ASP.NET MVC, forms auth or custom when using EF 4?

Question

Hello,

I'm new to the ASP.NET world. Since I want to use the ORM it seems I would want an Entity to represent the User or Member or whatever, not some data tucked away by the forms authentication api. In fact I don't see how I can live without one.

How do people deal with this? Roll your own authentication? Or is there a best practice for incorporating forms authentication with the Entity Framework?

In short, since I need a User and Role Entity for queries anyway, should I skip the forms auth or find a way to use it?

Thanks

Answer 1

EF and Forms Auth are really two different areas. You can use Forms Auth without ASP.NET Membership very easily and roll your own provider with very little effort.

This tutorial will show you how:

http://msdn.microsoft.com/en-us/library/ms172766(VS.80).aspx

With ASP.NET MVC you should really use standard Auth since you can manage access to controllers using attributes for Roles very easily.

Answer 2

FormsAuthentication on its own does not care about the identity store and can validate only credentials stored in the web.config <credentials> section, through the Authenticate method. Standard implementations of the login page use the static Membership class to manage the identities and credentials in the MembershipProvider specified in the config file (usually SqlProfileProvider).

However, you don't have to use the membership provider functionality of ASP.NET to maintain your identities and you can still use FormsAuthentication just fine. The forms authentication control flow shows that forms authentication deals primarily with creating and maintaining the auth ticket for the user in a cookie. It does not deal with the user identity or profile itself, as it does not care about those.

Thus, you can safely use EF to maintain your user profiles, including credentials and do authentication of the provided credentials in your login page, while still using FormsAuthnetication.