Difference between HttpApplication.User (in Global.asax) and Controller.User (in an MVC Controller)

Question

We're using a third-party authentication mechanism (CAS, via the .NET CAS Client). As part of this, we need to extract some data about the logged in user.

We have achieved this by accessing the HttpApplication.User instance from Global.asax (a DotNetCasClient.Security.CasPrincipal in our scenario). However, we need it to work from a controller.

The problem is that from a controller we have access to Controller.User, the instance of which is a plain old System.Web.Security.RolePrincipal, which is not what we need.

So:

• Why are these instances not the same?
• Is it possible to get the HttpApplication.User from within a controller?

Answer 1

I know there has got to be a better way to do this -- but in the meantime, I would suggest using HttpContext.Current.Items["YourKey"] and then accessing the Context.Item in your controller.

See HttpContext.Items in MSDN for more information.

Answer 2

Have you tried to inherit from Controller and override OnAuthorization?

protected override void OnAuthorization(AuthorizationContext filterContext)
{
    filterContext.HttpContext.ApplicationInstance.User   // CasPrincipal ???
......