Obtaining an ICredentials object for the authenticated user of an ASP website

Question

I'm attempting to add a feature to an existing ASP.net web site that needs to pull the users calendar data from the Exchange Web Service. I know that this is possible, and have local tests running as a proof of concept, but I'm having some issues in implementing this in the context of an ASP website.

My intention is to override the default credentials by constructing an instance of the WebCredentials class using the current user of the ASP sites credentials and then using this to create an Exchange Service Binding.

Example

ExchangeService service = new ExchangeService(ExchnageVersion.2007);
service.AutoDetect(emailAddress);
service.Credentials = new WebCredentials(credentials);

Unfortunately, the WebCredentials object can only be constructed from either a set of strings containing username, password and domain, or by passing in an ICredentials object.

So, the question is, within a Forms authenticated web site, is there any way to obtain an ICredentials object for the currently authenticated user?

Answer 1

No forms authentication uses an bespoke encrypted cookie which is sent by the browser with every request. It let's ASP.NET know that the user is authenticated and who they are. It's not designed to work with external systems, and in fact it requires the machinekey on the server to be able to decrypt the details. Passing forms credentials to another server would be pointless.

This system is different to Windows auth which can use various authentication schemes such as basic, digest, NTLM, and Kerberos authentication to negotiate credentials as part of the HTTP protocol, and which can be understood by external systems on the same Exchange.

So to use ICredentials you either need to be using Windows authentication in your ASP.Net application, or have access to username/password so that you can use NetworkCrententials explicitly.