c# - How to inject the current user for a request in to a controller / service? -

in webapi based application have ninject binding injecting current user in things ...

bind<user>().tomethod((context) => {     user result = new user { username = "guest" };      if (httpcontext.current.user.identity.isauthenticated)     {         var service = kernel.get<iuserservice>();         var user = service.getall().firstordefault(u => u.username == httpcontext.current.user.identity.name);         return user;     }      return result; }); 

pretty straightforward right?

i have webapi controller has service class injected ctor, in turn has current user injected in it, stack looks ...

class somethingcontroller : apicontroller {      public somethingcontroller(isomethingservice service) { ... } }  class somethingservice : isomethingservice {      public somethingservice(user user) { ... } } 

frustratingly odd reason when inject current user in service constructor user not authenticated yet.

it appears stack being constructed before authentication provider (aspnet identity) has done work , confirmed user is.

later when actual service call made controller user authenticated , user object have been given guest not actual user made call.

my understanding controller not constructed until authentication , determining request / user details done.

how can ensure current, authenticated user passed business services correctly every time (only after authentication has taken place)?

edit:

i think found problem: dotnetcurry.com/aspnet/888/aspnet-webapi-message-lifecycle looks controller , dependencies created before auth logic run. guess question becomes ... can force authorisefilter run , confirm users identity before controller constructed.

this changes question become:

how ensure authentication occurs before controller , dependencies constructed?

---

edit 2: answer - not ideal answer ...

can more rep unlock question please, not duplicate of other question, op asking basica usage of ninject asking webapi lifecycle , how session related context prior session being known current request.

---

ok don't answer solution.

if else has better 1 love hear ...

if update service constructor ...

class somethingservice : isomethingservice {      public somethingservice(ikernel kernel) { ... } } 

... , drop kernel in local field, when come run service code ...

  public void foo() {       var user = kernel.get<user>();   } 

... means ...

i user @ point of request lifecycle authentication , authorisation has taken place, , stack correctly constructed.

now if ask user, when rule runs httpcontext correctly showing right user details.

it works ...

this di antipattern type behaviour, don't , prefer find solution meant authenticate user there , if hadn't happened yet mean replicating code webapi stack has (that mean easier though) , take place anyway resulting in authentication process happening twice.

in absence of such solution ... "semi" reasonable workaround.

it's been while later found out answer this.

the problem whilst had auth info in form of auth token provided header value, trying construct information user , may not have needed during request.

i wanted ensure business services sat behind controller handling request given current user when in fact needed auth information auth info used determine , make security related decisions (such getting user if appropriate).

in end took creating ioc binding examine owin context , ask auth information, auth information inject in controller / service needed.

from there @ least had contextual information needed make key decisions.