title: C# Web API 2 Collect Additional Information About Windows Authenticated User
body: <p>I am working on the beginnings of a Web API web service for an intranet application. We will be requiring Windows Authentication at the IIS level and I can successfully grab the user name from <code>HttpContext.Current.User.Identity.Name</code>. We store additional information about the user in the application database that I need to grab and add to the request somewhere (or if not the actual request object, somewhere else that can be accessed by Controllers).</p>
  
  <p>My thought is to run the DB query to capture this information as soon as the request has been authenticated and create an <code>AppUser</code> object with the additional information I need.</p>
  
  <p>The question is where should this action be performed? A couple things I have seen when searching around but I am not sure the appropriate place - this is my first foray into Web API.</p>
  
  <ul>
  <li>Global.asax Application_PostAuthenicateRequest - this seems to be more at the application level - not the individual request level</li>
  <li>AuthenticationFilter - this seems to be more focused on custom authentication </li>
  <li>Master Controller - sub class ApiController and create a master controller on which all other controllers inherit - and add some methods into this master controller which do the work</li>
  </ul>
  
  <p>I am sure there may be more than 1 "right" way but looking for some best practices/guidance on the subject.</p>
  
  <p>EDIT</p>
  
  <p>I would also like to be able to use information from the DB (stored in the <code>AppUser</code> object) to handle the logic inside of the <code>[Authorize]</code> attribute (be that generally authorization, admin roles, etc.).</p>