title: MVC 5 & ASP.NET Identity - Implementation Confusion
body: <p>I'm creating a new web application that will be written using <strong>MVC 5</strong> and <strong>Entity Framework Database First Approach</strong>. I would also like to use <strong>ASP.Net Identity</strong> to look after membership, authentication, authorisation etc.</p>
  
  <p>I've read a good bit about the ASP.Net Identity on the web and how it works, however, I am still learning about this topic.</p>
  
  <p>When I created my MVC 5 application in Visual Studio 2013 and looked at the <strong>Account Controller</strong> my first instinct was that I didn't like what I saw, i.e., a <strong>DbContext</strong> was being referenced named '<strong>ApplicationDbContext</strong>'. The reason I didn't like this was because I prefer to keep my DbContext in the appropriate project within my solution, i.e., in my Model layer which adheres to the <strong>separation of concerns</strong> logic.</p>
  
  <p>Also, the out of the box MVC 5 project uses Entity Framework Code First to create a default database and tables to store the Users, Roles etc.</p>
  
  <p>Because <strong>I must use an existing database with an existing User table</strong>, this approach does not suit my needs.</p>
  
  <p>I still want to use the latest ASP.Net Identity for my application as it looks to have many benefits, therefore, I found this article which stripped back alot of the Entity Framework code but still got OWIN powered authentication into an ASP.NET MVC.</p>
  
  <p><a href="http://www.khalidabuhakmeh.com/asp-net-mvc-5-authentication-breakdown-part-deux">http://www.khalidabuhakmeh.com/asp-net-mvc-5-authentication-breakdown-part-deux</a></p>
  
  <p>Using the tutorial above, here is the <strong>HttpPost Login</strong> method for my <strong>Account Controller</strong></p>
  
  <pre><code>    [HttpPost]
      [AllowAnonymous]
      public ActionResult Login(LoginViewModel model, string returnUrl)
      {
          if (ModelState.IsValid)
          {
              //Calling my own custom Account Service which validates users login details
              var user = _AccountService.VerifyPassword(model.UserName, model.Password, false);
              if (user)
              {
                  var identity = new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, model.UserName), }, DefaultAuthenticationTypes.ApplicationCookie, ClaimTypes.Name, ClaimTypes.Role);
  
                  //ToDo: Manually adding Role, but will pull from db later
                  identity.AddClaim(new Claim(ClaimTypes.Role, "guest"));
  
                  AuthenticationManager.SignIn(new AuthenticationProperties
                  {
                      IsPersistent = model.RememberMe
                  }, identity);
  
                  return RedirectToAction("Index", "MyDashboard");
              }
              else
              {
                  ModelState.AddModelError("", "Invalid username or password.");
              }
          }
  
          return View(model);
      }
  </code></pre>
  
  <p>In my previous MVC applications I usually rolled my own custom membership and when a User logged into the site and was authenticated, I would have stored the any additional user details such as userID, DOB etc in the <strong>UserData</strong> string of the <strong>FormsAuthenticationTicket</strong>.</p>
  
  <p>As the code above does not use <strong>FormsAuthentication</strong>, instead it uses <strong>OWIN CookieAuthentication</strong>, I am not sure how to store this additional user data.</p>
  
  <p>Therefore, I have a few questions about the problems I am experiencing.</p>
  
  <ol>
  <li><p>How do I store the userID or any other additional piece of user data (DOB etc) the way I used to in FormsAuthentication? Is this done by adding a Claim to the identity?</p></li>
  <li><p>Does the method of using ASP.Net Identity/ OWIN above seem correct considering I am using Entity Framework Database First with an existing database?</p></li>
  <li><p>Should I be using the out of the box code that is used in the Account Controller, i.e., UserManager, ApplicationUser, ApplicationDbContext etc and hooking this up to work with my existing database?</p></li>
  </ol>
  
  <p>I apologise if my question is confusing, I suppose I'm just a little unsure of what approach I should be using whilst attempting to use ASP.Net Identity in my latest project.</p>
  
  <p>Any feedback would be greatly appreciated.</p>
  
  <p>Thanks.</p>