title: How do I perform WIF/claims impersonation without the claim being mapped to an AD account?
body: <p>I need to perform search impersonation in SharePoint 2010 for Claims users.  To put this in context, I would like to first state how I get this to work with Windows accounts and then discuss Claims / WIF.</p>
  
  <h1>Windows Accounts</h1>
  
  <p>I can do this for "classic" Windows Integrated Authenticated users using:</p>
  
  <pre><code>WindowsImpersonationContext wic = null;
  try
  {  
      WindowsIdentity impersonatedUser = new WindowsIdentity("john.doe@mydomain");
      wic = impersonatedUser.Impersonate();
  
      // do impersonated work here...
      // in my case this is a SharePoint KeywordQuery
  }
  finally
  {
      if (wic != null)
      {
          wic.Undo();
      }
  }
  </code></pre>
  
  <p>To get the above to work the impersonated account has to be in the same domain as the current user and I have to make sure that application pool owner is:</p>
  
  <ul>
  <li>A domain account in a domain that has a "domain functional level" of Windows 2003 or greater</li>
  <li>Has "act as part of the operating system" privilege on the local box</li>
  <li>Has "impersonate a client after authentication" privilege on the local box</li>
  </ul>
  
  <p>(Note: if anyone can figure out how to get around the issue where the current account must be in the same domain as the impersonated account I am all ears.)</p>
  
  <h1>Claims Accounts</h1>
  
  <p>I would like to do the same with Claims / WIF accounts.  These accounts are <strong>not</strong> necessarily associated with AD accounts (I need to assume they are not).</p>
  
  <p>Is there a way to tell the STS that I want to impersonate a particular account and for it to give me the appropriate token for that account?  I won't have the password of the user I am impersonating.</p>
  
  <p>Quoting <a href="http://blogs.msdn.com/b/russmax/archive/2010/05/27/understanding-sharepoint-2010-claims-authentication.aspx" rel="noreferrer">SharePoint Brew</a> I have to contend with my code which runs on a SharePoint web front end (WFE) that calls a Query Processor via a WCF call.  I want that WCF call to be in the context of the impersonated user.</p>
  
  <blockquote>
    <p>The WFE's (Server1) search web part talks to service application proxy. The associated search service application proxy calls the local STS to get a SAML token for the user. Once SAML token is collected, the search service application proxy then calls a server running the Query Processor via WCF call. I'll call this server, "Server 2". Server 2 receives the incoming request and validates the SAML token against its local STS. Once validated, Server 2 connects to various components to gather, merge, and security trims search results. Server 2 sends the trimmed search results back to Server 1 which are then presented to the user.</p>
  </blockquote>
  
  <p>A little more research is leading me towards looking at <a href="http://msdn.microsoft.com/en-us/library/ee766397.aspx" rel="noreferrer">ActAs</a> and <a href="http://msdn.microsoft.com/en-us/library/ee766593.aspx" rel="noreferrer">OnBehalfOf</a>.  I believe I would want to use OnBehalfOf, but I'm not certain that either would work yet.  Some references I have found are listed below.  Any guidance is appreciated.</p>
  
  <ul>
  <li><a href="http://social.msdn.microsoft.com/Forums/en/Geneva/thread/78e3e93f-0e59-4236-a174-484212b66554" rel="noreferrer">.NET Framework Developer Center - Act As vs. On BehalfOf</a></li>
  <li><a href="http://weblogs.asp.net/cibrax/archive/2010/04/06/actas-and-onbehalfof-support-in-wif.aspx" rel="noreferrer">Pablo M. Cibraro (aka Cibrax) blog - ActAs and OnBehalfOf support in WIF</a></li>
  <li><a href="https://rads.stackoverflow.com/amzn/click/com/0735627185" rel="noreferrer" rel="nofollow noreferrer">Programming Windows Identity Foundation</a> (I have the book)</li>
  </ul>