Building Secure ASP.NET Applications - People Search Directory

ASP.NET Identity Matrix
Principal objects implement the IPrincipal interface and represent the security
context of the user on whose behalf the code is running. The principal object
includes the user’s identity (as a contained IIdentity object) and any roles to which
the user belongs.
ASP.NET provides the following principal and identity object implementations:
● WindowsPrincipal and WindowsIdentity objects represent users who have been
authenticated with Windows authentication. With these objects, the role list is
automatically obtained from the set of Windows groups to which the Windows
user belongs.
● GenericPrincipal and GenericIdentity objects represent users who have been
authenticated using Forms authentication or other custom authentication
mechanisms. With these objects, the role list is obtained in a custom manner,
typically from a database.
● FormsIdentity and PassportIdentity objects represent users who have been
authenticated with Forms and Passport authentication respectively.
The following tables illustrate, for a range of IIS authentication settings, the
resultant identity that is obtained from each of the variables that maintain an
IPrincipal and/or IIdentity object. The following abbreviations are used in
the table:
● HttpContext = HttpContext.Current.User, which returns an IPrincipal object
that contains security information for the current Web request. This is the
authenticated Web client.
● WindowsIdentity = WindowsIdentity.GetCurrent(), which returns the identity
of the security context of the currently executing Win32 thread.
● Thread = Thread.CurrentPrincipal which returns the principal of the currently
executing .NET thread which rides on top of the Win32 thread.