c# - Using authorization filter in asp.net mvc4 application -

i have asp.net mvc4 application in i'd use authorization filter secure application added snippet web.config file

<system.web>     <authentication mode="forms" >       <forms loginurl=""~/home/login" />     </authentication>     </system.web> 

in controller :

 public actionresult login() {            return view(new user());        }       [httppost]        public actionresult login(user u)        {            return view(new user());        }         [authorize(roles ="admin")]        public actionresult adminspace()        {            return view();        }         [authorize(roles = "admin, user")]        public actionresult userspace()        {            return view();        } 

and user class

 public class user     {         public string login { get; set; }         public string mdp { get; set; }         public bool isadmin { get; set; }          public static bool authentificate(string login, string password){              if (login == "admin" && password == "admin")             {              }              if (login == "user" && password == "user")             {              }             else {                 return false;             }         }     } 

to issue , i'd add role of admin account (admin/admin ) , role user account( user/ user).

• how can change code reach goal?
• what best practices authentificate users in asp.net internet application?

i found solution here:

link