Skip to content

DomainlessUser (HttpContextExtensions)

HttpContextExtensions.DomainlessUser strips a down-level domain prefix (DOMAIN\) or a UPN suffix (@domain) from the ambient ASP.NET user's identity name, producing the bare account name used in the OnBehalfOfUser header.

Field Value
Operation ID OP-11
Trigger GetJsonResponse step 8; also directly callable by consumers.
Inputs Ambient HttpContext.
Outputs User name without domain qualifier.
Primary components SAIF.Web.API.Clients.Extensions.HttpContextExtensions.DomainlessUser(this HttpContext)
Entry point src/SAIF.Web.API.Clients/Extensions/HttpContextExtensions.cs

Steps

  1. Read httpContext.User.Identity.Name.
  2. On failure: NullReferenceException if httpContext, User, Identity, or Name is null — no guards exist. For an unauthenticated request, Name is "".
  3. Locate the index of \ and of @ (BR-CLI-004).
  4. If the \ index is > 1, take the substring after it (down-level logon name DOMAIN\user → user) (BR-CLI-004).
  5. The threshold is > 1, not >= 0: a name beginning A\user (index 1) is not stripped.
  6. If the @ index is > 1, take the substring before it (UPN user@domain → user) (BR-CLI-004).
  7. The @ index is computed on the original string, before the step-3 substring is taken. If both separators are present, the offset is stale and the result can be truncated incorrectly.
  8. Return the normalized name (BR-CLI-004).

Process flow

flowchart TD
    Start([DomainlessUser called]) --> Read["Read<br>httpContext.User.<br>Identity.Name"]
    Read --> Indices["Locate index of<br>backslash and at-sign"]
    Indices --> Backslash{Backslash index &gt; 1?}
    Backslash -->|Yes| StripDomain["Take substring after<br>backslash"]
    Backslash -->|No| AtSign
    StripDomain --> AtSign{At-sign index &gt; 1?}
    AtSign -->|Yes| StripDomainSuffix["Take substring before<br>at-sign"]
    AtSign -->|No| Return([Return normalized name])
    StripDomainSuffix --> Return

Failure and edge-case behavior

  • httpContext, User, Identity, or Name being null throws NullReferenceException with no guard.
  • A name beginning with a separator at index 0 or 1 (for example A\user) is not stripped, because the threshold is > 1.
  • A name containing both \ and @ (for example DOMAIN\user@domain) can be truncated incorrectly, because the @ index is computed on the original string before the \ substring is taken.

Sources

  • src/SAIF.Web.API.Clients/Extensions/HttpContextExtensions.cs