Programming Microsoft® ASP.NET 3.5

The ASP.NET Security Context

From an application point of view, security is mostly a matter of authenticating users and authorizing actions on the system's resources. ASP.NET provides a range of authentication and authorization mechanisms implemented in conjunction with IIS, the .NET Framework, and the underlying security services of the operating system. The overall security context of an ASP.NET application is composed of three distinct levels:

• The IIS level associates a valid security token with the sender of the request. The security token is determined according to the current IIS authentication mechanism.

• The ASP.NET worker process level determines the identity of the thread in the ASP.NET worker process serving the request. If enabled, impersonation ...