title: Custom login mechanism for a ASP.NET website
body: <p>I'm working on a ASP.NET website and I need to get away with some custom but simple login mechanism. I started from the famous <a href="http://eisk.codeplex.com/" rel="nofollow">Employee Info Starter Kit</a></p>
  
  <p>Here's what I have so far:</p>
  
  <p><strong>On a ASP.NET page:</strong></p>
  
  <pre><code>protected void ButtonLogOn_Click(object sender, EventArgs e)
  {
      if (String.IsNullOrEmpty(txtUserName.Value) || String.IsNullOrEmpty(txtPassword.Value))
          labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
      else
      {
          //if the log-in is successful
          LoginPage LoginBack = new LoginPage();
  
          if (LoginBack.VerifyCredentials(txtUserName.Value, txtPassword.Value) == 0)
          {
              SiteLogin.PerformAuthentication(txtUserName.Value, checkBoxRemember.Checked);
          }
          else
          {
              labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("&lt;strong&gt;Login Failed!&lt;/strong&gt;&lt;hr/&gt;The username and/or password you entered do not belong to any User account on our system.&lt;br/&gt;You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
          }
      }
  }
  
  protected void ButtonAdminLogOn_Click(object sender, EventArgs e)
  {
      if (String.IsNullOrEmpty(txtUserName.Value) || String.IsNullOrEmpty(txtPassword.Value))
          labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("&lt;strong&gt;Login Please!&lt;/strong&gt;&lt;hr/&gt;You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
      else
      {
          //if the log-in is successful
          if (txtUserName.Value == "admin" &amp;&amp; txtPassword.Value == "123123")
          {
              SiteLogin.PerformAdminAuthentication("admin", checkBoxRemember.Checked);
          }
          else
          {
              labelMessage.Text = MessageFormatter.GetFormattedErrorMessage("&lt;strong&gt;Login Failed!&lt;/strong&gt;&lt;hr/&gt;The username and/or password you entered do not belong to any Administrator ccount on our system.&lt;br/&gt;You can login using a username and a password associated with your account. Make sure that it is typed correctly.");
          }
      }
  }
  </code></pre>
  
  <p><strong>And a utility class</strong></p>
  
  <pre><code>public static void PerformAuthentication(string userName, bool remember)
  {
      FormsAuthentication.RedirectFromLoginPage(userName, remember);
  
      if (HttpContext.Current.Request.QueryString["ReturnUrl"] == null)
      {
          RedirectToDefaultPage();
      }
      else
      {
          HttpContext.Current.Response.Redirect(HttpContext.Current.Request.QueryString["ReturnUrl"]);
      }
  }
  
  public static void PerformAdminAuthentication(string userName, bool remember)
  {
      FormsAuthentication.RedirectFromLoginPage(userName, remember);
  
      if (HttpContext.Current.Request.QueryString["ReturnUrl"] == null)
      {
          RedirectToAdminDefaultPage();
      }
      else
      {
          HttpContext.Current.Response.Redirect(HttpContext.Current.Request.QueryString["ReturnUrl"]);
      }
  }
  </code></pre>
  
  <p>My login form has two buttons: The Admin login is hard-coded name/password. The normal login routine goes back to another assembly that calls a web service and get the username and password checked against a domain login.</p>
  
  <p>Now, there is one other file that has code and is baffling me.</p>
  
  <p><strong>Global.asax</strong></p>
  
  <pre><code>&lt;script RunAt="server"&gt;
  protected void Application_AuthenticateRequest(Object sender, EventArgs e)
  {
      if (HttpContext.Current.User != null)
      {
          if (HttpContext.Current.User.Identity.IsAuthenticated)
          {
              if (HttpContext.Current.User.Identity.AuthenticationType != "Forms")
              {
                  throw new InvalidOperationException("Only forms authentication is supported, not " +
                          HttpContext.Current.User.Identity.AuthenticationType);
              }
  
              IIdentity userId = HttpContext.Current.User.Identity;
  
              //if role info is already NOT loaded into cache, put the role info in cache
              if (HttpContext.Current.Cache[userId.Name] == null)
              {
                  string[] roles;
  
                  if (userId.Name == "admin")
                  {
                      roles = new string[1] { "administrators" };
                  }
                  else if (userId.Name == "member1")
                  {
                      roles = new string[1] { "employees" };
                  }
                  else
                  {
                      roles = new string[1] { "public" };
                  }
  
                  //1 hour sliding expiring time. Adding the roles in cache. 
                  //This will be used in Application_AuthenticateRequest event located in Global.ascx.cs 
                  //file to attach user Principal object.
                  HttpContext.Current.Cache.Add(userId.Name, roles, null, DateTime.MaxValue, TimeSpan.FromHours(1), CacheItemPriority.BelowNormal, null);
              }
  
              //now assign the user role in the current security context
              HttpContext.Current.User = new GenericPrincipal(userId, (string[])HttpContext.Current.Cache[userId.Name]);
          }
      }
  
  }
  &lt;/script&gt;
  </code></pre>
  
  <p>The website has a few About pages that allow free access but the rest is either for admin or employee. My admin username/password is fixed but the employee login is entered in domain format and needs to be verified on target domain (all being done) and then set the employee role.</p>
  
  <p>How am I to do that in the Application_AuthenticateRequest method in Global.asax file?</p>