title: saving session data once authenticated .net
body: <p>So I'm building a web application in .NET using c#, MVC and sqlexpress. I want users to be able to login and depending on what group they belong to, see some part of an UI.</p>
  
  <p>I have created the tables for groups and users in my database, created models from those tables using ADO.NET wizard for model creation.</p>
  
  <p>I have added a controller that has methods for checking if a user exists, and if his password is correct. My question is how to store the information that the user is authenticated the "©correct" way?</p>
  
  <p>At the moment, i just create a new object in the session variable that is made available by <code>System.Web.Mvc.Controller</code>. I have made a flag object <code>Session["Authenticated"] = true</code> and created another object that holds the information (username, group affiliation etc...) as <code>Session["User"]</code>.</p>
  
  <p>I have stumbled upon articles that describe implementing your own membership provider (<a href="http://msdn.microsoft.com/en-us/library/ms366730%28v=vs.100%29.aspx" rel="nofollow">here</a> and <a href="http://msdn.microsoft.com/en-us/library/f1kyba5e%28v=vs.100%29.aspx" rel="nofollow">here</a>) but I feel that I would need to break my existing classes for password security and account control in order to implement them inside of the custom membership provider.</p>
  
  <p>Is the custom membership provider implementation necessary or is the data saved in the session good enough?</p>