and since it's DMZ so the server is not joined with domain and I don't have Windows authentication available. As far as ADFS and authentication are concerned it's working perfectly as users are prompted with username/password when the application is accessed from outside network and use SSO (Single Sign-On) when accessed from inside the network.

However, the issue is that I have a static class which gets the current user and validates it against a users table in the database. To get the current user, I'm using Thread.CurrentPrincipal.Identity.Name . Initially, it does return me a user name but in-between navigating different pages of the application it flips and starts returning a blank string. There is no specific pattern when it flips. For the same user and session, all of sudden I start getting a blank string and after few page refreshes, it starts returning me back the user name.

Now, what I'm not sure if this issue is due to having a static class and method where I'm calling Thread.CurrentPrincipal.Identity.Name or is there something wrong with the configuration of the application. I've also tried HttpContext.Current.User.Identity.Name and the results are same. The reason for having a static class is not to duplicate the same code in each controller.

Any help will be highly appreciated. Thanks!

Answer 1

因此问题出在我的API控制器上，因为我可以匿名访问它们，所以我缺少了Authorize属性。