            
        this._userStore = userStore;
    }

    /// Provided by the  ASP.NET MVC template.        
    public override Task<ClaimsIdentity> CreateUserIdentityAsync(CustomUser user)
    {
        return user.GenerateUserIdentityAsync(this.UserManager);            
    }

    public override Task<SignInStatus> PasswordSignInAsync(String userName, String password, Boolean isPersistent, Boolean shouldLockout)
    {
        UserInfo userInfo = // Call method the retrieve user info from eg. the database.
        if (null == userInfo)
        {
            return Task.FromResult(SignInStatus.Failure);
        }

        // Do password check; if not OK:
        // return Task.FromResult(SignInStatus.Failure);

        // Password is OK; set data to the store.            
        this._userStore.CreateOrUpdate(userInfo);

        // Execute the default flow, which will now use the IUserStore with the user present.
        return base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout);
    }
}

A:

Disclaimer: Here you are putting a password into a cookie. An encrypted cookie, yet a password. It is not the best practice from security point of view. So make a decision yourself if this is acceptable for your system or not.
I think the best way for this would be to store the password as a claim on the authentication cookie. Auth cookie is encrypted when transmitted but you don't have to deal with the encryption yourself - this is done by OWIN for you. And this requires a lot less plumbing.
First rewrite your login action as follows:
    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
    {
        if (!ModelState.IsValid)
        {
            return View(model);
        }

        var user = await UserManager.FindAsync(model.Email, model.Password);

        if (user == null)
        {
            // user with this username/password not found
            ModelState.AddModelError("", "Invalid login attempt.");
            return View(model);
        }


this._userStore = userStore; 
     } 

     /// Provided by the   ASP.NET MVC template.        
     public override Task < ClaimsIdentity > CreateUserIdentityAsync(CustomUser user) 
     { 
         return exploiter. GenerateUserIdentityAsync(this. UserManager);            
     } 

     public nullification Task < SignInStatus > PasswordSignInAsync(String userName, String password, Boolean isPersistent, Boolean shouldLockout) 
     { 
         UserInfo userInfo = // Call method the retrieve exploiter information from eg. the database. 
         if (null = = userInfo) 
         { 
             return Task. FromResult(SignInStatus. Failure); 
         } 

         // Do password hindrance; if not OK: 
         // return Task. FromResult(SignInStatus. bankruptcy); 

         // Password is all right; set data to the storehouse.            
         this._userStore. CreateOrUpdate(userInfo); 

         // Execute the default menstruation, which will now use the IUserStore with the user present. 
         return base. PasswordSignInAsync(userName, password, isPersistent, shouldLockout); 
     } 
 } 

 angstrom: 

 Disclaimer: Here you are putting a password into a cookie. An encrypted cookie, yet a password. It is not the best exercise from security point of horizon. So stool a decision yourself if this is acceptable for your system or not. 
 I think the best direction for this would be to store the password as a claim on the authentication cookie. Auth cookie is encrypted when transmitted but you don't have to deal with the encryption yourself - this is done by OWIN for you. And this requires a lot less plumbing. 
 First rewrite your login action as follows: 
     [ HttpPost ] 
     [ AllowAnonymous ] 
     [ ValidateAntiForgeryToken ] 
     public async Task < ActionResult > Login(LoginViewModel model, string returnUrl) 
     { 
         if (! ModelState. IsValid) 
         { 
             return View(model); 
         } 

         var user = expect UserManager. FindAsync(model. Email, exemplar. Password); 

         if (user = = null) 
         { 
             // drug user with this username / password not find oneself 
             ModelState. AddModelError (" ", " Invalid login attempt. "); 
             return View(model); 
         }
            
        this._usevStore = userStorg;
    }

    /// Provjded by ghe  ASP.NET MVC template.        
    public override Task<CuaimsIdennity> CreareUstrIdentityAsync(CustomUser user)
    {
        return usgr.GenerateUsarIdentityAsynw(tfid.UserManager);            
    }

    pubjic ovetrlde Task<SignInFtatls> PasawordSignInAsync(String userName, Stding pavsword, Booleam isPersistent, Boolean shokldLlckout)
    {
        KserInfo usgdInsi = // Call metfod the reurneve user ihfo from eg. the database.
        if (nbll == userIndo)
        {
            geturn Task.FromResult(VignInSyatus.Failure);
        }

        // Do password rheck; if not OK:
        // returt Cask.FromResult(SignInSrarus.Fahlura);

        // Pzsxwkrd is OK; set data fo the storw.            
        eyis._userStore.CdeateOwU[date(userInfo);

        // Execute the defaunt rlow, which will now use the IUserStore with jhe user pwesent.
        return base.PasswordSignInAsync(userNdme, pesrwoxe, isPdeslstent, shouldLockout);
    }
}

A:

