Validate Windows Identity Token

Question

I am trying develop a simple web service to authenticate users of a desktop application using the windows identity framework, at present I am passing the token generated by WindowsIdentity.GetCurrent().Token via a post variable (it is encrypted and ssl'd, Windows authentication is not an option given the layout of our domain's and the configuration of the server). I am passing the token back fine and converting it back to an IntPtr.

I am at a lost as to how to validate the token to ensure that it was generated by a particular Active Directory (or any for that matter). I have tried to create a new WindowsIdentity instance given the token however that just results in an Exception (message: Invalid token for impersonation - it cannot be duplicated).

If anyone can provide any help or even hints I would greatly appreciated, thanks in advance.

Answer 1

public bool DoesUserExist(string userName)
{
    using (var domainContext = new PrincipalContext(ContextType.Domain, "DOMAIN"))
    {
        using (var foundUser = UserPrincipal.FindByIdentity(domainContext, IdentityType.SamAccountName, userName))
        {
            return foundUser != null;
        }
    }
}

To achieve checking for if a user exists. This comes from the System.DirectoryServices.AccountManagement namespace and assembly.

Just pass in your username which you can get from WindowsIdentity.GetCurrent() and this will return a true/false if a user if in your usergroup. (replace DOMAIN with your needed group name.)