Login system in Asp.net mvc

Question

How do I implement a login system in an Asp.net MVC application. Do I use Forms Authentication or Identity? I’ve been reading about Identity and wanted to see a basic example of Identity using the MVC web template without authentication No Authentication. Or if not, an example Forms Authentication in the MVC.

Answer 1

Most of the tools you used on Asp.net with Web Forms are available on Asp.net MVC, the Framework has evolved, but that doesn’t mean you no longer have the other tools. Therefore, you can implement an authentication mechanism based on a repository or service, just as you did before. A simplistic example would be a table in the database where you validate a login and password typed in a form.

It is important to note that Authorization is different from authentication, the act of authenticating a user is similar to checking an identity, while authorizing is allowing someone identified to use a resource (controlling the urls that someone can access).

So, in a very simple system, you would configure your Web.config for the "Forms" authentication type, with the controller/action url that logs in (the login form) and then does a method that returns a boolean by checking true for correct login and password and false for wrong.

Sample of a Web.config:

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

If the user hits the login and password, you authenticate it using the method:

FormsAuthentication.SetAuthCookie(username, false);

Where username is login and ready, you built an MVC application with using custom Forms-based authentication.

It’s important to note that if you control login, but you don’t restrict access to controllers or actions for authenticated users, then you’re doing nothing. :)

To restrict the access of a Controller or an action, you can use an "Authorize" attribute, as in the example below:

public class HomeController : Controller
{
    [Authorize]
    public ActionResult Index()
    {
        ViewBag.Message = "Welcome to ASP.NET MVC!";

        return View();
    }

    [Authorize(Roles="Admin")]
    public ActionResult About()
    {
        return View();
    }
}

This is not a good way to do Authorization, note that in one of the controller methods I allow only Admin (fixed in code) access, this should be controlled dynamically, because in practice you control several profiles dynamically in real world applications.

Another problem is that you have to remember which areas (controller/action) are restricted, so sometimes you might wonder if it’s worth having a Controllerbase class and inheriting your controllers from it, then you restrict access to that class, though you may also fail to inherit it from her. Automated testing or code review would help.

A good basic article on Custom Authentication: http://www.codeproject.com/Articles/578374/AplusBeginner-splusTutorialplusonplusCustomplusF

Remember that the method that does the custom authentication is your responsibility, so you can use whatever repository you need. For example, I worked on a project where we used Forms to authenticate the user in the network’s Active Directory, I used Forms the same way, the difference was the method to authenticate.