ASP.Net Single Sign On (SSO) from SP 2013

Question

Ok, here's my situation: I've got an ASP.NET web forms application that is installed and running on my SP 2013 IIS site. SP is setup to use Windows auth. I know that this is very unusual and not recommended, but for now I have to go this way. i.e. I don't have time to convert this and a number of other ASP.Net apps to SP apps. What I am trying to do is get the user who is logged into SP and use that info to authenticate to my ASP.Net application - and also not prompt for auth on ASP.NET. I think by nature of the .net app running in the same IIS as SP 2013 it will not prompt for auth creds a 2nd time., but how to get user info from the token?

I have code like

Dim strEmailAddress As String = HttpContext.Current.User.Identity.Name.ToLower

in my ASP.Net (VB.NET) and what it returns is: 0#.w|smg\myuser

and so as I understand it SP is using claims-based authentication and this is a claim token. My question is how to parse/accept this token to get user name to then use it in my ASP.NET?

Someone elsewhere on the net has shown the following as a solution but I think my app cannot use the Microsoft.SharePoint.Administration.Claims namespace. Is it as simple as that?

string userName = null;
SPClaimProviderManager mgr = SPClaimProviderManager.Local;
if (mgr != null)
{
    userName = mgr.DecodeClaim(SPContext.Current.Web.CurrentUser.LoginName).Value;
}

As I understand it SPClaimProviderManager is in the Microsoft.SharePoint.Administration.Claims namespace but how do I get that referenced in my ASP.NET. I cannot even find that dll on the SP 2013 server.

Answer 1

I was able to get this to work using the approach above outlined in my question - i was able to copy Microsoft.Sharepoint assembly from server and reference it in my ASP.NET project. The Microsoft.SharePoint.Administration.Claims namespace is found in the Microsoft.Sharepoint assembly

Answer 2

The key is to have both SharePoint and your app use the same authentication source.

So, either your app must change to Windows Auth (aka Integrated NTLM), or SharePoint must use forms (or claims that is based on the same user store).