Our applications use a method similar to what is described at http://www.codeproject.com/KB/aspnet/ASP_Net3_5CustomWinAuthen.aspx to authenticate users and set up their roles. We basically authenticate against our Active Directory, and then build a custom FormsAuthenticationTicket using roles pulled from our SQL database. This works fine in .NET 3.5, however we are upgrading to 4.0 and running into some problems.
The issue seems to stem from the fact that the WindowsAuthentication_OnAuthenticate method in global.asax fires first as the authenticated user and correctly sets up the roles and HttpContext.Current.User object. However, it then fires again as the application pool which overwrites everything previously set up. I can prevent this by exiting the OnAuthenticate method if the identity matches the application pool, but I'm just wondering why this event fir ...
Go to the complete details ...