Asp.net Security: IIdentity.IsAuthenticated default implementation

Question

I am writing my own custom Identity class which implements IIdentity. I don't need to change the default method IsAuthenticated but so now I was wondering how does the default IIdentity determines if it should return true or false?

I thought to find the answer in the FormsAuthenticationTicket I am using but not sure if that is correct.

Thanks in advance,

Pickels

Answer 1

There is no 'default IIdentity' in the context of an ASP.Net handler.

There is a GenericIdentity that is pass to a GenericPrincipal which is the default User for an ASP.Net handler, and it's behavior is that if it is instantiated with a non-empty username then it is authenticated.

e.g.

public virtual bool IsAuthenticated
{
    get
    {
        return !this.m_name.Equals("");
    }
}

That said, the determination of IsAuthenticated is completely arbitrary and the class implementing IIdentity is fully responsible for implementing this logic.

Typically, there is no use case for instantiating an un-authenticated principal/identity as this is done automatically by the asp.net runtime, thus implementing your custom IIdentity with a 'dumb' IsAuthenticated that returns true should be appropriate in most cases.

Also, while fully implementing IPrincipal and IIdentity is trivial, you could also simply derive from GenericPrincipal and GenericIdentity reducing the amount of code you need to maintain.

In the context of FormsAuthentication you will only have a ticket if the user is authenticated and the User will be an instance of RolePrincipal with an identity of type FormsIdentity and it's implementation of IsAuthenticated is super complex ;-) ...

public bool IsAuthenticated
{
    get
    {
        return true;
    }
}

Hope that helps clear things up.