|
37 | 37 | The following example uses the **DefaultAuthentication_OnAuthenticate** event to test whether the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance is `null`. If the <xref:System.Web.HttpContext.User%2A> property is `null`, then the sample sets the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a <xref:System.Security.Principal.GenericPrincipal> object where the <xref:System.Security.Principal.GenericPrincipal.Identity%2A> of the <xref:System.Security.Principal.GenericPrincipal> object is a <xref:System.Security.Principal.GenericIdentity> with a <xref:System.Security.Principal.GenericIdentity.Name%2A> value of "default."
|
38 | 38 |
|
39 | 39 | > [!NOTE]
|
40 |
| -> The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site. |
| 40 | +> The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site. |
41 | 41 |
|
42 | 42 | [!code-csharp[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/csharp/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/CS/global.asax#1)]
|
43 | 43 | [!code-vb[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/visualbasic/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/VB/global.asax#1)]
|
|
110 | 110 |
|
111 | 111 | You can use the <xref:System.Web.Security.DefaultAuthenticationEventArgs.Context%2A> property of the <xref:System.Web.Security.DefaultAuthenticationEventArgs> object in the **DefaultAuthentication_OnAuthenticate** event to set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom <xref:System.Security.Principal.IPrincipal> object. If you do not specify a value for the <xref:System.Web.HttpContext.User%2A> property, the <xref:System.Web.Security.DefaultAuthenticationModule> sets the <xref:System.Web.HttpContext.User%2A> property of the <xref:System.Web.HttpContext> instance to a <xref:System.Security.Principal.GenericPrincipal> object that contains no user information.
|
112 | 112 |
|
113 |
| - The **DefaultAuthentication_OnAuthenticate** event is raised after the <xref:System.Web.HttpApplication.AuthenticateRequest> event and before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. If you have an section that depends on the user name to deny or allow access to your application, modifying the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance can affect the behavior of your application. Be sure that the user name you set during the **DefaultAuthentication_OnAuthenticate** event is considered when you specify the [authorization](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) section in your configuration. |
| 113 | + The **DefaultAuthentication_OnAuthenticate** event is raised after the <xref:System.Web.HttpApplication.AuthenticateRequest> event and before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. If you have an section that depends on the user name to deny or allow access to your application, modifying the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance can affect the behavior of your application. Be sure that the user name you set during the **DefaultAuthentication_OnAuthenticate** event is considered when you specify the [authorization](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) section in your configuration. |
114 | 114 |
|
115 | 115 | > [!NOTE]
|
116 |
| -> If the Web application is running in IIS 7.0 in Integrated mode, the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event of the <xref:System.Web.Security.DefaultAuthenticationModule> is not raised. If the `mode` attribute of the [authentication](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/532aee0e(v%3dvs.100)) configuration element is set to "None" and the application subscribes to the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event, a <xref:System.PlatformNotSupportedException> error is raised. In this scenario, to receive authentication notification, subscribe to the <xref:System.Web.HttpApplication.AuthenticateRequest> event of the <xref:System.Web.HttpApplication> instance. For more information about compatibility issues in Integrated mode, see [Moving an ASP.NET Application from IIS 6.0 to IIS 7.0](https://msdn.microsoft.com/library/76f9cc78-f978-4837-b1c8-51d642ec4847). |
| 116 | +> If the Web application is running in IIS 7.0 in Integrated mode, the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event of the <xref:System.Web.Security.DefaultAuthenticationModule> is not raised. If the `mode` attribute of the [authentication](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/532aee0e(v%3dvs.100)) configuration element is set to "None" and the application subscribes to the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event, a <xref:System.PlatformNotSupportedException> error is raised. In this scenario, to receive authentication notification, subscribe to the <xref:System.Web.HttpApplication.AuthenticateRequest> event of the <xref:System.Web.HttpApplication> instance. For more information about compatibility issues in Integrated mode, see [Moving an ASP.NET Application from IIS 6.0 to IIS 7.0](https://msdn.microsoft.com/library/76f9cc78-f978-4837-b1c8-51d642ec4847). |
117 | 117 |
|
118 | 118 |
|
119 | 119 |
|
120 | 120 | ## Examples
|
121 | 121 | The following code example uses the **DefaultAuthentication_OnAuthenticate** event to test whether the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance is `null`. If the <xref:System.Web.HttpContext.User%2A> property is `null`, then the sample sets the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a <xref:System.Security.Principal.GenericPrincipal> object where the <xref:System.Security.Principal.GenericPrincipal.Identity%2A> of the <xref:System.Security.Principal.GenericPrincipal> object is a <xref:System.Security.Principal.GenericIdentity> with a <xref:System.Security.Principal.GenericIdentity.Name%2A> value of "default."
|
122 | 122 |
|
123 | 123 | > [!NOTE]
|
124 |
| -> The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site. |
| 124 | +> The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site. |
125 | 125 |
|
126 | 126 | [!code-csharp[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/csharp/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/CS/global.asax#1)]
|
127 | 127 | [!code-vb[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/visualbasic/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/VB/global.asax#1)]
|
|
0 commit comments