c# - ASP.NET MVC Forms authentication against external web service -

i trying write asp.net mvc application frontend our crm has soap web service. user log in web application using crm username , password, , authenticate against crm, make web service calls on pages etc.

i started @ using forms authentication , implementing custom membership provider - can implement methods need validateuser(), problem have after logging in crm web service given token has passed every subsequent web service call, , not sure can store this.

so questions are:

• is forms authentication way go here, or going more straightforward handle of authentication myself , store token in session.
• if forms authentication way go, , how should store additional information this. seems likes using forms authentication ramming load of additional information (which related authentication) cookie or session outside bit of mess?

any advice appreciated

you can store authentication token in userdata part of forms authentication cookie. way available on each request.

so example once verify credentials of user query web service obtain token , manually create , emit forms authentication cookie:

[httppost] public actionresult logon(string username, string password) {     // todo: verify username/password, obtain token, ...     // , if ok generate authentication cookie this:      var authticket = new formsauthenticationticket(         2,         username,         datetime.now,         datetime.now.addminutes(formsauthentication.timeout.totalminutes),         false,         "some token used access web service , have fetched"     );     var authcookie = new httpcookie(         formsauthentication.formscookiename,          formsauthentication.encrypt(authticket)     )     {         httponly = true     };     response.appendcookie(authcookie);      // ... redirect } 

then write custom authorize attribute read information , set custom generic identity:

[attributeusage(attributetargets.method | attributetargets.class, inherited = true, allowmultiple = true)] public class myauthorizeattribute : authorizeattribute {     protected override bool authorizecore(httpcontextbase httpcontext)     {         var isauthenticated = base.authorizecore(httpcontext);         if (isauthenticated)          {             string cookiename = formsauthentication.formscookiename;             if (!httpcontext.user.identity.isauthenticated ||                 httpcontext.request.cookies == null ||                  httpcontext.request.cookies[cookiename] == null)             {                 return false;             }              var authcookie = httpcontext.request.cookies[cookiename];             var authticket = formsauthentication.decrypt(authcookie.value);              // can read userdata part of authentication             // cookie , fetch token             string webservicetoken = authticket.userdata;              iprincipal userprincipal = ... create custom implementation                                            , store web service token property              // inject custom principal in httpcontext             httpcontext.user = userprincipal;         }         return isauthenticated;     } } 

finally decorate controllers/actions require authentication attribute:

[myauthorize] public actionresult foo() {     // httpcontext.user represent custom principal created     // , contain web service token use      // query remote service     ... }