title: Login system using Identity and role provider for existing database
body: <p>For the past few days, I was working in creating a login system for a webApp(asp.Net MVC 5) where I have a database already with username, credentials and Roles. I have found information from many blogs and stack overflow questions for my work and used it accordingly. Now before going online, I want to make sure that this login system is a secure one. I also want to know if there are some improvements which I can implement for this purpose. </p>
  
  <p>For Authentication, I have implemeted as shown in the below article <a href="https://www.jamessturtevant.com/posts/ASPNET-Identity-Custom-Database-and-OWIN/" rel="nofollow noreferrer">https://www.jamessturtevant.com/posts/ASPNET-Identity-Custom-Database-and-OWIN/</a>. For Authorization, I have used Role Provider and implemented few required methods as like one shown below:</p>
  
  <pre><code>public class RoleList:RoleProvider
  {
       public override bool IsUserInRole(string username, string roleName)
       {
              if (username == null || username == "")
                  throw new ProviderException("User name cannot be empty or null.");
              if (roleName == null || roleName == "")
                  throw new ProviderException("Role name cannot be empty or null.");
  
              bool userIsInRole = false;
              List&lt;string&gt; data = new List&lt;string&gt;();
              String mycon = ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString; 
              String myquery = 
                  "SELECT " +
                      "r.RName, u.UName " +
                  "FROM " +
                      "Users u " +
                  "INNER JOIN " +
                      "UserRole ur " +
                  "ON " +
                      "u.Id=ur.UserId " +
                  "INNER JOIN " +
                      "Roles r " +
                  "ON " +
                      "ur.RoleId=r.Id " +
                  "WHERE " +
                      "u.UName=@UName " +
                  "AND " +
                      "r.Name=@RName";
              var paramList = new List&lt;SqlParameter&gt;();
              paramList.Add(new SqlParameter("@UName", username));
              paramList.Add(new SqlParameter("@RName", roleName));
              using (var reader = HelperClasses.DatabaseUtil.GetReader(myquery, mycon, paramList))
              {
                  if (reader.HasRows)
                  {
                      userIsInRole = true;
                  }
              }
  
              return userIsInRole;
          }
  }
  </code></pre>
  
  <p><strong>In Database</strong>
  In the database, I have 4 tables storing below information respectively. </p>
  
  <ol>
  <li>user(name and Id) and hash password(using Bcrypt).</li>
  <li>Roles.</li>
  <li>Users and Roles mapping.</li>
  <li>Salt with user id</li>
  </ol>
  
  <p><strong>In Login Controller</strong></p>
  
  <p>Login:</p>
  
  <ol>
  <li>Get salt and hash from database using inputed user name.</li>
  <li>Adding salt to the inputed plain text password.</li>
  <li>Validating the password by inputing hash and salted password to Bcrypt.</li>
  <li>If success, user will be authenticated by custom sign in manager as shown below</li>
  </ol>
  
  <pre><code>CustomSignInManager.SignIn(user, isPersistent: false, rememberBrowser: false);
  </code></pre>
  
  <p>Log Off:</p>
  
  <pre><code>public ActionResult LogOff()
  { 
     HttpContext.GetOwinContext().Authentication.SignOut    
                               (DefaultAuthenticationTypes.ApplicationCookie);     
     return RedirectToAction("Index","Login");
  }
  </code></pre>
  
  <p><strong>To authorize an action</strong></p>
  
  <pre><code>[Authorize(Roles = "Customer")]
  public ActionResult Index()
  {
     return View();
  }
  </code></pre>
  
  <p>As, it is an important segment in the application, I wish to know the pros and cons of it. I simplified the question as much as possible for easy understanding to readers. Is this the right way for a login system in asp.NET MVC 5? Can I do anything better?</p>