I've been working with ASP.net MVC for several years now. Most applications I've developed in the past have been accessed thru a link from a legacy web application. When users arrive on one of my applications, my application simply reads a cookie from the browser that indicates that the user was authenticated by the legacy application.
Now, I'm finally working on a brand-new web application that needs to be able to perform authentication and authorization. I'm sure I can make something work, but I want to know what today's best practices are.
From ASP.net WebForms, I am familiar with the MembershipProvider and RoleProvider classes. I also have a little bit of familiarity with Windows Identity Foundatioin (WIF).
However, when I look at the default ASP.net MVC 4 application, the "AccountController" class uses something called the WebSecurity class. I'm wondering if this is meant to depreciate the MembershipProvider and RoleProvider classes.
This should be a basic setup with username/password authentication provided by another server and role-based access to privileged resources.
What are the best practices for implementing these in ASP.net MVC 4 today?