Configurable Authentication Provider Chain

<?xml version="1.0" encoding="utf-8" ?>

<configuration>

       <configSections>

              <sectionGroup name="episerver">

                    <section name="Security" allowDefinition="MachineToApplication" allowLocation="false" type="EPiServer.Security.SecurityConfigurationHandler,EPiServer" />

              </sectionGroup>

       </configSections>

       <episerver>

              <Security>

                    <authenticationProvider type="EPiServer.Security.CacheAuthenticationProvider, EPiServer" method="CacheAuthentication" />

                    <authenticationProvider type="EPiServer.Security.WindowsAuthenticationProvider, EPiServer" method="WindowsAuthentication" />

                    <authenticationProvider type="EPiServer.Security.DatabaseAuthenticationProvider, EPiServer" method="DatabaseAuthentication" />

              </Security>

       </episerver>

.

.

.

public static void Method(object sender, AuthenticationEventArgs e)

{

       // If user name is "john" you will never be authenticated,

       // regardless of what other providers (executed before or

       // after this provider) says. Setting IsDenied makes it

       // possible to filter out banned users for example.

       if (e.Username == "john")

              e.IsDenied = true;

       // If another provider has already authenticated this user,

       // do nothing. Note that all authentication providers will

       // always be called in response to an authentication event,

       // this is due to the nature of events in the .NET environment.

       if (e.IsHandled)

              return;

       // Very simple authentication - here you should implement

       // your own lookup and check credentials against your

       // user store. Several out-of-band techniques can be used

       // if the information in AuthenticationEventArgs is

       // insufficient - primarily looking at HttpContext.Current

       // gives you the possibility to extract any information

       // about the current Http request.

       if (e.Username != "peter" || e.Password != "expert")

              return;

       // A request is authenticated by setting e.Principal to an

       // object instance that implements the IPrincipal interface.

       // Since the principal also carries the roles of the

       // principal it is usually a good idea to do the

       // authorization at the same time for performance reasons.

       UnifiedPrincipal up = new UnifiedPrincipal(

              new GenericPrincipal(

              new GenericIdentity( e.Username, "My Authentication Type" ),

              new string[] { "Administrators" } ) );

       // If you want to cache the principal to speed up

       // authentication for subsequent requests, the

       // following code sequence is needed.

       up.Password = e.Password;

       up.AddToCache();

       // Return the principal to indicate that authentication

       // was successful

       e.Principal = up;

}

<?xml version="1.0" encoding="utf-8" ?>

<configuration>

       <configSections>

              <sectionGroup name="episerver">

                    <section name="Security" allowDefinition="MachineToApplication" allowLocation="false" type="EPiServer.Security.SecurityConfigurationHandler,EPiServer" />

              </sectionGroup>

       </configSections>

       <episerver>

              <Security>

                    <authenticationProvider type="EPiServer.Security.CacheAuthenticationProvider, EPiServer" method="CacheAuthentication" />

                    <authenticationProvider type="EPiServer development.MyAuthentication, EPiServerSample" method="Method" />

              </Security>

       </episerver>

.

.

.