title: Cookie Authentication without Identity Password
body: <p>I'm using the default individual user accounts template in Visual Studio 2017 asp.net core with my own custom user tables. <code>User</code> table has a <code>Password</code> and <code>LoginModel</code> has a <code>Password</code>. I've been following along <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie" rel="nofollow noreferrer">here</a>, for the <code>Login</code> in the <code>AccountController</code>.</p>
  
  <pre><code>    [HttpPost]
      [AllowAnonymous]
      [ValidateAntiForgeryToken]
      public virtual async Task&lt;IActionResult&gt; Login(LoginModel model,
          string returnUrl)
      {
          if (ModelState.IsValid)
          {
              var user = _context.Users.FirstOrDefault(u =&gt; u.Email == model.Email);
              var claims = new List&lt;Claim&gt;
              {
                  new Claim(ClaimTypes.Email, user.Email)
              };
              var identity = new ClaimsIdentity(claims);
              var principal = new ClaimsPrincipal(identity);
              await _httpContext.Authentication.SignInAsync
                  (CookieAuthenticationDefaults.AuthenticationScheme,
                  principal, new AuthenticationProperties
                  {
                      IsPersistent = model.RememberMe,
                      ExpiresUtc = DateTime.UtcNow.AddYears(1)
                  });
              return RedirectToRoute("HomePage");
          }
          return View(model);
      }
  </code></pre>
  
  <p>When I run the code, email will throw an error if I put in wrong one, but I can put whatever password I want and it'll be successful. How would I pull in the password to make sure it's the correct password?</p>