title: HttpClient & Windows Auth: Pass logged in User of Consumer to Service
body: <p>I am struggling to understand and set up a Service and Consumer where the Service will run as the user logged into the Consumer.</p>
  
  <p>My consumer is an MVC application. My Service is a Web Api application. Both run on separate servers within the same domain. Both are set to use Windows Auth.</p>
  
  <p>My consumer code is:</p>
  
  <pre><code>private T GenericGet&lt;T&gt;(string p)
      {
          T result = default(T);
  
          HttpClientHandler handler = new HttpClientHandler() { PreAuthenticate = true, UseDefaultCredentials = true };
          using (HttpClient client = new HttpClient(handler))
          {
              client.BaseAddress = new Uri(serviceEndPoint);
  
              HttpResponseMessage response = client.GetAsync(p).Result;
              if (response.IsSuccessStatusCode)
                  result = response.Content.ReadAsAsync&lt;T&gt;().Result;
          }
  
          return result;
      }
  </code></pre>
  
  <p>In my Service I call <code>User.Identity.Name</code> to get the caller ID but this always comes back as the consumer App Pool ID, not the logged in user. The consumer App Pool is running as a Network Service, the server itself is trusted for delegation. So how do I get the logged in User? Service code:</p>
  
  <pre><code>    // GET: /Modules/5/Permissions/
      [Authorize]
      public ModulePermissionsDTO Get(int ModuleID)
      {
          Module module= moduleRepository.Find(ModuleID);
          if (module== null)
              throw new HttpResponseException(HttpStatusCode.NotFound);
  
          // This just shows as the App Pool the MVC consumer is running as (Network Service).
          IPrincipal loggedInUser = User;
  
          // Do I need to do something with this instead?
          string authHeader = HttpContext.Current.Request.Headers["Authorization"];
  
          ModulePermissionsDTO dto = new ModulePermissionsDTO();
          // Construct object here based on User...
  
          return dto;
      }
  </code></pre>
  
  <p>According to this <a href="https://stackoverflow.com/questions/12212116/how-to-get-httpclient-to-pass-credentials-along-with-the-request?lq=1">question</a>, Kerberos is required to make this set up work because the HttpClient runs in a separate thread. However this confuses me because I thought the request sends an Authorization header and so the service should be able to use this and retrieve the user token. Anyway, I have done some testing with Kerberos to check that this correctly works on my domain using the demo in "Situation 5" <a href="http://blogs.msdn.com/b/canberrapfe/archive/2012/01/02/kerberos-troubleshooting.aspx" rel="nofollow noreferrer">here</a> and this works but my two applications still wont correctly pass the logged in user across.</p>
  
  <p>So what do I need to do to make this work? Is Kerberos needed or do I need to do something in my Service to unpack the Authorisation header and create a principal object from the token? All advice appreciated.</p>