SOAP web service running on SharePoint - web-services

Question

I have a SOAP web service running on my sharepoint box under the _layouts directory, and a thick client which uses that SOAP service. We have one sharepoint box that uses basic auth and another which uses client certificates. I need that SOAP service to update some list items in a document library. The problem I'm having is nothing seems to work unless I run within an elevated privileges block. Here is a code snippet of what I'm trying to do.
using (SPSite site = new SPSite(fileUrl))
using (SPWeb web = site.OpenWeb()) {
// web.CurrentUser is always null unless in elevated privileges block.
// do something with document library...
web.Files.Add(...); // fails with access denied unless in elevated privileges block.
}
I also tried "SPContext.Current.Web" but it returns null for "web.CurrentUser" even if I'm in an elevated privileges block.
I really can't use an elevated privileges block because the users complain that anything my SOAP service touches has a modified by system.
From the thick client we are using code like the following...
HttpWebRequest request = (HttpWebRequest)WebRequest.Create(requestString);
if(basicAuth) {
request.Credentials = System.Net.CredentialCache.DefaultCredentials;
}
else {
X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);
foreach (X509Certificate2 certificate in store.Certificates) {
request.ClientCertificates.Add(certificate);
}
request.GetResponse();
We are manually constructing the SOAP request for various reasons.

Answer 1

If you want your webservice to properly integrate within the sharepoint context (i.e. being able to query the "current sharepoint user"), you should really deploy it to _vti_bin (the ISAPI subfolder of the 12 hyve), not to _layouts.
Discovery is a bit of a pain and requires manual tweaking of files (see the MSDN article on custom webservices within SharePoint for more information), but as you are hand-building your request anyway discovery should not be an issue.
[Edit] As an alternative, you can try acquiring the SPUserToken of the windows authenticated user,
SPUserToken token = web.AllUsers[WindowsIdentity.GetCurrent().Name].UserToken;
and then use this token to open the site and web as this user.