title: If authentication ticket also contains information about roles, then why...?
body: <p>
  
  <p>Q1 – Reason as to why native <em>UrlAuthorizationModule</em>  doesn’t understand roles is due to the fact that roles information is stored in managed object implementing <em>IPrincipal</em> interface, to which native modules don’t have access to. </p>
  
  <p>A) But if native <em>UrlAuthorizationModule</em> understands authentication ticket, and thus can work in conjunction with <em>FormsAuthenticationModule</em>, then why can’t it also work with Roles module? </p>
  
  <p>Namely, doesn’t this ticket also contain information about the roles user is in? If so, then <em>UrlAuthorizationModule</em> could get all the information about roles from the ticket and thus wouldn’t need to have access to <em>IPrincipal</em> object?!</p>
  
  <p><br></p>
  
  <p>Q2 
  The following article <em><a href="http://www.asp.net/learn/security/tutorial-11-vb.aspx" rel="nofollow noreferrer">http://www.asp.net/learn/security/tutorial-11-vb.aspx</a></em> claims:</p>
  
  <blockquote>
    <p>If an anonymous user visits the site, neither the <em>FormsAuthenticationModule</em> nor the <em>RoleManagerModule</em> creates a principal object.</p>
  </blockquote>
  
  <p><br></p>
  
  <p>A) If the above claim was true, then wouldn’t then the following code throw an exception, since <em>User</em> property would contain a null reference:</p>
  
  <pre><code>        if (User.Identity.IsAuthenticated)
              Label1.Text = "user is authenticated";
          else Label1.Text = "user is not authenticated";
  </code></pre>
  
  <p><em>Label1</em> displays “<em>User is not authenticated</em>”, which would suggest that <em>User</em> property is assigned object implementing <em>IPrincipal</em>, even if user is not authenticated?! </p>
  
  <p><br></p>
  
  <p>Thanx</p>