fallback

Author: BrennanConroy

src/Servers/IIS/AspNetCoreModuleV2/InProcessRequestHandler/managedexports.cpp

@@ -516,7 +516,13 @@ http_get_authentication_information(
 )
 {
     *pstrAuthType = SysAllocString(pInProcessHandler->QueryHttpContext()->GetUser()->GetAuthenticationType());
-    *pvToken = pInProcessHandler->QueryHttpContext()->GetUser()->GetImpersonationToken();
+    // prefer GetPrimaryToken over GetImpersonationToken as that's what we've been using since before .NET 10
+    // we'll fallback to GetImpersonationToken if GetPrimaryToken is not available
+    *pvToken = pInProcessHandler->QueryHttpContext()->GetUser()->GetPrimaryToken();
+    if (*pvToken == nullptr)
+    {
+        *pvToken = pInProcessHandler->QueryHttpContext()->GetUser()->GetImpersonationToken();
+    }
 
     return S_OK;
 }

src/Servers/IIS/AspNetCoreModuleV2/OutOfProcessRequestHandler/forwardinghandler.cpp

@@ -819,12 +819,20 @@ FORWARDING_HANDLER::GetHeaders(
         (_wcsicmp(m_pW3Context->GetUser()->GetAuthenticationType(), L"negotiate") == 0 ||
             _wcsicmp(m_pW3Context->GetUser()->GetAuthenticationType(), L"ntlm") == 0))
     {
-        HANDLE impersonationToken = m_pW3Context->GetUser()->GetImpersonationToken();
-        if (impersonationToken != nullptr &&
-            impersonationToken != INVALID_HANDLE_VALUE)
+        // prefer GetPrimaryToken over GetImpersonationToken as that's what we've been using since before .NET 10
+        // we'll fallback to GetImpersonationToken if GetPrimaryToken is not available
+        HANDLE authToken = m_pW3Context->GetUser()->GetPrimaryToken();
+        if (authToken == nullptr ||
+            authToken == INVALID_HANDLE_VALUE)
+        {
+            authToken = m_pW3Context->GetUser()->GetImpersonationToken();
+        }
+
+        if (authToken != nullptr &&
+            authToken != INVALID_HANDLE_VALUE)
         {
             HANDLE hTargetTokenHandle = nullptr;
-            RETURN_IF_FAILED(pServerProcess->SetWindowsAuthToken(impersonationToken,
+            RETURN_IF_FAILED(pServerProcess->SetWindowsAuthToken(authToken,
                 &hTargetTokenHandle));
 
             //