The login form in /templates/login.aspx is a good start. Change the authentication tag in web.config to point to this instead. Authenticating extranet users is nothing different than authenticating editors or administrators. It is done in the same way, what makes you an extranet user is what you can see and do. If you want to create your own login form for extranet users, what you need to do is create two textboxes to collect the username and password, add a button to call EPiServer.Util.LoginBase.Login(username, password, persist). That will try to authenticate the user, write the auth cookie and cache the credentials for subseqent requests. You will have to do a redirect if the authentication is successful in order to have a complete authenticated request, as the button click event is fired rather late in the event chain. /Steve