What is the best method for user authorisation/authentication in ASP.NET MVC?
I see there are really two approaches:
I'd prefer the second option, because User is part of my domain model (and I have zero experience with ASP.NET's built-in stuff), but I'd really like to hear what people have been doing in this area.
There is actually a third approach. The asp.net membership functionality is based on the provider model. You can write a custom provider, thus being able to provide your own implementation for how the data is stored, but retaining much of the benefit of asp.net membership.
Some articles on the subject:
http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx
http://www.asp.net/learn/videos/video-189.aspx
Go with custom. MembershipProvider is way too heavy for my tastes. Yes it's possible to implement it in a simplified way, but then you get a really bad smell of NotSupportedException or NotImplementedException.
With a totally custom implementation you can still use IPrincipal, IIdentity and FormsAuth. And really how hard is it do your own login page and such?
Yet another approach is to use ASP.NET membership for authentication, link your User class to ASP.NET members, and use your User class for more granular permissions. We do this, because it allows changing authentication providers very easily, while still retaining the ability to have a complex permission system.
In general, it's worth remembering that authentication/identity and storing permissions are not necessarily the same problem.
You may be interested in RPX for a free API to authenticate your users
http://blog.maartenballiauw.be/post/2009/07/27/Authenticating-users-with-RPXNow-(in-ASPNET-MVC).aspx
Try the ASP.Net MVC Membership Starter Kit for an administrative API
Screenshots
http://www.squaredroot.com/2009/08/07/mvcmembership-release-1-0/
Old locations changesets (historic)
http://mvcmembership.codeplex.com/SourceControl/list/changesets
New Location:
This is a forth approach. Using the web matrix security classes you can use simple membership provider which can use EF so users and roles can be part of your domain model but also part of the IPrincipal and IIdentity MVC helpers.
I have created an example Github project to see how this can be used with automated self registration and email signup / password reset and the like.
