ASP.NET MVC How to Manage User Content Using an ASP.NET Membership Provider

Question

I come from 5 years of experience with ASP.NET Web Forms and I am new to ASP.NET MVC. Now I am trying to learn MVC with some tutorials, video tutorials and books.
I use Visual Studio 2012 and the new ASP.NET MVC 4 to create a small web application to manage my mutual fund portfolio. This should allow me to enter a new pattern and learn a lot ...
My app should also let some other friends do the same. Thus, he must manage the portfolios of different users .
I created a small database with Entity Framework Code First, so I have several basic models: Fund, Portfolio, Share, Deposit, Source and User. One user can have many portfolios with many funds inside them. Each user has their own list of contributions. Each fund has many shares (one / day).
The source model is just a table where I put one URL for each website source for stock data for a particular fund. Thus, one fund has many sources. Then I use the scraper class to retrieve data from these sites once a day.
This is the basic structure of the application. Now I need to know what would be best:

1) User account management .
Should I integrate the ASP.NET membership database structure into my database and use it instead of my user table for user management?

2) User content management : portfolios, funds, etc.
What is the easiest and most elegant way in an MVC template to implement authentication and all authorization checks to get the user to get their own data? Do I need to check this inside every action on every controller?

So, in other words, how do I implement my controllers? For instance:.

[Authorize] public class PortfolioController : Controller { private FundMonitorContext db = new FundMonitorContext(); public ActionResult Index() { // Check user ID and give back to the view only his portfolios... var portfolio = db.Portfolios.List(); return View(portfolio.ToList()); } ... public ActionResult Details(int id = 0) { ... } //Other actions... } 

I would be very grateful for every suggestion!

Answer 1

• This is a choice that you must make yourself, but I like to create my own membership provider, and it's not that difficult. With your own provider, you can do it your own way, and not like what Microsoft thought was cool 10 years ago. Example: http://www.codeproject.com/Articles/165159/Custom-Membership-Providers .
  In .NET 4.5, it is even easier with SimpleMembershipProvider to create your own provider.

• With the [Authorize] attribute, you inform the controller that only an authorized user will be accepted. When a user signs up, you can put the username / username in the FormsAuthentication cookie so that you can easily get the username / username. You can also create Authtication captions in a cookie if you want to add more data to it.
  
  To simplify testing, I do not recommend creating a binding between HttpContext.User and IPrincipal, http://www.hanselman.com/blog/IPrincipalUserModelBinderInASPNETMVCForEasierTesting.aspx .

Answer 2

Use Identity 2.0 for authentication and authorization. I found this blog http://typecastexception.com/post/2014/04/20/ASPNET-MVC-and-Identity-20-Understanding-the-Basics.aspx very useful. Basically, you will receive auth claims and then you can decorate your actions with an AuthorizeAttribute attribute such as

 [Authorize(Roles="Admin, Moderators")] public ActionResult MyAction(...) 

and you can view the claims using the User.Identity property in the controller.