Trying to figure out the security model in Asp.Net I found these identity references.
a) WindowsIdentity.GetCurrent(): It seems it is always the windows user (OS user) that "runs the code" in any given time. (Its posible values depend on IIS security settings and on ASP.Net impersonation?).
b) Request.LogonUserIdentity: Is it always the user (OS user) that IIS set? I mean, it has nothing to do with asp.net impersonation settings.
c) User.Identity: The asp.net authenticated user. Has nothing to do with the user that "runs the code". In fact it doesn't has to be a windows identity or to be something the OS could understand. If it is a windows identity, asp.net impersonation could use it for "running the code".
d) Thread.CurrentPrincipal.Identity: At several points the http application pipeline syncronize this reference to point to the same object as ...
Go to the complete details ...