Need help understanding ASP .Net MVC user authentication/authorization

Question

I have been going around in circles trying to properly understand this.

I have an ASP .Net MVC project I am working on and need to implement user logins that authorize and authenticate against en external system (via webservice).

I can't seem to get my head around MembershipProvider and AuthorizeAttribute in the context that I require.

Which do I need to use (I believe its both) and where do I need to customize to provide the authentication against an external system.

There is one additional thing I also require on top of the default ASP .Net user principals in that the external webservice will return a session ID upon successful login that would be used for subsequent requests to external services.

Would someone be able to point me in the direction of some useful example of this sort of set up?

Answer 1

MembershipProvider is used to provide the users that may login the system. The RoleProvider is used to tell which roles a user has. They are used during the authentication process. i.e. identifying the user. You can read about membership vs roles

The [Authorize] attribute on the other hand is used during authorization. i.e. to check if the user is allowed to do something.