For ASP.NET MVC I use to roll my own AuthorizeAttribute (just inherit it and overload OnAuthorization). I avoid dealing with IIdentity and IPrincipal, I find it sorta messy.<p>Looks like things are different on vNext though: <a href="http:&#x2F;&#x2F;docs.asp.net&#x2F;en&#x2F;latest&#x2F;security&#x2F;authorization&#x2F;index.html" rel="nofollow">http:&#x2F;&#x2F;docs.asp.net&#x2F;en&#x2F;latest&#x2F;security&#x2F;authorization&#x2F;index.h...</a>