Custom IPrincipal // Hacking the Application_AuthenticateRequest method // Something better in 2.0?

[sloan]

I've been reading this article:
http://msdn2.microsoft.com/EN-US/library/aa302401.aspx

Building Secure ASP.NET Applications: Authentication, Authorization, and
Secure Communication

(the article is for 1.1)
(i'm using 2.0)

The article is good. Then you get to the part about:::::::::::::


protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
}


That you have to "hack in" a way to keep your custom IPrincipal alive and
well.





(I discovered this because when I did the following:


CustomPrincipal customPrinc = new CustomPrincipal(ident);
System.Web.HttpContext.Current.User = customPrinc ;


then you went to the next page, the System.Web.HttpContext.Current.User was
a GenericPrincipal) and not an instance of CustomPrincipal like I would
expect.



.............

Is there a better way to handle this in 2.0, rather than hacking into the
Application_AuthenticateRequest method?



With the provider model in 2.0 I would expect something (similar) to:



<authentication mode= "MyCustomAuthenicator"/>



But no go on that.



There's gotta be a better way in 2.0 ?!?



Thanks!