Web App Authentication

We need a list of authentication options for the web application we are building (along with a recommended authentication method of choice). This list should take into account our technology stack. We will then discuss the list and choose which one we think will suit our solution best. We also need to understand the fine detail around the authentication process, such as one way hashing (and comparison) of passwords and the possible use of a salt for the encryption. Our web application has three distinct layers - SPA Front End (knockoutJs), Web Api data layer (MVC), Datastore (Sql Server). It also has a caching element. The authentication will take place via a login form presented in the frontend. The user will enter credentials and submit the form for the authentication process to begin (validation not in scope here). The data should be sent to the server for validation in the form of a POST. Things like SSL and other standard security techniques are not the point of interest for these requirements as they are covered by in other areas (but anything you feel is relevant please highlight). The authentication should keep the client's user session secure. The authentication should work across multiple devices on multiple operating systems (so an authentication process that involved a Windows only technique would not work). The user credentials will be stored in the database The username will be the email address of the user. The password will be a minimum length of 8 characters, and must contain a capital letter, alpha and numeric characters and a non alpha character. (it is not necessary to produce client side validation for this). The password will be stored in the database using a one way hash. The password should not be retrievable from the database but only used to compare i.e. to check that the input password (hashed) match the stored password (hash). Please specify options around one way hash comparison systems. How can a salt be incorporated into this? Output: Initially we need a list of presented options for authentication and storing of user credentials. We will then discuss and approve one authentication option, which should then be followed by a very basic demonstration to showcase the technique described. This demonstration will then be handed over to us for incorporation into our solution. This should include a (very) simple html page with username/password input and submit button (which utilises knockoutJs) to contact the server (built in c# web api) to validate credentials stored in the backend database (sql server). The demo should mimic our own design so it is easily incorporate. Source code and design should be fully documented.