.net - How does the membership authentication flow work? What are the responsibilities of each step in the process? -

i'm having hard time finding adequate documentation on subject, question this: flow of authentication in mvc4? using custom provider (that i'm still in midst of coding gain better understanding of framework). let me elaborate current understanding can place question in context:

as understand it, when user logs in, login(loginviewmodel model, string returnurl) action fired runs websecurity.login(model.username, model.password, persistcookie: false). method, in turn, fires validateuser in custom membership class. here, need work authenticate user. doing hitting our auth service receive access , refresh tokens , store them in cookie.

so, how work after user validated? how framework know user still logged in or logged out, user timeout, etc? feel there need doing during validateuser process user principal.

if me better understanding of process, appreciated.

when overriding asp.net membership provider.

login(loginviewmodel model, string returnurl) action fired runs websecurity.login(model.username, model.password, persistcookie: false). method, in turn, fires validateuser in custom membership class. here, need work authenticate user. doing hitting our auth service receive access => here happens

you not need create cookie yourself.

public override bool validateuser(string username, string password) {    // return true or false based on auth service.    // no need create authentication cookie.    // membership provider create if return true. } 

when authenticated user requests page, membershipprovider calls getuser method membershipuser object , create iprincipal object.

public override membershipuser getuser(string username, bool userisonline) {           // code need return membershipuser -    // return new membershipuser(...)    // again not need create iprincipal object yourself.  } 

by overriding 2 methods, user can login site. again, not need create authentication cookie , principal object membership provider's job.