in an IIS web app, how do I get the windows user name? - not the process username

Question

I have inherited an old asp.net web app. Part of the login process is intended to collect the windows username (not the process username). This used to work (years ago) but a new compile of the system returns the App Pool name / username instead of the windows username.

The username is collected before authentication by the website, originally using HttpContext.Current.User.Identity.Name I have tried all the other options that have been suggested with no change in the results.

string loginName;
loginName = Environment.UserName;
loginName = System.Windows.Forms.SystemInformation.UserName;
loginName = System.Security.Principal.WindowsIdentity.GetCurrent().Name;
loginName = HttpContext.Current.User.Identity.Name;
loginName = System.Security.Principal.WindowsIdentity.GetCurrent().Name;
loginName = System.Windows.Forms.SystemInformation.UserName;
loginName = System.DirectoryServices.AccountManagement.UserPrincipal.Current.SamAccountName;
loginName = System.DirectoryServices.AccountManagement.UserPrincipal.Current.UserPrincipalName;

I tried these one at a time (not all together) and in the target environment only ever got the App Pool name or App Pool username. I have tried every combination of Authentication in IIS, the only one that makes a difference is ASP.NET impersonation which changes from App Pool name to impersonation user name.

On my local PC, launched out of Visual Studio, they all work to return the windows logged in username.

I'm quite new to asp.net web apps, and I don't know what else to try.

Answer 1

You have stumbled on the answer. If you want the server to automatically know the windows user, that windows user's credentials need to be passed to the application. If you use the Kerberos or NTML authentication options (Windows Authentication) that set of credentials is passed automatically. Otherwise you need to prompt the user to enter credentials. You don't have to use impersonation, but you can programmatically impersonate the logged in user if your app pool user has sufficient access to the dc catalog. More on that here: https://docs.microsoft.com/en-us/previous-versions/msp-np/ff647405(v=pandp.10)#impersonating-the-original-caller-programmatically