The advantage I see is if you call components or objects that live in other processes or app domains. My understanding is that whatever security identity you attach to the thread will flow through to the call to the other process automatically. Supposedly the component shouldn't know about the web session so your component would be more portable in other contexts.


>Is there an advantage to using Principle and Indentity objects and attaching them to the context over just storing the user_id in the cookie and having a business object that has methods like InRole() ???
>
>One advantage I see is being able to use a permission attribute on your methods. Any others?
>
>BOb