download http://www.pluralsight.com/toolcontent/show_pipeline.zip

put the ashx file in a web app and run it through your browser - you'll see the DefaultAuthentication event (this one is hardwired and you will not find a registration in the HttpModules section in machine.config).

fire up Reflector and look for System.Web.Security.DefaultAuthenticationModule - in the OnEnter method you'll see a call to "SetPrincipalOnThread" - follow this link - and there you are.

was that the "documentation" you are looking for ? :)



---
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

   nntp://news.microsoft.com/microsoft.public.dotnet.security/<AF107FF6-A8D1-481B-AC68-FAD1F18A1***@microsoft.com>

Thanks Nicole and Dominick,

@Nicole, you guessed right, my implementation of IsAuthenticated was buggy,
fixed that and everything works as expected...

@Dominick, do you happen to have a link to some documentation on that
undocumented behavior?

rgds,
Baileys

[microsoft.public.dotnet.security]

Error instantiating RSACryptoServiceProvider
Error from CAS Config util
Assembly.Load fails after assembly preloaded using Assembly.LoadFrom (v1.1.4322)
IIS Authentication Problem?
AddDomain with FullTrust