Custom Login for MVC3 application - asp.net-mvc-3

Question

I want to build a website that displays user-specific information (e.g. user sees her own records when she logs in). I don't want to use MVC3 Internet Application with default Membership provider as I would like to experience building my own authentication. I found some links on the web but feel that I need more sources to read from.
My project is MVC3, Entity Framework with code first. Thank you,

Answer 1

Desciption
You can implement your own custom MemberShip Provider with your own logic.
More Information
ASP.NET MVC 2 Custom Membership Provider Tutorial
Codeplex: Custom Membership Providers
Using a Custom Membership Provider in an MVC Application
MSDN: Implementing a Membership Provider

Answer 2

I recently did a similar thing - we have an application written in classic ASP and I wanted to authenticate with .NET using the existing database tables at the same time (for anyone who's interested I first logged the user into the classic ASP side then posted their details to the .NET logon form causing it to do its own login process).
Pretty much everything I found suggested just writing my own MemberShip Provider (as suggested by (dknaack) and IPrincipal object to allow me to add additional fields I wanted (it was easier than extending the profile data).
It was actually very easy in the end; I didn't bother implementing all of the MembershipProvider functions because I didn't need them. Here I just use Entity framework to check if the username/password are valid but clearly you could use whatever you wanted.
Here's a dump of my code to get you started:
using System;
using System.Collections.Specialized;
using System.Linq;
using System.Security.Principal;
using System.Web.Security;
using My.Company.Project.Entities;
namespace My.Company.Project.Classes
{
public class ClassicMembershipProvider : MembershipProvider
{
public override void Initialize(string name, NameValueCollection config)
{
base.Initialize(name, config);
}
public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
{
throw new NotImplementedException();
}
public override bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer)
{
throw new NotImplementedException();
}
public override string GetPassword(string username, string answer)
{
throw new NotImplementedException();
}
public override bool ChangePassword(string username, string oldPassword, string newPassword)
{
throw new NotImplementedException();
}
public override string ResetPassword(string username, string answer)
{
throw new NotImplementedException();
}
public override void UpdateUser(MembershipUser user)
{
throw new NotImplementedException();
}
public override bool ValidateUser(string username, string password)
{
using (var entities = new ProjectEntities())
{
return entities.Buprofile
.Where(p => p.profileid == username &&
p.profilepassword == password)
.Count() == 1;
}
}
public override bool UnlockUser(string userName)
{
throw new NotImplementedException();
}
public override MembershipUser GetUser(object providerUserKey, bool userIsOnline)
{
throw new NotImplementedException();
}
public override MembershipUser GetUser(string username, bool userIsOnline)
{
throw new NotImplementedException();
}
public override string GetUserNameByEmail(string email)
{
throw new NotImplementedException();
}
public override bool DeleteUser(string username, bool deleteAllRelatedData)
{
throw new NotImplementedException();
}
public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords)
{
throw new NotImplementedException();
}
public override int GetNumberOfUsersOnline()
{
throw new NotImplementedException();
}
public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords)
{
throw new NotImplementedException();
}
public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords)
{
throw new NotImplementedException();
}
public override bool EnablePasswordRetrieval
{
get { return false; }
}
public override bool EnablePasswordReset
{
get { return false; }
}
public override bool RequiresQuestionAndAnswer
{
get { return false; }
}
public override string ApplicationName
{
get { throw new NotImplementedException(); }
set { throw new NotImplementedException(); }
}
public override int MaxInvalidPasswordAttempts
{
get { throw new NotImplementedException(); }
}
public override int PasswordAttemptWindow
{
get { throw new NotImplementedException(); }
}
public override bool RequiresUniqueEmail
{
get { return true; }
}
public override MembershipPasswordFormat PasswordFormat
{
get { throw new NotImplementedException(); }
}
public override int MinRequiredPasswordLength
{
get { throw new NotImplementedException(); }
}
public override int MinRequiredNonAlphanumericCharacters
{
get { throw new NotImplementedException(); }
}
public override string PasswordStrengthRegularExpression
{
get { throw new NotImplementedException(); }
}
}
}
You can hook it up by adding/updating in your web.config:
<membership defaultProvider="ClassicMembershipProvider" userIsOnlineTimeWindow="15">
<providers>
<clear />
<add name="ClassicMembershipProvider" type="My.Company.Project.Classes.ClassicMembershipProvider" applicationName="MyApplication" />
</providers>
</membership>
I also created a custom IPrincipal (based on http://blog.codevelop.dk/post/2007/11/24/ASPNET-20-Forms-authentication-Keeping-it-customized-yet-simple.aspx) which allows you to store various bits of data about the user in a UserData property (as mentioned, it looked far easier this way than to extend the user profile).
You can access UserData of a user once logged in by casting User: ((MyPrincipal)User).UserData - I overode the User property in my page base class so I could just use User. in future though:
/// <summary>
/// Override User and return a MyPrincipal with its additional data
/// </summary>
public new MyPrincipal User
{
get { return HttpContext.Current.User is MyPrincipal ? (MyPrincipal) HttpContext.Current.User : null; }
}
In the end this was pretty pain-free, and far less hassle than writing my own from scratch yet I still have all the control I need.