I have been given the assignment of modifying an ASP.NET MVC application in such a way that navigating to `myurl?username=xxxxxx` automatically logs in user `xxxxxx`, without asking for a password.

I already made it very clear that this is a terrible idea for many security-related reasons and scenarios, but the people in charge are determined. The site would not be publicly available.

So: is there any way of signing in without a password by, for example, extending the `Microsoft.AspNet.Identity.UserManager` and modifying the `AccountController`?

Some code:

```
var user = await _userManager.FindAsync(model.UserName, model.Password);
if (user != null && IsAllowedToLoginIntoTheCurrentSite(user))
{
    user = _genericRepository.LoadById<User>(user.Id);
    if (user.Active)
    {
        await SignInAsync(user, model.RememberMe);

```

`_userManager` holds an instance of a `Microsoft.AspNet.Identity.UserManager`.

and `SignInAsync()`:

```
private async Task SignInAsync(User user, bool isPersistent)
{
    AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
    var identity = await _userManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
    if (user.UserGroupId.IsSet())
        user.UserGroup = await _userManager.Load<UserGroup>(user.UserGroupId);

    //adding claims here ... //

    AuthenticationManager.SignIn(
        new AuthenticationProperties { IsPersistent = isPersistent }, 
        new CustomClaimsIdentity(identity));
}

```

`AuthenticationManager` would be `OwinSecurity`.