MVC with External Authentication

I am trying to get Sitefinity to work with MVC and JQuery Mobile and am having many issues....

The current issue is that I need to have users authenticate to access parts of the application.  This authentication needs to be with an external service, the users logging into the front end will not be in the Sitefinity user base.  I also need to have users who can log into the back-end to update the content, these users will be managed by Sitefinity.

To secure pages in MVC I add a authorize attribute on the controller.  This needs to confirm the users on the front end have been authenticated by the external service, but still allow users logged into the back end to be able to updated content.

This is not working, when I hit the page with the authorize attribute on the front-end it is trying to take me to the sitefinity login.  Has anyone found a way to make this work?

Well, I have a way to do it now, but I'm not all that excited with it...

I heard back from Sitefinity support and was given a few different ways to do this.

1) Create my own custom AuthorizeUser attribute, save the values when I authenticate to the session of a cookie, check for that value on the attribute...basically rewrite all the Authenticate functionality myself. - I'd really like to keep the Authenticate functionality as much as possible so I don't think I will do this.

2) Create a Custom Membership Provider, add this to the Sitefinity backend as a valid membership provider. This would be a good solution if I was wanting to store my users in a database and validate/update them. But, I am only validating against a service.

3) Create a dummy user in the Sitefinity backend with no access and definitely no backend access or admin access. After authenticating to my service if all is good then log into this user from the code. After this the [Authenticate] attribute finds that this user is logged in so all is good. As I do not need to check roles or claims in my app, just that user is logged in, this may work. It seems pretty ugly to me but I am assured that as long as the user does not have backend access or admin access it will not count to co-current users and many many users can be logged in as the same user.

I will go forward with option 3 and see how it goes and if I can get it past the architecture team.

here is the link where I found option 3 with some more info...

www.sitefinity.com/.../custom-authentication

When implementing the External STS with Sitefinity CMS on the project, the platform shows a message that says that the file OAuthLoginForm.ascx. does not exist. I would like to know if I need to change the file path or if I have a Project version that is not the correct one. This is the link I used to download the project:github.com/.../Sitefinity-External-STS-Integration.

This is the link with my project: www.wetransfer.com/.../d131ad

@James Why does it have to be a dummy user?  Why can't you pass along the dude as a JWT or some other method, then create the user in SF (if they dont exist) and log them in though code?  You wouldn't have to MANAGE them in sitefinity, but there's greater security when you know who is who.