The System.Web.Security.DefaultAuthenticationModule ensures that the System.Web.HttpContext.User property of the current System.Web.HttpContext instance is set to an System.Security.Principal.IPrincipal object for each request. The System.Web.Security.DefaultAuthenticationModule examines the System.Web.HttpContext.User property after the System.Web.HttpApplication.AuthenticateRequest event and before the System.Web.HttpApplication.AuthorizeRequest event. If the System.Web.HttpContext.User property is null, the System.Web.Security.DefaultAuthenticationModule sets the System.Web.HttpContext.User property to a System.Security.Principal.GenericPrincipal object that contains no user information.

If the authentication module sets the System.Web.HttpResponse.StatusCode property to 401, the System.Web.Security.DefaultAuthenticationModule will render an access-denied error page. If the value of the System.Web.HttpResponse.StatusCode property is set to a value greater than 200, the System.Web.Security.DefaultAuthenticationModule object will end the request. In that case, only HTTP modules that subscribe to the System.Web.HttpApplication.EndRequest event are called prior to the completion of the current request.

The System.Web.Security.DefaultAuthenticationModule exposes an DefaultAuthenticationModule.Authenticate event. You can use this event to provide a custom System.Security.Principal.IPrincipal object for the System.Web.HttpContext.User property of the current System.Web.HttpContext instance. The WindowsAuthenticationModule.Authenticate event is accessed by specifying an event named DefaultAuthentication_OnAuthenticate in the application's Global.asax file.

Namespace: System.Web.Security
Assembly: System.Web (in System.Web.dll)
Assembly Versions: 1.0.5000.0, 2.0.0.0