Which event to handle in HttpModule for setting the current principal when dealing with providers?

Question

I am facing a problem where I have to integrate with a custom HttpModule where the principal and identity are set on the current thread so that HttpContext.Current.User contains these. However I get the feeling that the eventhandler they used (PostAcquireRequestState) is way too late.

Which is the best event to handle before the initialization of the providers happen in the HttpModule? All I want is my custom provider to work with the correct principal and identity.

Answer 1

This is probably best done in the PostAuthenticateRequest event. ASP.NET assumes that after this event the security information is stable.