What is the best way to retrieve a WindowsIdentity from a ClaimsIdentity

Question

So far I found out two solutions to get a WindowsIdentity object from a ClaimsIdentity. First I extract the user principal name (upn).

ClaimsIdentity ci = (ClaimsIdentity) Thread.CurrentPrincipal.Identity;    
string upn = null;
foreach (Claim c in ci.Claims)
{
    if (c.ClaimType == ClaimTypes.Upn)
    {
        upn = c.Value;
        break;
    }
}

1. Just call the constructor of WindowsIdentity with the upn:

   WindowsIdentity winId = new WindowsIdentity(upn);

2. Use Claims to Windows Token Service (c2WTS):

   WindowsIdentity winId = S4UClient.UpnLogon(upn);

Solution 1 seems for me the simpler and easier solution, but then i don't understand the purpose of the c2WTS?

Any suggestions?

tnx!

Answer 1

1. WindowsIdentity winId = S4UClient.UpnLogon(upn);

Used by Excel Services and PerformancePoint services.

Its cached once used. Has some other checks against it as well.