title: ASP.NET MVC4 Security, Authentication, and Authorization
body: <p>I'm working on a new asp.net mvc4 project using Visual Studio 2011 beta and am trying to get my head around the whole security thing. It's an internal Intranet application that will initially use single sign on, so the user will not (yet) be prompted for a Windows ID/password. The company has a custom application for storing roles for different applications and will be available via a stored procedure call. It will take a user's logon ID and return some sort of collection containing roles e.g. "MyApp.Data", "MyApp.User, "MyApp.Admin". So what is this referred to as - is this a custom Membership provider, custom Roles provider or something else?</p>
  
  <p>I've been reading up on all the ins and outs of Authorization, Authentication, Membership, Roles, etc. and I can't see the wood for the trees at the moment. I've read that the existing ASP.NET Security objects have been tried and tested, and unless there are very complex requirements the in-built ones will suffice, so I'm happy to use what's already there. </p>
  
  <p>So if a user is already signed in to the network this means they are authenticated - correct? If so then I just need to implement Authorization. Is it necessary to decorate each Controller or Action with the Authorize attribute? If so how does the "ABC" part of [Authorize(Roles = "ABC")] get set if I retrieve roles from my custom role storage app?</p>
  
  <p>I read several articles and blog posts including this one from Jon Galloway but I got lost towards the end:</p>
  
  <p><a href="http://weblogs.asp.net/jgalloway/archive/2012/05/04/asp-net-mvc-authentication-customizing-authentication-and-authorization-the-right-way.aspx" rel="noreferrer">Customizing Authentication and Authorization The Right Way</a></p>
  
  <p>So many questions...if anyone knows of  good high level description of how all this hangs together then I'm all ears :)</p>