Impersonating a user in ASP.NET when using Windows Authentication

I frequently have the need to test, debug, troubleshoot, etc my ASP.NET intranet applications that use Windows Authentication as another user. For example, user1 says, the application is behaving strangely when I do xyz. It is very helpful to be able to see exactly what that user is seeing. Of course I could ask the user for their password, but that is a bad solution, and a bad idea to ever give passwords out, even to IT.

What I needed was a way to just specify the username I wanted, and not worry about the password. I want this functionality to be restricted to user in a certain role. For example, maybe an Admin role. I didn’t want any real performance impact either.

With that in mind, I set out to write a class to encapsulate all this logic. Below is the solution I came up with. It requires very little changes to your existing application. It hooks into the application at the Application_AuthenticationRequest event in your Global.asax. There are a couple of items that can be configured in the constructor or the web.config or use my defaults. You can control the impersonation through the url query string, or you can come up with your own user interface that calls my methods. See the example comment in the class for more details. The code is heavily commented and I also have examples of how to use the code as well. There really isn’t that much code once you take away the example code and comments.

Anyway, here is the code. Just paste the code into .cs file, and you should be ready to go.

using System;
using System.Collections;
using System.Configuration;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.SessionState;
using System.Xml.Linq;
using System.Web.Routing;
using System.Web.DynamicData;
using DataModel;
using ICAWebSite3;
using System.Security.Principal;

namespace MyWebSite
{
   /// <summary>
   /// Impersonates an specified user. Impersonation is started by adding
   /// ImpersonatedUser=domain\username to the url or calling Impersonate() 
   /// and UnImpersonate methods from code. 
   /// </summary>
   /// <example>
   ///     In Global.asax and using url to control impersonation
   ///     void Application_AuthenticateRequest(object sender, EventArgs e)
   ///     {
   ///        Impersonation i = new Impersonation();
   ///        i.ImpersonateBasedOnQueryStrings("ImpersonatedUser", "UnImpersonate");
   ///        i.HandleAuthenticationRequest();
   ///     }
   ///    
   /// or 
   /// 
   ///     In Global.asax and using web interface to control impersonation
   ///     void Application_AuthenticateRequest(object sender, EventArgs e)
   ///     {
   ///        Impersonation i = new Impersonation();
   ///        i.HandleAuthenticationRequest();
   ///     }
   ///     
   ///     This example assumes you call the Impersonate() and UnImpersonate()
   ///     methods in your code appropriately. Be sure to use the same parameters to the 
   ///     constructor as you do in Global.asax. The web.config option shown below is recommended.
   ///     
   ///     Impersonation i = new Impersonation();
   ///     i.Impersonate(@"domain\someoneelse")
   ///     
   ///     You will also need to call this somewhere else also.
   ///     Impersonation i = new Impersonation();
   ///     i.UnImpersonate();
   ///     
   ///     NOTE: You may need to redirect after you call i.Impersonate(...) because the 
   ///     button event handlers, etc are after the Application_AuthenticateRequest event.
   ///     
   ///     Below is an example of how you may want to show/hide a textbox and two buttons
   ///     on a page or master page. The textbox is for the domain\username you want
   ///     to impersonate and the two buttons are Impersonate and UnImpersonate.
   ///     
   ///     protected void Page_Load(object sender, EventArgs e)
   ///     {
   ///         Impersonation i = new Impersonation();
   ///         btnUnImpersonate.Visible = i.IsImpersonating;
   ///         if (i.CanImpersonate)
   ///         {
   ///             btnImpersonate.Visible = true;
   ///             txtImpersonatedUser.Visible = true; 
   ///         }
   ///         else
   ///         {
   ///             btnImpersonate.Visible = false;
   ///             txtImpersonatedUser.Visible = false;
   ///         }
   ///         if (!IsPostBack)
   ///         {
   ///             txtImpersonatedUser.Text = i.ImpersonatedUsername;
   ///         }
   ///     }
   ///
   ///     protected void btnImpersonate_Click(object sender, EventArgs e)
   ///     {
   ///         Impersonation i = new Impersonation();
   ///         i.Impersonate(txtImpersonatedUser.Text);
   ///         Response.Redirect(Request.Url.OriginalString);
   ///     }
   ///
   ///     protected void btnUnImpersonate_Click(object sender, EventArgs e)
   ///     {
   ///         Impersonation i = new Impersonation();
   ///         i.UnImpersonate();
   ///         txtImpersonatedUser.Text = "";
   ///     }
   /// </example>
   /// <remarks>
   ///     The impersonation data is being persisted to the Application object currently.
   ///     This is very fast and has no real impact on performance of the application. 
   ///     It is important that performance be very quick because the Application_AuthenticateRequest
   ///     event fires for every request. This includes image and javascript files, etc. 
   ///     
   ///     The Application object works very well for single web server environments.
   ///     However in web farms where a user may be redirected to multiple servers, 
   ///     the impersonation would not work anymore unless the user happens to hit the same
   ///     server each time. 
   ///     
   ///     In environments like this, I recommend using a database or something
   ///     of the like since it can be accessed from all application instances. There will of course
   ///     be a performance hit for this, so use sparingly. You may want to experiment with
   ///     caching credentials, or limiting the impersonation to .aspx pages only. These
   ///     approaches have their own issues that you will need to content with as well.
   ///     
   ///     If you choose to change the place where impersonation state is kept you just need to change
   ///     the ImpersonationDateStore object. This is by design.
   ///     
   /// </remarks>
   public class Impersonation
   {
       /// <summary>
       /// The role that the user must be in in order for impersonation to work.
       /// For example, Admin.
       /// </summary>
       private string requiredRoleName;

