What is the cleanest way to leverage Forms Authentication from ServiceStack?

Question

I'm trying to integrate ServiceStack with an existing Web Forms site. The site uses Forms Authentication along with some custom authentication logic involving database calls, etc.

How can I secure ServiceStack calls using the same mechanism? Reading the docs, it seems I should write a custom auth provider that inherits from CredentialsAuthProvider to do the database check, etc. and add a request filter to apply the AuthenticateAttribute to each request. Do I also need to set the forms auth ticket, once authenticated, and check the ticket on each request? Where would I do those things?

Am I missing anything? Is there a better approach?

Answer 1

See the CustomAuthenticationMvc UseCase project for an example of integrating MVC Forms Authentication with ServiceStack's Auth Providers.

Specifically the AccountController.Login() method shows how to call ServiceStack from MVC:

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult Login(LoginModel model, string returnUrl)
{
    if (ModelState.IsValid)
    {
        var authService = AppHostBase.Instance.TryResolve<AuthService>();
        authService.RequestContext = CreateRequestContext();
        var response = authService.Authenticate(new Auth
        {
            UserName = model.UserName,
            Password = model.Password,
            RememberMe = model.RememberMe
        });

        // add ASP.NET auth cookie
        FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);

        return RedirectToLocal(returnUrl);
    }

    // If we got this far, something failed, redisplay form
    ModelState.AddModelError("", 
        "The user name or password provided is incorrect.");
    return View(model);
}