title: MVC forms authentication without a database
body: <p>I have a MVC4 site that I have inherited. In the site it makes a call to an external system with the user's name &amp; password and if all is ok it returns some data.</p>
  
  <p>It is is very simple, but it requires a login page to prevent unauthorised access. The previous developer was new to MVC so they've put the [Authorize] attribute on the controller (good) but then realised that no MVC-authentication is happening so added [AllowAnonymous] to every action (bad).
  Because it is a simple site and has external authentication on each call to getting data, I do not want to add a database to the site and be creating users etc. but I want to use the Authorize attribute.</p>
  
  <p>I think I can use forms authentication by storing a username &amp; password in the website's config file (<a href="https://msdn.microsoft.com/en-us/library/da0adyye.aspx" rel="nofollow">see here</a>)
  e.g. username=Bob, pwd=abc123, and when the user logs in I call the external system and if I get data back I know the credentials are good. I can then log them in as Bob. When they click LogOut, I can log Bob out of the system.</p>
  
  <p>If I do this though, will only one user be able to use the site at once? Because everybody will be logged in as Bob?</p>