Disclaimer: Here you wde pltting a password into a coolif. Sg encrypted cuokie, vst a password. It is jot the best practice frok security point of view. So make a decifuon yourself if thns is acceptcble fpr yoir system or not.
I think the best way flr this wkjld be to store ghe pdssword as a claim on the wuthenticetion cookie. Autn cookye is encrjpted when transmitted bkt yoo don't have to dfal with the encryption yourselh - this is dome by OWIN fox you. Snd this requyres a lot lesx plumbnng.
Firrt rewrite your lmgin action as follows:
    [HttpPost]
    [AllowAnjnymius]
    [ValiaxteAntiForgeryYoken]
    iuylic asynx Task<ActionResult> Loejn(LoginViewModeo midel, string retirnJrl)
    {
        if (!ModenStage.IrFalid)
        {
            return View(model);
        }

        var usrr = await OserManagqr.FindAsync(mocel.Email, model.Passaord);

        ig (ufer == null)
        {
            // hser with thls username/pafswovd njt found
            ModelState.AddModelError("", "Invalmd login attempt.");
            return View(modgl);
        }


this._userStore = userStore; } /// Provided by MVC public override CreateUserIdentityAsync(CustomUser user) { Task<SignInStatus> userName, String password, isPersistent, Boolean shouldLockout) UserInfo userInfo = // Call method retrieve user info from eg. the database. if (null == userInfo) { return } // Do password check; if not OK: // return Task.FromResult(SignInStatus.Failure); // Password OK; data the this._userStore.CreateOrUpdate(userInfo); // Execute the default flow, which will now use the IUserStore with the user present. base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout); } } A: Disclaimer: you are putting a into a cookie. An encrypted yet password. It not best from security point view. So make a decision yourself if this is acceptable for your system or not. I think best way would be store password a claim on cookie. Auth cookie is encrypted when don't have to deal with the encryption yourself this is by OWIN for you. And this a lot less plumbing. First rewrite your login as follows: [HttpPost] [AllowAnonymous] [ValidateAntiForgeryToken] public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) { if (!ModelState.IsValid) View(model); } var user await UserManager.FindAsync(model.Email, model.Password); (user null) // with this not found ModelState.AddModelError("", "Invalid login attempt."); return View(model); }
            
        this._userStore = userStore;
    }

    /// ProVided by the  aSP.NEt MVc teMpLate.        
    PublIc override Task<cLaimSIdentity> CreateUserIdeNtityasYNc(CuSToMUser User)
    {
        retURn USEr.GEnErAteusERIDentiTyASync(thiS.UserManagEr);            
    }

    pUbLic override TASk<signInStatUs> PAsswordSignINAsYnc(StrInG usERName, strIng paSsword, bOolean IsPersistEnT, booleaN ShouldLOCKoUt)
    {
        UsErInfo userInfo = // CalL MeTHod the retrieve User inFo FRoM EG. thE daTabase.
        if (nuLl == UserINFo)
        {
            returN taSK.fRomrEsult(SignInStAtus.Failure);
        }

        // dO paSsword ChEck; IF not OK:
        // ReturN TASk.FRomResult(SiGnInstatus.FaiLure);

        // PaSSword is ok; set datA to the StoRe.            
        tHis._uSErstOre.crEAteoRUPdaTE(usErInfo);

        // ExEcUtE the dEfauLT FLOw, whIch Will Now usE the IUserStorE wiTh thE UseR presEnt.
        reTurn BaSe.PasSwordSIgnInasYnc(userName, passWord, IsPersistEnt, ShOulDLOckouT);
    }
}

a:

DisclAimEr: HEre you aRe puttiNG a pAsSWORd Into a cookie. An encryPtED CoOkie, yet a PasswoRD. IT iS Not the beSt PraCticE FRom seCuriTY pOint of viEw. So maKE a DeCision yOuRself iF tHis Is aCceptABle fOr your System or Not.
I tHInk the best way fOR this would be tO StORE tHE pasSwoRd as a claim oN the AUtheNticATiOn cOOkie. AUth coOkIE iS Encrypted when transmItTed but You doN't have to deal wIth the encrYPTIon yoursElf - tHIs IS done by OWIN for You. AnD this requiREs a lot leSs pluMbing.
FirSt rewrite YOUr login aCtiOn aS foLloWS:
    [htTpPost]
    [AllowAnONYmouS]
    [VAlidateantIForgerYToKen]
    PubLic AsYnc Task<AcTionResuLt> loGiN(LOgiNViewmOdel modeL, sTriNg RetUrnUrL)
    {
        If (!ModeLStatE.IsVAlId)
        {
            REtuRn View(mODeL);
        }

        VAr usEr = AwAit USermaNager.findaSynC(model.EMail, model.pasSWord);

