title: Windows Store app with enterpriseAuthentication and Impersonation
body: <p><strong>Short Version</strong>: Why when I impersonate a web-request made by Windows Store app, I get WindowsIdentity object with correct user name, but its IsAuthenticated property returns False? Making same request from a browser (including Metro IE10) gives IsAuthenticated==true.</p>
  
  <p><strong>Long Version</strong>:<br>
  I'm prototyping an internal enterprise solution, which consists of WCF-service and WinJS application. WCF-service is based on the webHttpBinding (i.e. simple GET/POST requests).</p>
  
  <p>Certain actions need to be processed on behalf of a user making request, therefore service is configured to impersonate its callers. Here is sample configuration:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;system.serviceModel&gt;
    &lt;bindings&gt;
      &lt;webHttpBinding&gt;
        &lt;binding name="CustomizedWebBinding"&gt;
          &lt;security mode="TransportCredentialOnly"&gt;
            &lt;transport clientCredentialType="Windows" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
      &lt;/webHttpBinding&gt;
    &lt;/bindings&gt;
      &lt;behaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="Web"&gt;
            &lt;webHttp/&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
          &lt;serviceBehaviors&gt;
              &lt;behavior name=""&gt;
                  &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" /&gt;
                  &lt;serviceDebug includeExceptionDetailInFaults="false" /&gt;
              &lt;/behavior&gt;
          &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;services&gt;
          &lt;service name="WcfService"&gt;
              &lt;endpoint address="" binding="webHttpBinding" bindingConfiguration="CustomizedWebBinding" contract="IWcfService" behaviorConfiguration="Web"&gt;
                  &lt;identity&gt;
                      &lt;dns value="localhost" /&gt;
                  &lt;/identity&gt;
              &lt;/endpoint&gt;
              &lt;host&gt;
                  &lt;baseAddresses&gt;
                      &lt;add baseAddress="http://localhost:8787/" /&gt;
                  &lt;/baseAddresses&gt;
              &lt;/host&gt;
          &lt;/service&gt;
      &lt;/services&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>... and code:</p>
  
  <pre class="lang-C# prettyprint-override"><code>public class WcfService : IWcfService
  {
      [OperationBehavior(Impersonation=ImpersonationOption.Required)]
      public UserInfo GetUserInfo()
      {
          UserInfo ui = new UserInfo();
          WindowsIdentity identity = ServiceSecurityContext.Current.WindowsIdentity;
  
          ui.UserName = identity.Name;
          ui.IsAuthenticated = identity.IsAuthenticated;
          ui.ImpersonationLevel = identity.ImpersonationLevel.ToString();
          ui.IsAnonymous = identity.IsAnonymous;
          ui.IsGuest = identity.IsGuest;
          ui.IsSystem = identity.IsSystem;
          ui.AuthenticationType = identity.AuthenticationType;
  
          return ui;
      }
  }
  </code></pre>
  
  <p>So, this operation simply collects information about the caller and sends it back in a json string.</p>
  
  <p>Moving to the client. To enable automatic authentication I checked "Enterprise Authentication", "Internet (Client)" and "Private Networks" in the Windows Store app's manifest file.</p>
  
  <p>From within Windows Store app, I send request using WinJS.xhr function:</p>
  
  <pre class="lang-js prettyprint-override"><code>    var options = {
          url: "http://localhost:8787/getuserinfo"
      };
  
      WinJS.xhr(options).then(function (xhrResponse) {
          var userInfoBlock = document.getElementById("userInfoBlock");
          var data = JSON.parse(xhrResponse.response);
  
          userInfoBlock.innerHTML += "&lt;ul&gt;"
  
          for (var p in data) {
              if (data.hasOwnProperty(p)) {
                  userInfoBlock.innerHTML += "&lt;li&gt;" + p + ": " + data[p] + "&lt;/li&gt;";
              }
          }
  
          userInfoBlock.innerHTML += "&lt;/ul&gt;";
      });
  </code></pre>
  
  <p>Now, when I execute Windows Store app and it sends request, the response I get is:</p>
  
  <pre><code>AuthenticationType: "NTLM"
  ImpersonationLevel: "Impersonation"
  IsAnonymous: false
  IsAuthenticated: false
  IsGuest: false
  IsSystem: false
  UserName: "TESTBOX\dev"
  </code></pre>
  
  <p>If I send request using browser's address bar, I get same response, with the only difference that "IsAuthenticated: true".</p>
  
  <p>I also noticed that if I disable "Enterprise Authentication", it causes Credentials Picker to popup and after providing correct credentials I'm getting "IsAuthenticated: true".</p>
  
  <p>Am I missing something or expecting too much from the enterpriseAuthentication capability?</p>