ASP.NET MVC 4 Forms Authentication Customized

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult Login(LoginModel model, string returnUrl)
{
if (ModelState.IsValid && WebSecurity.Login(model.UserName, 
          model.Password, persistCookie: model.RememberMe))
{
return RedirectToLocal(returnUrl);
}

// If we got this far, something failed, redisplay form
ModelState.AddModelError("", "The user name or password provided is incorrect.");
return View(model);
}

The fairly simple code. Magic happens with WebSecurity.Login() method. this method first checks if supplied user exists in dbo.userprofile table. If exists, then this method checks if supplied password matches in the dbo.webpages_ Membership table. If password also matches then this method reads the roles associated with this user and set in the request context and returns true to indicate successful login. It internally also sets the Request.IsAuthenticated flag to true. That's all about forms authentication side in MVC 4 project.

Resolution of authentication customization problem

Now since you understand the logic behind forms authentication lets talk about resolution of single sign on problem with forms authentication in which user will also be validated in project database.

Step -1

Change the <Forms> tag in Web.Confile file with following tag. 

<forms loginUrl="errors/InvalidUser" timeout="2880" /> 

Step -2

Add errors Controller with following Action methods. 

public class ErrorsController : Controller
{
    //
    // GET: /Errors/

    public ActionResult InvalidUser()
    {
        return PartialView("_InvalidUser");
    }
    public ActionResult UnAuthorizedUser()
    {
        return PartialView("_UNAuthorizedUser");
    }

}

Step -3

Add a shared view "_InvalidUser.cshtml" with following Razor. 

@{
    ViewBag.Title = "Invalid User";
 }

<hgroup class="title">
    <h1 class="error">Invalid User.</h1>
    <h2 class="error">Please contact your Administrator.</h2>
</hgroup;>

Add another shared view "_UNAuthorizedUser.cshtml" with following Razor.

@{
    ViewBag.Title = "Invalid User";
    Layout = "~/Views/Shared/_Layout.cshtml";
}
<hgroup class="title">
    <h1 class="error">You are not authorized to view this page.</h1>
    <h2 class="error">Please contact your Administrator.</h2>
</hgroup>

Step -4

change the existing _LoginPartial.cshtml partial view with following Razor. 

@if (Request.IsAuthenticated)
{
    <text>
        Hello, @User.Identity.Name 
        
    </text>
}

Step -5
Lets create our own User table in the Application Database.

CREATE TABLE [dbo].[AppUser](  [USerID] [int] IDENTITY(1,1) NOT NULL,

[LoginName1] [nvarchar]
 (50) NULL, )

Step -6

Create user data in user table manually.

Insert Into dbo.AppUser values(1,'<your windows user name>');

Step 7

Create data in Membership table.

insert into dbo.webpages_Membership(UserId,PasswordFailuresSinceLastSuccess,Password)
values
(1,0,'AJfhqOHKFeLY8aHVGCAwf0dnN6QkGPv09Hj5sQaG2FQsdIk9p7zniTJmb6tMQK/HIQ==')

 Please note : the Encrypted value shown in the above query for password is "1", since WebSecurity.Login can not receive a blank password so I am hard-coding this password with "1" and I am planning to create every user with the same encrypted password. Since we are going with single signon password doesn't make much sense here.

Step -8

Create role as per your need in role table.

Step -9

Go to the InitializeSimpleMembershipAttribute.cs file and change the following code  in which "User" is newly created table.

WebSecurity.InitializeDatabaseConnection("DefaultConnection", 
   "User", "UserId", "UserName", autoCreateTables: true); 

Step 10

Add the following Attribute to the Home Controller.

[Authorize]
[InitializeSimpleMembership] 

Step -11

Change the Index Action of Home Controller with following code. 

[AllowAnonymous]
public ActionResult Index()
{
    string username;
    var logonUser = Request.ServerVariables["LOGON_USER"];
    username = logonUser.Split('\\')[1].ToString();
    if (!Request.IsAuthenticated)
    {
        username = "sanjiv";
        if (WebSecurity.Login(username, "2", persistCookie: false))
        {
            return RedirectToAction("Index", "Home");
        }
        else
        {
            return RedirectToAction("InvalidUser", "Errors");
        }
    }
    ViewBag.Message = "Modify this template to jump-start your ASP.NET MVC application.";
    return View();
}

 Step - 12

Remove account controller (AccountController.cs) completely from the project.

Step -13

Now you run the application and you will be able to see the following screen with logged in user information. 

Summary

I will recap the activities performed in this article.

1. We had removed the Account Controller completely from the project and managed the authentication from "Index" action of "Home" controller. That's the reason we had to provide [AllowAnonymous] attribute to "Index" action. In this authentication process we are reading the logged in user name from Server variables and not providing the user to input username hence it behaves like single sing on application.
2. Secondly we have changed the "InitializedSimpleMembership" provider to connect to our Local DB. We also managed the user data in our own AppUSer table in project database.
3. Third and importantly we had changed the _LoginPartial partial view and also created our own error view to display "Invalid user ." error message.