User Permission Mask from NetworkCredentials

Question

Although I am currently developing this WinForms application on our Sharepoint server I intend for the finished program to function from any computer on the Domain. I'm using the WSS web services to get all the information I use from Sharepoint.

I have written some code which will check Sharepoint Permission masks, with logical OR against mask, for all the permissions it covers but I am having trouble returning the Sharepoint mask for the current user. I would like users to be able to log right in through Windows Authentication so this was my immediate idea.

NetworkCredential credentails = CredentialCache.DefaultNetworkCredentials;
var userInfo = userGroupService.GetUserInfo(credentails.UserName);

However although I am able to return the permission collection for the entire Sharepoint site with DefaultNetworkCredentials (as in bellow snippet) the properties are empty strings, so I can't use it to get the UserName.

permissionService.Credentials = CredentialCache.DefaultNetworkCredentials;
permissionService.Url = "http://localhost/mySite/_vti_bin/Permissions.asmx";
// Web service request works
XmlNode node = permissionService.GetPermissionCollection(siteName, "Web");
// But I need to identify current user from this collection somehow still

I read that Windows Authentication suffers from a double-hop issue, which I want to avoid, but as I am developing on the server Sharepoint & IIS are running, I can't see this causing an immediate issue.

Is there a way around this or a better way to get the current users permission mask?

Answer 1

If the current user for wss will always be the same as the user currently logged on to the pc

var userInfo = userGroupService.GetUserInfo(Environment.UserDomainName +@"\"+ Environment.UserName);

or to get the permissions for the currently logged on user

XmlNode currentUserPermission = userGroupService.GetRolesAndPermissionsForCurrentUser();

Answer 2

You are dealing with an issue where the authentication cannot move beyond one remote host; this is known as the "one-hop" limitation.

To overcome this, you have to get into "Constrained Delegation," where a computer/account are expressly authorized to receive and accept authentication credentials from another computer/account. This is set up in Active Directory by defining the appropriate Service Principal Names (SPN's) on either "end" of the delegation.

You can get more details about Constrained Delegation here.

Good luck! CD can be a bit of a pain to set up, so tread carefully.