What's the best way to develop a custom logon/authentication system in ASP.NET

Question

The website I'm developing will allow users to login at 3 levels.

Level 1 - Not logged in

Level 2 - They register their email address and receive a confirmation email, and login that way.

Level 2 - They login with a username/password, which is then sent to a web service. If the web service comes back with a "successful login" result, they're logged into the website.

Depending on the login level, some web pages will be available while others will be restricted.

My question is, how should I develop this?

I'm doing the project in ASP.NET MVC.

Should I just code my own AccountController? Should I use .NET Forms Authentication? What's the benefit of Forms Authentication over just doing it manually with .NET code?

If I did this myself, on successful login, I'd just store the logged-in user in a session variable. Is there any harm in doing this, or for what I'm doing, is it OK?

Answer 1

check this previous question in SO:

How should I implement user membership in my ASP.NET MVC site?

Check out this blog on ASP.Net MVC Membership Basics.