I've been looking into implementing a RoleProvider for our ASP.NET applications at work, partly to ease the upgrade path to ASP.NET 2, partly because it's inherently useful for our requirements and partly because I'm interested in the provider pattern for a number of potential uses.
So anyway, I was poking away in the documentation and bits and pieces trying to get an appreciation of how the ASP.NET 2 roles management system works, and I finally realised that they don't assign roles when the first request is authenticated, which is what I've been doing for the past few years (creating a generic principal, assigning roles to it and then assigning it back to Context.User).
After a bit of experimentation (which involved writing a class I call "StupidPrincipal", which returns true when queried for membership of certain hard-code roles and false for anything else) I now know that the ASP.NET authorisation mechanism actually calls the current user's IsInRole(...) method for the roles specified in the Web.config - a nice and simple approach.
The beauty of only retrieving roles when IsInRole(...) is called (and then caching them of course if desired) is that a single role/principal system can be used across all your web applications regardless of whether they all use roles or not, and there's no danger of wasting time and resources trying to retrieve a list of roles for an application that doesn't use them...which also means that a single application can switch between using roles and not using them (or vice versa) without having to yank out or otherwise play around with authentication code.
I like that.
Updated 28/08/2005
I removed the reference to exactly which roles I was using, since the Community Server nannyware was replacing one of them with "***".
I'm glad this isn't a historical blog, or as I'm about to demonstrate it would be impossible to mention the original title of William the Conqueror, who was previously known as William the *** (and it's worth noting that on arrival in England he demonstrated that he was a *** in the slang sense as well. With bells on). And yep, that's the word I used as a role name. The other one was Manager - not a good choice I know since they might be regarded as interchangeable.