For ASP.NET MVC I use to roll my own AuthorizeAttribute (just inherit it and overload OnAuthorization). I avoid dealing with IIdentity and IPrincipal, I find it sorta messy.

Looks like things are different on vNext though: http://docs.asp.net/en/latest/security/authorization/index.h...