I have a solution where I have an ASP.NET MVC application, and an ASP.NET API. When someone lands on the home page of the MVC App, I am accessing the HttpContext inside the home controller to get the user's credentials, which I then use for various things. Inside the Home Controller, I also need to call my API (mentioned above), and that API also needs to access the user's credentials via HttpContext.
This works fine when I am debug this locally, and both the MVC App and API can see my credentials as [MyDomainName]/[MyUserName]. However, when running them both on my IIS Server, the MVC App can access my credentials correctly, while the API sees them as IIS AppPool/[MyAppPool], or whatever account the app pool hosting the MVC App is running as.
I understand why this happens, on the server from the API's perspective the user that sent the request is the MVC App's app pool if the API request is sent from the server-side scripts (MVC App's Home Controller). The problem is that it's a requirement that I must send these requests from the Controller (or anywhere from within the server-side C# code), I can't quite make these from the Javascript files inside the MVC App (which I know would work).
Does anyone know if there is a way to forward the credentials with an API request made from within the server-side C# code? I understand this might not be allowed for security reasons, but just want to check what is people's approach when dealing with this?