IIdentity, IPrincipal whats the difference?

IIdentity represents the user.

IPrincipal represents the user along with all his role memberships.

This is why IPrincipal has a reference to the IIdentity object that it encapsulates. In addition it also have methods to determine role membership.