asp.net MVC FormsAuthentication for claim based authentication -

we using gigya authenticate user provide user id , email. pass user detail our crm web service return user data crm.

we need create session user can identify whether user logged in or not. if not logged in redirect gigya login/register etc.

now, given not using asp.net membership or similar, i'm thinking how going secure member pages. 1 way can think of store user detail in session. check if user detail exists in session, if doesn't exist prompt login.

i'm thinking whether:

1. i can use formsauthentication.setauthcookie or similar create asp.net session

2. or there better way achieve this.

also, if use formsauthentication.logout clear session , cookies though i'm not using asp.net membership provider?

goal:

1. to able create session user
2. able authorize user based on user role crm.
3. able logout user on lout button click.

first, , very important security perspective.

authentication != session.

they different concepts. second,

never use session authentication

see first rule. formsauthentication has nothing. zero. zilch. nada. session management. nor have membership or credential verification. store cookie asp.net can decode verify user authenticated or nor. cookie set application when has validated users credentials.

formsauthentication.logout() not clear sessions, because said, have nothing each other. have clear session calling session.abandon().

session storing data user, , not secure. session volatile, , iis can discard whenever feels like, reason, @ time. cannot depend on session there request next.

authentication encrypted, , strictly proving user has been authenticated.

authentication can transcend sessions. can hours, weeks, months... session time there (if iis doesn't kill earlier).