Custom IIdentity w/ FormsAuthentication

[Guest]

Hi all,

I created a custom IIdentity class to store additional properties for a
logged in user.

The only way I've been able to assign a custom IIdentity when using
FormsAuthentication is to swap it in the Begin_AuthenticateRequest event in
the global.asax.

Is it safe to susbstitute a custom IIdentity in place of the "standard"
FormsIdentity?

Does anyone know if this will create any security problems?

I've swapped my custom IIdentity into a GenericPrincipal and it seems to
work ok...

 

[sloan]

Here is a decent article.
http://www.leastprivilege.com/ContextUserVsThreadCurrentPrincipal.aspx

Are you saying that:
// Attach the new principal object to the current HttpContext object
Context.User = principal;


fails, unless you have it in
Begin_AuthenticateRequest ?

 

[Guest]

(e-mail address removed) wrote in @g44g2000cwa.googlegroups.com:

Are you saying that:
// Attach the new principal object to the current HttpContext object
Context.User = principal;


fails, unless you have it in
Begin_AuthenticateRequest ?

I've attached a custom principal AND custom identity within the
Application_AuthenticateRequest event handler ... and it seems to be
working OK???

So what I'm worried out:

I am no longer using the FormsIdentity Object - yet forms authentication
works OK. Have I created any security holes?