Does ASP.NET MVC authentication work with alternative source to database?

The relevant component relationships to know about are as follows:

SignInManager talks to UserManager talks to UserStore

The class to override is UserStore. If you create an ASP.NET application from the Visual Studio templates, it will provide a user store from Microsoft.AspNet.Identity.EntityFramework.UserStore.

You can replace this user store with your own MyWcfServiceUserStore (or whatever you choose to call it).

For example, if you represented the user as MyUserType, and it used a Guid as a unique identifier:

 public class MyWcfServiceUserStore
    : IUserLockoutStore<MyUserType, Guid>,
      IUserPasswordStore<MyUserType, Guid>,
      IUSerTwoFactorStore<MyUserType, Guid>,
      IUserEmailStore<MyUserType, Guid>
{
   // Lots of methods to implement now
}

You would then modify the code so the UserManager is passed the MyWcfServiceUserStore in the constructor.

public class ApplicationUserManager : UserManager<MyUserType, Guid>
{
    public ApplicationUserManager(IUserStore<MyUserType, Guid> store)
       : base(store)
    {
    }

    public static ApplicationUserManager Create(IdentityFactoryOptions<ApplicationUserManager> options, IOwinContext context)
    {
       var manager = new ApplicationUserManager(new MyWcfServiceUserStore(...));
       //
       // Further initialization here
       //
       return manager;
    }
}

While this isn't exactly trivial, it should be straightforward to implement all of the required UserStore methods yourself. One thing to keep in mind, within one web call the UserManager might hit the UserStore several times with identical queries, so you will have to make good use of caching.

The easiest hack is to use form authentication, I have done it, but not in production.

LoginViewModel

public class LoginViewModel
     {
        [Required]
        public string Username { get; set; }
    [Required]
    [DataType(DataType.Password)]
    public string Password { get; set; }
}

Controller Action

    [HttpPost]
    public ActionResult Login(LoginViewModel login)
    {
        if (!ModelState.IsValid)
        {
            ViewBag.Error = "Form is not valid; please review and try again.";
            return View("Login");
        }

        if ((login.Username == "[email protected]" && login.Password == "NotVeryWise")) { 
            FormsAuthentication.SetAuthCookie(login.Username, false);
            return RedirectToAction("Index", "Home");
        }  


        ViewBag.Error = "Credentials invalid. Please try again.";
        return View("Login");
    }   

Web.config

    <system.web>
    //...
    //...
    <authentication mode="Forms">
      <forms loginUrl="~/Account/Login" timeout="2880" defaultUrl="~/Home" />
    </authentication>

  </system.web>

You can now use [Authorize] on controllers.