Asp.net Security: IIdentity.IsAuthenticated default implementation

asp.net, asp.net-membership, security

Solution

There is no 'default `IIdentity`' in the context of an ASP.Net handler.

There is a `GenericIdentity` that is pass to a `GenericPrincipal` which is the default `User` for an ASP.Net handler, and it's behavior is that if it is instantiated with a non-empty username then it is authenticated.

e.g.

public virtual bool IsAuthenticated
{
    get
    {
        return !this.m_name.Equals("");
    }
}

That said, the determination of IsAuthenticated is completely arbitrary and the class implementing `IIdentity` is fully responsible for implementing this logic.

Typically, there is no use case for instantiating an un-authenticated principal/identity as this is done automatically by the asp.net runtime, thus implementing your custom `IIdentity` with a 'dumb' `IsAuthenticated` that returns `true` should be appropriate in most cases.

Also, while fully implementing `IPrincipal` and `IIdentity` is trivial, you could also simply derive from `GenericPrincipal` and `GenericIdentity` reducing the amount of code you need to maintain.

In the context of `FormsAuthentication` you will only have a ticket if the user is authenticated and the `User` will be an instance of `RolePrincipal` with an identity of type `FormsIdentity` and it's implementation of `IsAuthenticated` is super complex ;-) ...

public bool IsAuthenticated
{
    get
    {
        return true;
    }
}

Hope that helps clear things up.

Problem

I am writing my own custom Identity class which implements IIdentity. I don't need to change the default method IsAuthenticated but so now I was wondering how does the default IIdentity determines if it should return true or false? I thought to find the answer in the FormsAuthenticationTicket I am using but not sure if that is correct. Thanks in advance, Pickels

Original source