title: ASP.NET MVC and Login Authentication
body: <p>I have searched many posts here regarding custom user authentication but none have addressed all of my concerns</p>
  
  <p>I am new to ASP.NET MVC and have used traditional ASP.NET (WebForms) but don't know how build a login / authentication mechanism for a user using ASP.NET MVC.</p>
  
  <pre><code>protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
  {
      string userName = Login1.UserName;
      string password = Login1.Password;
      bool rememberUserName = Login1.RememberMeSet;
  
      if (validateuser(userName, password))
      {
          //Fetch the role
          Database db = DatabaseFactory.CreateDatabase();
  
  
          //Create Command object
          System.Data.Common.DbCommand cmd = db.GetStoredProcCommand("sp_RolesForUser");
          db.AddInParameter(cmd, "@Uid", System.Data.DbType.String, 15);
          db.SetParameterValue(cmd, "@Uid", Login1.UserName);
          System.Data.IDataReader reader = db.ExecuteReader(cmd);
          System.Collections.ArrayList roleList = new System.Collections.ArrayList();
          if (reader.Read())
          {
              roleList.Add(reader[0]);
              string myRoles = (string)roleList[0];
  
              //Create Form Authentication ticket
              //Parameter(1) = Ticket version
              //Parameter(2) = User ID
              //Parameter(3) = Ticket Current Date and Time
              //Parameter(4) = Ticket Expiry
              //Parameter(5) = Remember me check
              //Parameter(6) = User Associated Roles in this ticket
              //Parameter(7) = Cookie Path (if any)
              FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, userName, DateTime.Now,
              DateTime.Now.AddMinutes(20), rememberUserName, myRoles, FormsAuthentication.FormsCookiePath);
  
              //For security reasons we may hash the cookies
              string hashCookies = FormsAuthentication.Encrypt(ticket);
              HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hashCookies);
  
              // add the cookie to user browser
              Response.Cookies.Add(cookie);
  
              if (HttpContext.Current.User.IsInRole("Administrators"))
              {
                  Response.Redirect("~/Admin/Default.aspx");
              }
              else
              {
                  string returnURL = "~/Default.aspx";
  
                  // get the requested page
                  //string returnUrl = Request.QueryString["ReturnUrl"];
                  //if (returnUrl == null)
                  //   returnUrl = "~/Default.aspx";
                  Response.Redirect(returnURL);
              }
          }
      }
  }
  
    protected bool validateuser(string UserName, string Password)
    {
      Boolean boolReturnValue = false;
  
      //Create Connection using Enterprise Library Database Factory
      Database db = DatabaseFactory.CreateDatabase();
  
      //Create Command object
      DbCommand cmd = db.GetStoredProcCommand("sp_ValidateUser");
  
      db.AddInParameter(cmd, "@userid", DbType.String, 15);
      db.SetParameterValue(cmd, "@userid", Login1.UserName);
  
      db.AddInParameter(cmd, "@password", DbType.String, 15);
      db.SetParameterValue(cmd, "@password", Login1.Password);
  
      db.AddOutParameter(cmd, "@retval", DbType.Int16, 2);
      db.ExecuteNonQuery(cmd);
  
      int theStatus = (System.Int16)db.GetParameterValue(cmd, "@retval");
  
      if (theStatus &gt; 0)  //Authenticated user
          boolReturnValue = true;
      else  //UnAuthorized...
          boolReturnValue = false;
  
      return boolReturnValue;
  }
  </code></pre>
  
  <p>I don't really know how to translate that ASP.NET code into MVC-esque architecture; and I'm still at a loss on how to implement authentication in ASP.NET MVC.</p>
  
  <p>What do I need to do? How do I implement the above code in ASP.NET MVC? What am I missing from that code?</p>