Using .NET membership provider throughout n-tier web app

I'm currently building an n-tier web application, mainly to practice new technologies and patterns - repositories, uow, services, ioc, ef4 and mvc3.

After lots of hair-pulling I now have ef4 saving my entities through my service layer using repositories.

I'm now starting to define methods I'll need in the service layer and am thinking now's a good time to start implementing authentication. Normally I would roll my own authentication code however I've been told by a friend to try the Membership Provider.

Now obviously I'm going to use this within the mvc3 web app but I'm wondering if I can use this within my service layer as well? Can开发者_StackOverflow中文版 anyone point me to any articles or blog posts?

NB. Apologies if I'm stating the obvious however I just wanted to be clear that when I'm referring to my service layer, I don't mean WCF; these are my own classes which respect the service layer pattern - http://martinfowler.com/eaaCatalog/serviceLayer.html. Having said that, I may wish to expose this service layer through WCF services at a later date.

I've been googling for a couple of hours now and haven't come up with anything!

Any help is really appreciated.

This is a 18 part series articles from Scott Mitchell.

It's a very deep explanation of all the features that regards Authentication, Authorization and Membership providers in asp.net. I did never found a better source on this from the same author.

You can hide the implementation throgh the usage of the repository pattern as you already do today with EF4 without any particular change

Hope this helps!

One way to go about it is to create a "SecurityContext" class that holds username, remote ip address, etc. Then create an Agent class that acts as a proxy class to your WCF services. In the Agent class you can create the security context with a static class. You can then pass this SecurityContext along to the other tiers on all service methods that need security. This way it is flexible enough to do the authentication on the front end and auditing, etc on the domain/business logic layer.