Thread.CurrentPrincipal set in Application_AuthenticationRequest is not set later in the app

Question

In the global.asax file for the Application_AuthenticationRequest I'm setting the Thread.CurrentPrincipal to a custom principal. I also set the HttpContext.Current.User to the same principal.

However later in the app when I need to cast the Thread.CurrentPrincipal to our custom type, I get a runtime error saying: Unable to cast object of type 'System.Web.Security.RolePrincipal' to type 'OurCustomPrincipal'.

How did the Thread.CurrentPrincipal get reset to RolePrincipal, and more to the point how do I keep it at the CustomPrincipal we set in the global.asax

Thanks in advance

score 6 · Accepted Answer · answered Sep 27 '09 at 14:04

6

You surely have resolved your problem by now but just in case, if you are using the RoleProvider from ASP.NET, the RoleManagerModule overwrites the GenericPrincipal object created by the FormsAuthenticationModule and replaces it with a RolePrincipal object during the PostAuthenticateRequest: http://www.asp.net/Learn/Security/tutorial-11-vb.aspx

answered Sep 27 '09 at 14:04

jon

408
6
20

this just started happening out of the blue. Doesn't know why. adding `` solved the problem. – tugberk Jun 05 '13 at 11:38

score 3 · Answer 2 · answered Apr 06 '11 at 01:06

3

To sum up, a quick fix is to perform your principal and identity replacements on the Application_OnPostAuthenticateRequest handler instead.

answered Apr 06 '11 at 01:06

tggm

973
2
15
41

score 0 · Answer 3 · answered Jun 25 '09 at 08:08

Please verify that you have implemented a class for IIDentity & Iprincipal interface and then you are using something like the following code to assign the currentprincipal.

    Dim userIdentity As CustomIdentity
    userIdentity = New CustomIdentity(username, True,"forms", sessionId)

    Dim principal As New CustomPrincipal(userIdentity, arrRoles)
    HttpContext.Current.User = principal
    System.Threading.Thread.CurrentPrincipal = principal

Thread.CurrentPrincipal set in Application_AuthenticationRequest is not set later in the app

3 Answers3

Linked