protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
    {
        string userName = Login1.UserName;
        string password = Login1.Password;
        bool rememberUserName = Login1.RememberMeSet;

        // for this demo purpose, I am storing user details into xml file
        string dataPath = Server.MapPath("~/App_Data/UserInformation.xml");
        DataSet dSet = new DataSet();
        dSet.ReadXml(dataPath);

        DataRow[] rows = dSet.Tables[0].Select(" UserName = '" + userName + "' AND Password = '" + password + "'");
        // record validated
        if (rows.Length > 0)
        {
            // get the role now
            string roles = rows[0]["Roles"].ToString();

            // Create forms authentication ticket
            FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
            1, // Ticket version
            userName,// Username to be associated with this ticket
            DateTime.Now, // Date/time ticket was issued
            DateTime.Now.AddMinutes(50), // Date and time the cookie will expire
            rememberUserName, // if user has chcked rememebr me then create persistent cookie
            roles, // store the user data, in this case roles of the user
            FormsAuthentication.FormsCookiePath); // Cookie path specified in the web.config file in <Forms> tag if any.

            // To give more security it is suggested to hash it
            string hashCookies = FormsAuthentication.Encrypt(ticket);
            HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hashCookies); // Hashed ticket

            // Add the cookie to the response, user browser
            Response.Cookies.Add(cookie);

            // Get the requested page from the url
            string returnUrl = Request.QueryString["ReturnUrl"];
            // check if it exists, if not then redirect to default page
            if (returnUrl == null) returnUrl = "~/Default.aspx";
            Response.Redirect(returnUrl);
        }
        else // wrong username and password
        {
            // do nothing, Login control will automatically show the failure message
            // if you are not using Login control, show the failure message explicitely
        }  
    }