title: Custom form authentication / Authorization scheme in ASP.net MVC
body: <p>I am trying to create a custom authentication scheme in ASP.NET MVC using form authentication. The idea that I might have different areas on the site that will be managed - approver are and general user area, and these will use different login pages, and so forth. So this is what I want to happen.</p>
  
  <ol>
  <li>User access restricted page (right now I have it protected with a customer AuthorizeAttribute)</li>
  <li>User is redirected to a specific login page (not the one from Web.config).</li>
  <li>User credentials are verified (via custom databse scheme) and user logs in.</li>
  </ol>
  
  <p>Would really appreciate any help with this!!!</p>
  
  <p>This is what I what I have so far, and it doesn't work:</p>
  
  <pre><code> public class AdministratorAccountController : Controller
  {
      public ActionResult Login()
      {
          return View("Login");
      }
  
      [HttpPost]
      public ActionResult Login(AdministratorAccountModels.LoginModel model, string returnUrl)
      {
          if (ModelState.IsValid)
              if (model.UserName == "admin" &amp;&amp; model.Password == "pass") // This will be pulled from DB etc
              {
                  var ticket = new FormsAuthenticationTicket(1,               // version 
                                                             model.UserName,  // user name
                                                             DateTime.Now,    // create time
                                                             DateTime.Now.AddSeconds(30), // expire time
                                                             false,           // persistent
                                                             "");             // user data
  
                  var strEncryptedTicket = FormsAuthentication.Encrypt(ticket);
                  var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, strEncryptedTicket);
                  Response.Cookies.Add(cookie);
  
                  if (!String.IsNullOrEmpty(returnUrl))
                  {
                      return Redirect(returnUrl);
                  }
                  else
                  {
                      return RedirectToAction("Index", "Home");
                  }
              }
              else
              {
                  ModelState.AddModelError("", "The user name or password provided is incorrect.");
              }
  
          // If we got this far, something failed, redisplay form
          return View(model);
      }
  
      [AdministratorAuthorize]
      public ActionResult MainMenu()
      {
          return View();
      }
  
      public class AdministratorAuthorizeAttribute : AuthorizeAttribute
      {
          protected override bool AuthorizeCore(HttpContextBase httpContext)
          {
              var authenCookie = httpContext.Request.Cookies.Get(FormsAuthentication.FormsCookieName);
              if (authenCookie == null) return false;
  
              var ticket = FormsAuthentication.Decrypt(authenCookie.Value);
              var id = new FormsIdentity(ticket);
              var astrRoles = ticket.UserData.Split(new[] { ',' });
              var principal = new GenericPrincipal(id, astrRoles);
              httpContext.User = principal;
              return true;
          }
  
          protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
          {
              var model = new AdministratorAccountModels.LoginModel();
              var viewData = new ViewDataDictionary(model);
  
              filterContext.Result = new ViewResult { ViewName = "Login", ViewData = viewData };
  
          }
      }
  }
  </code></pre>