       /// <summary>
       /// The time before an impersonation expires. This is a sliding expiration.
       /// This means that the time is relative to the last time the impersonation
       /// actually is set.
       /// This is Not the absoute time since impersonation was started, UNLESS
       /// the impersonation is only set once such as through the UI.
       /// </summary>
       private TimeSpan expirationDuration;

       /// <summary>
       /// Class responsible for persisting the impersonation state
       /// </summary>
       private ImpersonationDataStore ds;


       // Assuming there is some traffic on the site, any expired impersonations 
       // will be removed
       public Impersonation()
       {
           // if the web.config does not have a default value specified,
           // then use our own default.
           string configFileExpirationDuration = ConfigurationManager.AppSettings["Impersonation-ExpirationDuration"];
           if (!string.IsNullOrEmpty(configFileExpirationDuration))
           {

               // string in web.config should have the format:
               // [ws][-]{ d | d.hh:mm[:ss[.ff]] | hh:mm[:ss[.ff]] }[ws]
               // for more info see http://msdn.microsoft.com/en-us/library/system.timespan.tryparse.aspx 
               TimeSpan.TryParse(configFileExpirationDuration, out this.expirationDuration);
           }
           else
           {
               // default time to 20 minutes if one is not specified
               this.expirationDuration = new TimeSpan(0, 20, 0);
           }


           // if the web.config does not have a default value specified,
           // then use our own default.
           string configFileRequiredRoleName = ConfigurationManager.AppSettings["Impersonation-RequiredRoleName"];
           if (!string.IsNullOrEmpty(configFileRequiredRoleName))
           {

               this.requiredRoleName = configFileRequiredRoleName;
           }
           else
           {
               // default role to Admin
               this.requiredRoleName = "Admin";
           }

           Init();
       }

       // Assuming there is some traffic on the site, any expired impersonations 
       // will be removed
       public Impersonation(string requiredRoleName, TimeSpan expirationDuration)
       {
           this.expirationDuration = expirationDuration;
           this.requiredRoleName = requiredRoleName;

           Init();
       }

       /// <summary>
       /// Stuff that is done for all the constructors
       /// </summary>
       private void Init()
       {
           ds = new ImpersonationDataStore();

           ds.ClearExpiredImpersonations();
       }

     
  
       public void Impersonate(string impersonatedUsername)
       {
           if (Roles.IsUserInRole(requiredRoleName))
           {
               ImpersonatedUsernameInternal = impersonatedUsername;
           }
       }

      

       /// <summary>
       /// This must be called from the Application_AuthenticateRequest event in Global.asax Parameters are taken from the
       /// query string of the url. The url does NOT have to have either of the parameters
       /// present after the initial request with one of them in the url. Even if the 
       /// query parameters are not in the url the impersonation will exist until it expires 
       /// or is explicitly UnImpersonated by adding UnImpersonate=Y to the url or the UnImpersonate() method.
       /// </summary>
       /// <param name="impersonateParamName">The name of the query string key name. 
       /// In the url, the value associated with the key should be of the format
       /// domain\username</param>
       /// <param name="unimpersonateParamName">The name of the query string key name.
       /// In the url, the value associated with this can be anything. All that matters
       /// is that a value is specified so that the key will be passed from browser to the
       /// ASP.NET QueryString Dictionary.
       /// </param>
       public void ImpersonateBasedOnQueryStrings(string impersonateParamName, string unimpersonateParamName)
       {
           if (Roles.IsUserInRole(requiredRoleName))
           {
              
               string impersonateUserVal = HttpContext.Current.Request.QueryString[impersonateParamName] as string;
               bool unImpersonateUser = HttpContext.Current.Request.QueryString.AllKeys.Contains<string>(unimpersonateParamName);
              