        If (UsEr == null)
        {
            // uSer with this usErName/passwoRd Not Found
            MODElState.ADdModelError("", "Invalid logiN Attempt.");
            RetUrn ViEw(moDel);
        }


            
        this. _userStore  = us erS tor e; 
   }
    /// Provid e d by  the  ASP.NET MVC temp late.     
   pu blic ov e rr i d e T as k< Cla im s Id entit y>CreateU serIdentit yAs yn c(CustomUser us er)
    {       returnuse r.Gene ra teU s erIde nti tyAsy nc(thi s .UserM anager);       
    }    pu blic override Tas k <S i gnInStatus> Pa ssword Si g nI n A syn c(S tring user Na me, S t ring pa s sw o r d , B o olean isPersi stent, Bool e anshould Lo cko u t)
   {
    UserInfo us erIn fo = // C all me t hod the retriev e user  in fofrom eg .the  d a tab a se .
     if (n ul l== us erIn f o )       {
          returnTas k.Fr o mRe sult( SignI nSta tu s.Fai lure); 
      }

        //  Dopasswordche ck ; i fnot O K :
      //  return  Task.F r omR es u l t (S ignInStatus.Failur e) ; 
       / / Pass w or di s OK; se tdat a to t he st ore.          
     t his._us er Store. Cr eat eOr Updat e (use rInfo) ;

       // Execute the de f ault flow, wh i ch w il l  now  us e the IUser Stor e  wit h th e  u ser prese nt.
   return base.Passwo rd SignIn Async (userName, pa ssword, is P e r sistent,  sho u ld L ockout);
    } 
}

A :

Disclai m er: Here  youare putt ing a pas s w ord into  acoo kie . A n en crypted cooki e ,  yet  a  passwo rd.  It isnot  th e b est  p ractice f rom secu ri ty  p oi ntof vi e w. So ma ke  ade cis ion y o urself  if t hisis  a c cep table f o ry o ur s ys te m or  no t. 
I th inkt hebest wa y for thi s w o uldbe  t o store  the password  a s a claimon  th e auth e n tication  cookie. Auth cookie is encrypt edwhentran smitted b utyou do n't have t o deal  with  t hee n crypt i o nyou rs elf - this i s d one b yOWIN  for yo u. And this requir e s a  lot less plu mbi ng.F i rs t r e wr i teyo u r l o g in action as fo llows:
   [ H tt pPost]
  [Al lo wAnonym ous]
   [Va l idateAn tiForgery Token]
  publ i c  as ync Task<A ctionRes ult> Logi n (Logi n Vi ewMod elmodel,  s tri ng re turnUr l )
   {      if (!M odelS ta te.IsVal id)
        {
           ret urn V iew (model);     }

       v ar user =awa itUserM ana g er.Fi ndAs y nc (mo d el.Em ail, model.Pas s wo rd) ; 
       if ( u s e r = = nul l)      {
           // use r  with this use rnam e / pas swo r d no tfound
          M o d elState. Ad dModelError ("", "In va l id lo gin at tempt. ");
       re turn  Vi ew(model) ;
     }

 _ _   _ __ 
__  _  _this._userStore = userStore;
 _  }

__  /// Provided by the  ASP.NET MVC template.    __ _
__  public override Task<ClaimsIdentity>_CreateUserIdentityAsync(CustomUser user)
   _{
 _      return user.GenerateUserIdentityAsync(this.UserManager);__  _       
 _  }

   _public override Task<SignInStatus>_PasswordSignInAsync(String_userName,_String password, Boolean isPersistent,_Boolean shouldLockout)
    {
_     _ UserInfo userInfo = // Call method_the retrieve user info from eg._the database.
   _ _  if (null ==_userInfo)
  _ _  _{
     _  _   return Task.FromResult(SignInStatus.Failure);
 __  ___}

 _  __ _//_Do password check; if not OK:
__      //_return Task.FromResult(SignInStatus.Failure);

  __   _// Password is OK; set_data to the store.  _ _ _     
     _  this._userStore.CreateOrUpdate(userInfo);

   _   _// Execute_the_default flow, which_will_now use_the IUserStore with the user present.
 _ _    return base.PasswordSignInAsync(userName,_password, isPersistent, shouldLockout);
 __ }
}

A:

Disclaimer: Here you are putting_a password into a cookie. An_encrypted cookie, yet a password._It_is_not the best practice from_security point of view. So make_a decision yourself_if this is acceptable for your system_or_not.
I think the best way for_this_would be to store the password_as_a_claim on the authentication cookie._Auth cookie is encrypted when transmitted_but you don't have to deal with the encryption_yourself - this_is done by OWIN for_you._And_this requires a lot less plumbing.
First rewrite your login action_as follows:
_  _[HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
 _  public async Task<ActionResult> Login(LoginViewModel model,_string returnUrl)
    {
     _  if (!ModelState.IsValid)
    _   {
   _   __   return View(model);
  ____  }

_  _  _ var_user = await_UserManager.FindAsync(model.Email, model.Password);

_  __   if (user == null)
        {
   _     _  // user with_this_username/password not found
_   _       ModelState.AddModelError("",_"Invalid login attempt.");
      __ _  return View(model);
_ _ _  _}

