Q:

Custom Authentication .Net MVC

I have a web app that allows a user to pay for a holiday booking.
The user will log in using a combination of a unique booking ID and a booking password.
Is there a simple way I can authenticate the user once they have successfully logged in. Is it a good idea to use the .net session object for this purpose?
The app wont be load balanced so I don't need to worry about storing session across different machines.
I would like to not have to use .Net membership as I don't want to create any extra tables in the database.

A:

If you are able to retrieve the user, I guess this is possible. Below is the way I would try:
public ActionResult UrlAuth(string bookingId, string bookingPass)
{
    var userManager=HttpContext.GetOwinContext().GetUserManager<ApplicationUserManager>();

    // Retrieve the user by the give booking values (Custom part in your app
    string userId= _bookingRepository.GetUserIdByBooking(bookingId, bookinggPass);

    var user = userManager.FindById(userId);
    if (user != null)
    {
        var userIdentity = userManager.CreateIdentity(user, DefaultAuthenticationTypes.ApplicationCookie);

        HttpContext.GetOwinContext().Authentication.SignIn(new AuthenticationProperties { IsPersistent = false }, userIdentity );

        // authentication succeed do what you want 
        return Redirect("Wherever");
    }

    ModelState.AddModelError("", "Invalid booking values");

    return View();
}