               // if we need to unimpersonate then do so before we call Impersonate()
               if (unImpersonateUser)
               {
                   UnImpersonate(AuthenticatedUsername);
               }

               // if there is a new or same impersonation value, 
               // then set it to the current impersonation value
               if (!string.IsNullOrEmpty(impersonateUserVal))
               {
                   ImpersonatedUsernameInternal = impersonateUserVal;
               }
           }
       }

       /// <summary>
       /// This must be called from the Application_AuthenticateRequest event in Global.asax
       /// </summary>
       /// <param name="impersonateUserVal">The domain and username of the user that 
       /// is to be impersonated. The value should be of the format domain\username
       /// </param>
       public void HandleAuthenticationRequest()
       {
           if (Roles.IsUserInRole(requiredRoleName))
           {
               ImpersonationInfo info = ds.Retrieve(AuthenticatedUsername);
               if (info != null)
               {
                   string impersonatedUsername = info.ImpersonatedUser;
                   if (!string.IsNullOrEmpty(impersonatedUsername))
                   {
                       GenericIdentity id = new GenericIdentity(impersonatedUsername);
                       GenericPrincipal p = new GenericPrincipal(id, Roles.GetRolesForUser(impersonatedUsername));
                       HttpContext.Current.User = p;
                   }
               }
              
              
           }
      
       }

       /// <summary>
       /// Returns true if someone is being impersonated, else, false.
       /// </summary>
       public bool IsImpersonating
       {
           get { return (ImpersonatedUsername != null) && (ImpersonatedUsername != AuthenticatedUsername); }
       }

       /// <summary>
       /// True if the Authenticated user is in the role required to impersonate other users,
       /// else false
       /// </summary>
       public bool CanImpersonate
       {
           get { return Roles.IsUserInRole(AuthenticatedUsername, requiredRoleName); }
       }



       /// <summary>
       /// Call this method to unimpersonate
       /// </summary>
       public void UnImpersonate()
       {
           UnImpersonate(AuthenticatedUsername);
       }

       /// <summary>
       /// Call this method to unimpersonate
       /// </summary>
       /// <param name="authenticatedUsername"></param>
       private void UnImpersonate(string authenticatedUsername)
       {
           ds.Delete(authenticatedUsername);
       }

       public string AuthenticatedUsername
       {
           get
           {
               return HttpContext.Current.Request.ServerVariables["LOGON_USER"];
           }
       }

       public string ImpersonatedUsername
       {
           get
           {
               return ImpersonatedUsernameInternal;
           }
       }

       private class ImpersonationDataStore
       {
           public void Store(string key, ImpersonationInfo value)
           {
               HttpContext.Current.Application[GetImpersonationKey(key)] = value;
           }

           public ImpersonationInfo Retrieve(string key)
           {
               return HttpContext.Current.Application[GetImpersonationKey(key)] as ImpersonationInfo;
           }

           public void Delete(string key)
           {
               HttpContext.Current.Application.Remove(GetImpersonationKey(key));
           }

           private string GetImpersonationKey(string key)
           {
               return "Impersonation-" + key;
           }

           /// <summary>
           /// Removes any impersonations that have expired.
           /// </summary>
           public void ClearExpiredImpersonations()
           {
               string[] keys = HttpContext.Current.Application.AllKeys;
               string keyPrefix = GetImpersonationKey("");
               for (int i = 0; i < keys.Count(); i++)
               {
                   if (keys[i].StartsWith(keyPrefix))
                   {
                       object infoObj = HttpContext.Current.Application[keys[i]];

                       if (infoObj is ImpersonationInfo)
                       {
                           ImpersonationInfo info = infoObj as ImpersonationInfo;
                           DateTime expires = info.Expires;
                           if (expires < DateTime.Now)
                           {
                               Delete(info.AuthenticatedUsername);
                           }
                       }
                   }
               }
           }

       }

       private string ImpersonatedUsernameInternal
       {
           get
           {

               ImpersonationInfo info = ds.Retrieve(AuthenticatedUsername);
               if (info == null) return null;
               else return info.ImpersonatedUser;
           }

           set
           {
               ImpersonationInfo info = new ImpersonationInfo();
               info.AuthenticatedUsername = AuthenticatedUsername;
               info.ImpersonatedUser = value;

               // slide the expiration window out from the current date time.
               info.Expires = DateTime.Now.Add(expirationDuration);

               ds.Store(AuthenticatedUsername, info);
              
           }
       }

      

       /// <summary>
       /// Stores information about the impersonation.
       /// This could be persisted to a database or file.
       /// </summary>
       public class ImpersonationInfo
       {
           public string AuthenticatedUsername { get; set; }
           public DateTime Expires { get; set; }
           public string ImpersonatedUser { get; set; }
       }

      
      
   }
}