title: forms authentication in mvc app, authenticating with external service
body: <p>I am currently working on an MVC4 application where different types of users can visit the site and log in. There will be 2 different categorizations of users, type A and B where can access different areas of the site.</p>
  
  <p>Authentication of the user is via service call to an authentication provider and they will return a status of whether the user have been authenticated or not and the users information eg name, address etc. At this point I would like to track that the user is authenticated and what role they are in. Previously I would have created a cookie with the users name, address etc and stored on the clients machine. But this was open to manipulation as the cookies were plain text.</p>
  
  <p>But I would like to strengthen the security of the site and therefore looking at using FormsAuthentication. I am aware that generates a cookie but it is much more secure. </p>
  
  <p>Is this the correct approach and can the users information such as address etc be stored in this cookie? Session where I would like to store it is not available to me. How would I achieve this with FormsAuthentication?</p>
  
  <p>My second question is, once a user is logged in, how do I know the role that they are in?</p>
  
  <p>Finally, once a user is logged in, should the entire site by https? Even areas that are open to everyone but being visited by the logged in user? The logged in user will have information displayed on screen from them on every page eg Welcome John.</p>