| 
37 | 37 |  The following example uses the **DefaultAuthentication_OnAuthenticate** event to test whether the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance is `null`. If the <xref:System.Web.HttpContext.User%2A> property is `null`, then the sample sets the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a <xref:System.Security.Principal.GenericPrincipal> object where the <xref:System.Security.Principal.GenericPrincipal.Identity%2A> of the <xref:System.Security.Principal.GenericPrincipal> object is a <xref:System.Security.Principal.GenericIdentity> with a <xref:System.Security.Principal.GenericIdentity.Name%2A> value of "default."    | 
38 | 38 |     | 
39 | 39 | > [!NOTE]  | 
40 |  | ->  The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site.    | 
 | 40 | +>  The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site.    | 
41 | 41 |     | 
42 | 42 |  [!code-csharp[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/csharp/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/CS/global.asax#1)]  | 
43 | 43 |  [!code-vb[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/visualbasic/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/VB/global.asax#1)]    | 
 | 
110 | 110 |     | 
111 | 111 |  You can use the <xref:System.Web.Security.DefaultAuthenticationEventArgs.Context%2A> property of the <xref:System.Web.Security.DefaultAuthenticationEventArgs> object in the **DefaultAuthentication_OnAuthenticate** event to set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom <xref:System.Security.Principal.IPrincipal> object. If you do not specify a value for the <xref:System.Web.HttpContext.User%2A> property, the <xref:System.Web.Security.DefaultAuthenticationModule> sets the <xref:System.Web.HttpContext.User%2A> property of the <xref:System.Web.HttpContext> instance to a <xref:System.Security.Principal.GenericPrincipal> object that contains no user information.    | 
112 | 112 |     | 
113 |  | - The **DefaultAuthentication_OnAuthenticate** event is raised after the <xref:System.Web.HttpApplication.AuthenticateRequest> event and before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. If you have an  section that depends on the user name to deny or allow access to your application, modifying the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance can affect the behavior of your application. Be sure that the user name you set during the **DefaultAuthentication_OnAuthenticate** event is considered when you specify the [authorization](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) section in your configuration.    | 
 | 113 | + The **DefaultAuthentication_OnAuthenticate** event is raised after the <xref:System.Web.HttpApplication.AuthenticateRequest> event and before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. If you have an  section that depends on the user name to deny or allow access to your application, modifying the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance can affect the behavior of your application. Be sure that the user name you set during the **DefaultAuthentication_OnAuthenticate** event is considered when you specify the [authorization](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) section in your configuration.    | 
114 | 114 |     | 
115 | 115 | > [!NOTE]  | 
116 |  | ->  If the Web application is running in IIS 7.0 in Integrated mode, the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event of the <xref:System.Web.Security.DefaultAuthenticationModule> is not raised. If the `mode` attribute of the [authentication](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/532aee0e(v%3dvs.100)) configuration element is set to "None" and the application subscribes to the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event, a <xref:System.PlatformNotSupportedException> error is raised. In this scenario, to receive authentication notification, subscribe to the <xref:System.Web.HttpApplication.AuthenticateRequest> event of the <xref:System.Web.HttpApplication> instance. For more information about compatibility issues in Integrated mode, see [Moving an ASP.NET Application from IIS 6.0 to IIS 7.0](https://msdn.microsoft.com/library/76f9cc78-f978-4837-b1c8-51d642ec4847).    | 
 | 116 | +>  If the Web application is running in IIS 7.0 in Integrated mode, the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event of the <xref:System.Web.Security.DefaultAuthenticationModule> is not raised. If the `mode` attribute of the [authentication](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/532aee0e(v%3dvs.100)) configuration element is set to "None" and the application subscribes to the <xref:System.Web.Security.DefaultAuthenticationModule.Authenticate> event, a <xref:System.PlatformNotSupportedException> error is raised. In this scenario, to receive authentication notification, subscribe to the <xref:System.Web.HttpApplication.AuthenticateRequest> event of the <xref:System.Web.HttpApplication> instance. For more information about compatibility issues in Integrated mode, see [Moving an ASP.NET Application from IIS 6.0 to IIS 7.0](https://msdn.microsoft.com/library/76f9cc78-f978-4837-b1c8-51d642ec4847).    | 
117 | 117 |     | 
118 | 118 |      | 
119 | 119 |     | 
120 | 120 | ## Examples    | 
121 | 121 |  The following code example uses the **DefaultAuthentication_OnAuthenticate** event to test whether the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance is `null`. If the <xref:System.Web.HttpContext.User%2A> property is `null`, then the sample sets the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a <xref:System.Security.Principal.GenericPrincipal> object where the <xref:System.Security.Principal.GenericPrincipal.Identity%2A> of the <xref:System.Security.Principal.GenericPrincipal> object is a <xref:System.Security.Principal.GenericIdentity> with a <xref:System.Security.Principal.GenericIdentity.Name%2A> value of "default."    | 
122 | 122 |     | 
123 | 123 | > [!NOTE]  | 
124 |  | ->  The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site.    | 
 | 124 | +>  The **DefaultAuthentication_OnAuthenticate** event is raised before the <xref:System.Web.HttpApplication.AuthorizeRequest> event. As a result, if you set the <xref:System.Web.HttpContext.User%2A> property of the current <xref:System.Web.HttpContext> instance to a custom identity, it can affect the behavior of your application. For example, if you are using the <xref:System.Web.Security.FormsAuthentication> class and you specify `<deny users="?" />` in the [authorization](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8d82143t(v%3dvs.100)) configuration section to ensure that only authenticated users have access to your site, this sample will cause the [deny](https://docs.microsoft.com/previous-versions/dotnet/netframework-4.0/8aeskccd(v%3dvs.100)) element to be ignored, as the user will have a name, which is "default." Instead, you would specify `<deny users="default" />` to ensure that only authenticated users can access your site.    | 
125 | 125 |     | 
126 | 126 |  [!code-csharp[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/csharp/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/CS/global.asax#1)]  | 
127 | 127 |  [!code-vb[System.Web.Security.DefaultAuthenticationModule#1](~/samples/snippets/visualbasic/VS_Snippets_WebNet/System.Web.Security.DefaultAuthenticationModule/VB/global.asax#1)]    | 
 | 
0 commit comments