Authentication, Identity, and OWIN

// App_Start/Startup.Auth.cs (a partial class; the other half is App_Start/Startup.cs)
[assembly: OwinStartup(typeof(MyApp.Startup))]
namespace MyApp
{
    public partial class Startup
    {
        public void ConfigureAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ApplicationDbContext.Create);
            app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
            app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);

            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                Provider = new CookieAuthenticationProvider
                {
                    OnValidateIdentity = SecurityStampValidator
                        .OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                            TimeSpan.FromMinutes(30),
                            (manager, user) => user.GenerateUserIdentityAsync(manager))
                }
            });

            app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions
            {
                ClientId = "...", ClientSecret = "..."
            });
        }
    }
}

public class ApplicationUser : IdentityUser
{
    public string DisplayName { get; set; }
}

public class ApplicationDbContext : IdentityDbContext<ApplicationUser>
{
    public ApplicationDbContext() : base("DefaultConnection") { }
    public static ApplicationDbContext Create() => new ApplicationDbContext();
}

var result = await UserManager.CreateAsync(
    new ApplicationUser { UserName = model.Email, Email = model.Email }, model.Password);

if (result.Succeeded)
{
    var user = await UserManager.FindByNameAsync(model.Email);
    var confirmToken = await UserManager.GenerateEmailConfirmationTokenAsync(user.Id);
    // email the confirmation link containing confirmToken
    await SignInManager.SignInAsync(user, isPersistent: false, rememberBrowser: false);
}

// App_Start/IdentityConfig.cs
public class ApplicationUserManager : UserManager<ApplicationUser>
{
    public static ApplicationUserManager Create(
        IdentityFactoryOptions<ApplicationUserManager> options, IOwinContext context)
    {
        var manager = new ApplicationUserManager(new UserStore<ApplicationUser>(context.Get<ApplicationDbContext>()));
        manager.PasswordValidator = new PasswordValidator { RequiredLength = 8, RequireNonLetterOrDigit = true };
        manager.UserLockoutEnabledByDefault = true;
        manager.DefaultAccountLockoutTimeSpan = TimeSpan.FromMinutes(15);
        manager.MaxFailedAccessAttemptsBeforeLockout = 5;
        return manager;
    }
}

[AllowAnonymous]
public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
{
    var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
    if (loginInfo == null) return RedirectToAction("Login");

    var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
    return result switch
    {
        SignInStatus.Success => RedirectToLocal(returnUrl),
        SignInStatus.LockedOut => View("Lockout"),
        _ => View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = loginInfo.Email })
    };
}

[Authorize(Roles = "Administrator,Support")]
public class AdminController : Controller { ... }