---
title: Integrating Kentico membership
related:
  - https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/setting-up-authentication.md
  - https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/enabling-user-registration.md
  - https://docs.kentico.com/k12sp/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/implementing-password-reset-functionality-for-mvc-sites.md
  - https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/external-authentication-on-mvc-sites.md
  - https://docs.kentico.com/k12sp/managing-users/authorizing-live-site-actions-via-roles.md
  - https://docs.kentico.com/k12sp/managing-users/user-management.md
  - https://docs.kentico.com/k12sp/managing-users/adding-custom-fields-to-users.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Kentico provides an integration API that allows you to work with Kentico membership data on websites presented by a [separate MVC application](https://docs.kentico.com/k12sp/developing-websites/mvc-development-overview.md). The API is available in the **Kentico.Membership** assembly and namespace, which is provided as part of the _Kentico.AspNet.Mvc_ [integration package](https://docs.kentico.com/k12sp/developing-websites/starting-with-mvc-development/installing-kentico-integration-packages.md).

You can set up the following scenarios:

- Allow visitors to sign in with Kentico [user accounts](https://docs.kentico.com/k12sp/managing-users/user-management.md)
- Allow users to register new accounts from the MVC site (the user data is stored in the shared Kentico database)
- Allow users to reset their passwords
- Authorize actions based on Kentico [roles](https://docs.kentico.com/k12sp/managing-users/role-management.md)
- Use external services for authentication

The membership integration is based on [ASP.NET Identity](http://www.asp.net/identity) and the [OWIN](http://owin.org/) standard. As a result, you can work with user data through the standard approaches that you would use in any ASP.NET MVC application.

## Integrating Kentico membership into your project

Before you can start working with Kentico membership data in your MVC application, you need to register the required API:

1. Open your MVC project in Visual Studio.
2. Install the **Microsoft.Owin.Host.SystemWeb** NuGet package.
3. Add a **Startup.Auth** class to your project's **App\_Start** folder (or modify your existing authentication startup file):

   ```csharp

   using System;
   using System.Web;
   using System.Web.Mvc;

   using Microsoft.Owin;
   using Microsoft.Owin.Security.Cookies;
   using Microsoft.AspNet.Identity;
   using Owin;

   using CMS.Helpers;
   using CMS.SiteProvider;

   using Kentico.Membership;

   // Assembly attribute that sets the OWIN startup class
   // This example sets the Startup class from the 'LearningKit.App_Start' namespace, not 'LearningKit.App_Start.Basic' used below
   // The active Startup class is defined in Startup.Auth.cs and additionally demonstrates registration of external authentication services
   [assembly: OwinStartup(typeof(LearningKit.App_Start.Startup))]

   namespace LearningKit.App_Start.Basic
   {
       public partial class Startup
       {
           // Cookie name prefix used by OWIN when creating authentication cookies
           private const string OWIN_COOKIE_PREFIX = ".AspNet.";

           public void Configuration(IAppBuilder app)
           {
               // Registers the Kentico.Membership identity implementation
               app.CreatePerOwinContext(() => UserManager.Initialize(app, new UserManager(new UserStore(SiteContext.CurrentSiteName))));
               app.CreatePerOwinContext<SignInManager>(SignInManager.Create);

               // Configures the authentication cookie
               UrlHelper urlHelper = new UrlHelper(HttpContext.Current.Request.RequestContext);
               app.UseCookieAuthentication(new CookieAuthenticationOptions
               {
                   AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                   // Fill in the name of your sign-in action and controller
                   LoginPath = new PathString(urlHelper.Action("SignIn", "Account")),
                   Provider = new CookieAuthenticationProvider
                   {
                       // Sets the return URL for the sign-in page redirect (fill in the name of your sign-in action and controller)
                       OnApplyRedirect = context => context.Response.Redirect(urlHelper.Action("SignIn", "Account")
                                                    + new Uri(context.RedirectUri).Query)
                   }
               });

               // Registers the authentication cookie with the 'Essential' cookie level
               // Ensures that the cookie is preserved when changing a visitor's allowed cookie level below 'Visitor'
               CookieHelper.RegisterCookie(OWIN_COOKIE_PREFIX + DefaultAuthenticationTypes.ApplicationCookie, CookieLevel.Essential);
           }
       }
   }

   ```

   > **Info:** **Registering authentication cookies**
   >
   > We strongly recommend [registering](https://docs.kentico.com/k12sp/configuring-kentico/data-protection/registering-custom-cookies.md) all authentication cookies used on your website with an appropriate [cookie level](https://docs.kentico.com/k12sp/configuring-kentico/data-protection/working-with-cookies.md) (typically **Essential** when working with the default cookie level values).
   >
   > Otherwise you may encounter problems with the cookies being cleared after adjusting the allowed cookie level for visitors (for example when managing [tracking consent](https://docs.kentico.com/k12sp/configuring-kentico/data-protection/gdpr-compliance/working-with-consents-on-mvc-sites.md)). Changes of the allowed cookie level automatically remove all cookies above the given level. Any unregistered cookies are processed with the _Visitor_ level, which is usually too high for basic authentication cookies.
   >
   > To register a cookie, call the **CookieHelper.RegisterCookie** method (available in the **CMS.Helpers** namespace of the Kentico API) in your application's startup code. You can access the default level values in the **CookieLevel** enumeration.

The Kentico identity implementation is now registered and you can work with the **Kentico.Membership** API in your application's code. Continue by setting up [user authentication](https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/setting-up-authentication.md). You can also implement the following features:

- [User registration](https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/enabling-user-registration.md)
- [Password reset functionality](https://docs.kentico.com/k12sp/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/implementing-password-reset-functionality-for-mvc-sites.md)
- [Role-based authorization](https://docs.kentico.com/k12sp/managing-users/authorizing-live-site-actions-via-roles.md) for your controller actions
- [Integration of external authentication services](https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/external-authentication-on-mvc-sites.md)