It's because you are posting the from to the Index action whereas you should be posting it to the LogOn action, where your authentication logic is in.
Try changing Html.BeginForm() to Html.BeginForm("LogOn", "HomeController") in your view.
In the code you posted you were presenting the form from the HomeController's Index action. And posting it back to the same controller's same action. But that action was not handling the authentication logic. That's why nothing was happening and you weren't logging in.
In the default ASP.NET MVC 2 site, however, they are presenting the form from the AccountController's LogOn action :
public ActionResult LogOn() {
return View(); //returns the LogOn.aspx view
}
So when they use Html.BeginForm() in the view, it creates a form that will POST to the same controller's same action. So they create another action with the name LogOn :
[HttpPost]
public ActionResult LogOn(LogOnModel model, string returnUrl) {
//...
}
But this time they decorate that action with the HttpPost attribute. That means if a request hits the AccountController's LogOn action with the POST verb, that method above will be executed. But if the same action is requested with the GET verb (ie without a POST body) the other method will be executed.
So basically, you could have done this in your HomeController :
public ActionResult Index() {
ViewData["Message"] = "Welcome to ASP.NET MVC!";
return View(); //returns the view which has the form
}
[HttpPost]
public ActionResult Index(LogOnModel model, string returnUrl) {
//handles the post
}
But your action (the one that was supposed to handle the authentication logic) was named differently. And that's why we needed to explicitly set the controller and the action name in the Html.BeginForm("LogOn", "HomeController").