ClaimsPrincipal.Current vs. HttpContext.Current.User?

Question

In MVC, what's the difference between these 2?

They look the same, and they even return the same type / class System.Web.Security.RolePrincipal , but there are subtleties.

Eg. The following code generates various errors when called with an instance generated through ClaimsPrincipal.Current

 cp.FindFirst(ClaimTypes.Name); //{"Unable to connect to SQL Server database."} <--HUH!? cp.Claims; //{"Value cannot be null.\r\nParameter name: username"} 

The above works if cp is instead:

 var cp = System.Web.HttpContext.Current.User 

When drilling individuals using quick browsing, I see that both of them have the same application dictionary. However, for some reason, public ownership blows when invoking the object returned by ClaimsPrincipal.Current

Help - why is it !? It drives me crazy.

============== EDIT ===================

It must be almost time to sleep.

IPrincipal supports multiple identifiers. This requires some kind of store. IIdentity returns an instance of ClaimsIdentity and does not need to be saved.

I just checked the wrong properties. Both of them are almost identical in shape, i.e. the same properties and methods that I confused them.

Answer 1

The identifier is the current authenticated user, and the main one is the security context in which the code works.

This article is a good explanation of what I found useful http://msdn.microsoft.com/en-us/library/ftx85f8x.aspx .