title: How to get UPN for authenticated user in .NET web application, without querying Active Directory
body: <p>(This question is similar to <a href="https://stackoverflow.com/questions/1101938/get-upn-or-email-for-logged-in-user-in-a-net-web-application">Get UPN or email for logged in user in a .NET web application</a>, but not quite.)</p>
  
  <p>In a .NET (C#) web application using Windows authentication, I'd like to find the UPN of the signed-in user.</p>
  
  <p>I know how to do this by querying Active Directory: take the 'DOMAINNAME\userName' from <code>HttpContext.Current.User.Identity as WindowsIdentity</code>; look up DOMAINNAME under the <code>ldap://RootDSE</code> and find its <code>dnsRoot</code>; query for <code>(&amp;(objectCategory=person)(objectClass=user)(sAMAccountName=...userName...))</code> under <code>ldap://...dnsRoot...</code>; get this entry's <code>userPrincipalName</code> property.  (More detail is in answer <a href="https://stackoverflow.com/a/513668/223837">https://stackoverflow.com/a/513668/223837</a>).</p>
  
  <p><strong>My question:</strong> Can the UPN be found <em>without</em> a call to Active Directory?  Given Microsoft's focus on using UPNs everywhere, isn't the UPN already stored somewhere in the token which is created when the user authenticates to the web server?</p>
  
  <p>(Supporting observation: If I run <code>whoami /upn</code> on Windows 7, then Wireshark does not show any Active Directory connections.)</p>
  
  <p>(If it makes any difference: note that our web application does <strong>not use impersonation</strong>, i.e., our web app does not run under the user identity.)</p>