Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

DefaultAuthenticationModule Class

Ensures that an authentication object is present in the context. This class cannot be inherited.

Namespace: System.Web.Security
Assembly: System.Web (in system.web.dll)
public sealed class DefaultAuthenticationModule : IHttpModule
public final class DefaultAuthenticationModule implements IHttpModule
public final class DefaultAuthenticationModule implements IHttpModule
Not applicable.

The DefaultAuthenticationModule ensures that the User property of the current HttpContext is set to an IPrincipal object for each request. The DefaultAuthenticationModule examines the User property after the AuthenticateRequest event and before the AuthorizeRequest event. If the User property is a null reference (Nothing in Visual Basic), the DefaultAuthenticationModule sets the User property to a GenericPrincipal object that contains no user information.

If the authentication module sets the StatusCode property to 401, the DefaultAuthenticationModule will write out a special access-denied error page. If the value of the StatusCode property is set to a value greater than 200, the DefaultAuthenticationModule object will end the request, and only HTTP modules that subscribe to the EndRequest event will be called prior to the completion of the current request.

The DefaultAuthenticationModule exposes an Authenticate event that enables you to provide a custom IPrincipal object for the User property of the current HttpContext. The Authenticate event is accessed by specifying an event named DefaultAuthentication_OnAuthenticate in the Global.asax file for your ASP.NET application.

The following code example uses the DefaultAuthentication_OnAuthenticate event to test whether the User property of the current HttpContext is a null reference (Nothing in Visual Basic). If the User property is a null reference (Nothing in Visual Basic), then the sample sets the User property of the current HttpContext to a GenericPrincipal object where the Identity of the GenericPrincipal object is a GenericIdentity with a Name value of "default."

NoteNote:

The DefaultAuthentication_OnAuthenticate event is raised before the AuthorizeRequest event. As a result, if you set the User property of the current HttpContext to a custom identity, it can affect the behavior of your application. For example, if you are using the FormsAuthentication class and you specify <deny users="?" /> in the authorization configuration section to ensure that only authenticated users have access to your site, this sample will cause the deny element to be ignored, as the user will have a name, which is "default." Instead, you would specify <deny users="default" /> to ensure that only authenticated users can access your site.

public void DefaultAuthentication_OnAuthenticate(object sender,
                                                 DefaultAuthenticationEventArgs args)
{
  if (args.Context.User == null)
    args.Context.User = 
      new System.Security.Principal.GenericPrincipal(
        new System.Security.Principal.GenericIdentity("default"),
        new String[0]);
}

System.Object
  System.Web.Security.DefaultAuthenticationModule
Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Windows 98, Windows Server 2000 SP4, Windows Server 2003, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP SP2, Windows XP Starter Edition

The Microsoft .NET Framework 3.0 is supported on Windows Vista, Microsoft Windows XP SP2, and Windows Server 2003 SP1.

.NET Framework

Supported in: 3.0, 2.0, 1.1, 1.0
Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft. All rights reserved.