ASP.Net MVC Custom Authentication

Question

I'm looking to create a custom authentication model for my MVC app but I'm not sure where to implement my custom IPrincipal and IIdentity classes. I don't want to do this in the Global.asax on every request as not all the pages in the site will need authentication. So my question is where? Should I be doing this in my custom action filters for the actions that require the user to be logged in?

I don't wish to use the Membership Provider or Forms Authentication this needs to be completely custom and separated.

Answer 1

Please have a look at this question:

Is it possible to create a Logon System with ASP.NET MVC but not use the MembershipProvider?

Answer 2

Have you considered creating a seperate base class for your controllers?

You can override the OnActionExecuting event to check to see if the user is authenticated... something like:

Public Class AuthenticatedPageController
    Inherits Controller

    Protected Overrides Sub OnActionExecuting(ByVal filterContext As ActionExecutingContext)
 // Code to check user is authenticated - if not chuck them to the log in page...

    End Sub


End Class

Then, any controllers for pages where the user needs to be authenticated, inherit from this class instead of the standard controller class.