Hi,

In your own custom code you should generally always use HttpContext.User and never have to worry about mojoPrincipal.

The only case where mojoPrincipal is used, is when hosting multiple sites on one installation using first level subfolder to determine the site.

At the bottom of the above linked page it talks about the limitations of this approach because all the sites use the same physical cookies because they share  the same host name. So the purpose of mojoPrincipal and mojoIdentity is to solve this problem by doing extra cookie checks to determine if the user .IsAuthenticated and .IsInRole for the current site. The innerPrincipal is the normal generic principle associated with Context.User and some of the work is still delegated to this principal but further checks are done by the outer containing mojoPrinciple when needed. You can see this innerPrinciple is really the Context.User object and it is passed into the constructor of mojoPrincipal in Global.asax.cs if needed during Application_AuthenticateRequest

If not hosting multiple sites this way the complext cookie checking logic is not needed or used.

Hope the explanation helps.

Best,

Joe