Build a member system in ASP.NET 2.0 without using the Providers

ASP.NET 2.0 Provider Model

If you search for something like "authentication, authorization, member, role, user with ASP.NET," the first thing that is likely to come up is the famous ASP.NET 2.0 Provider Model.

A provider is a software module that provides a uniform interface between a service and a data source. Providers abstract physical storage media, in much the same way that device drivers abstract physical hardware devices.

To make things simple, providers are interfaces those represent ASP.NET 2.0 services: Membership, Profile, Role, Sitemap, Session State etc. The implementing classes of these providers are responsible for storing state data in storage media that maybe a SQL Server database, MySQL database, XML file or even a plain text file. We can say that the Provider Model is somekind of Strategy Pattern.



One of the providers is Membership Provider which standardized the way ASP.NET developers implement a member system in ASP.NET 2.0. By using Membership Provider, many benefits are gained. For example,

• Every ASP.NET programmers implement the member system the same way. So it is easy to understand/work across different projects.
• Easy to migrate to other database. Just change/reimplement the provider!
• Can take advantage of ASP.NET's ready-out-of-the-box Login controls: Login, PasswordRecovery, CreateUserWizard, ChangePassword etc.

So, What are the problems ?

While there are so many benefits, ordinary developers suffered from Provider Model from many reasons.

• It takes too much effort to implement a provider. Take a look at Implementing a Membership Provider. I just don't want to waste time reading this document just to build a member system on my small website.
• The Login Controls looks inflexible to many developers. It gives the impression that they will not allow the developers to do things the way they want. Despite the fact that these controls are highly customizable ... with some efforts.
• It has too steep learning curve. In a time-crisis situation, developers may consider implementing member system the manual way.
  

This makes some developers turn back from Provider Model and implement their own logics.

The member system we are going to implement is simple, utilizing only the FormsAuthentication in ASP.NET 1.x style.

• Create new user
• Login and Logout
• Restrict access to pages in directory according to user's roles

Note that the readers' experience on ASP.NET and ASP.NET 2.0 are assumed :) and most of the code comes from "Role-based Security with Forms Authentication" by Heath Stewart.

Create new user

This is straight-forward. Just layout some fields and add some validators. The initial user data is then inserted into the database.

Login and Logout

We must first have the logic for authentication. For example, the person with username and password pair are queried from database.

<br />public static bool Authenticate(string username, <br /> string password)<br />{<br /> PersonCollection persons = new PersonCollection()<br /> .Where("username", username)<br /> .Where("password", password)<br /> .Load();<br /> return persons.Count == 1;<br />}<br />

We then need to modify the web.config file to indicate the authentication method and the location of login page. Add these lines under <system.web>

<br /><authentication mode="Forms"><br /> <forms name="items_auth" loginurl="SignIn.aspx"><br /><br /> </forms><br /></authentication><br />

Next, for the login logic, here is my sample code.

<br />protected void uxLogin_Click(object sender, ImageClickEventArgs e)<br />{<br /> string username = <br /> (LoginView1.FindControl("uxUsername") as TextBox).Text;<br /> string password = <br /> (LoginView1.FindControl("uxPassword") as TextBox).Text;<br /><br /> if (MembershipManagement.Authenticate(username,password))<br /> {<br /> FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(<br /> 1,<br /> username,<br /> DateTime.Now,<br /> DateTime.Now.AddMinutes(15),<br /> false,<br /> "Customer",<br /> FormsAuthentication.FormsCookiePath);<br /><br /> string hash = FormsAuthentication.Encrypt(ticket);<br /> HttpCookie cookie =<br /> new HttpCookie(FormsAuthentication.FormsCookieName,hash);<br /> Response.Cookies.Add(cookie);<br /><br /> string returnUrl = Request.QueryString["ReturnUrl"];<br /> if (returnUrl == null) returnUrl = "./";<br /> Response.Redirect(returnUrl, false);<br /><br /> }<br /> else<br /> {<br /> Label uxMessage = (LoginView1.FindControl("uxMessage") as Label);<br /> uxMessage.Text = "* Cannot log into the system";<br /> uxMessage.Visible = true;<br /> }<br />}<br />

In this case, every succeeded authentication will give the current user the role of "Customer."

Finally, add the Global.asax file to your project if none exists. You can add the Global.asax file from Add New Item Dialog. Overrides the Application_AuthenticateRequest method like this:

<br /><br />protected void Application_AuthenticateRequest(object sender,<br /> EventArgs e)<br />{<br /> if (HttpContext.Current.User != null)<br /> {<br /> if (HttpContext.Current.User.Identity.IsAuthenticated)<br /> {<br /> if (HttpContext.Current.User.Identity is FormsIdentity)<br /> {<br /> FormsIdentity id = <br /> (FormsIdentity)HttpContext.Current.User.Identity;<br /> FormsAuthenticationTicket ticket = id.Ticket;<br /> <br /> // Assign roles to user<br /> string userData = ticket.UserData;<br /> string[] roles = userData.Split(',');<br /> HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(id, roles);<br /> }<br /> }<br /> }<br />}<br />

Restrict access to pages in directory according to user's roles

To protect a directory, add a separate web.config files containing these lines to each directory.

<br /><?xml version="1.0"?><br /><!--<br /> ...<br />--><br /><configuration><br /> <appSettings/><br /> <connectionStrings/><br /> <system.web><br /> <authorization><br /> <allow roles="Customer"/><br /> <deny users="*"/><br /> </authorization><br /> </system.web><br /></configuration><br />

The allow tag specifies roles those can access the directory.

You can now also use ASP.NET's Login Controls

• LoginView Control: To display different message to users those have been logged in and those not.
• LoginStatus Control: To display Login/Logout link.
• LoginName: To display username of current user. Same as using HttpContext.Current.User.Identity

Hope this post help those ASP.NET developers, especially for those with time-constraint :)

ChemL1ve! quite a hard time …

My team and I had just finished our Imagine Cup 2007 local round project, ChemL1ve!, and had given presentation on yesterday at TK Park, Central World Plaza. We won the third prize. I am really happy since I thought our team would not be in the top three of six teams from various Universities.

We had to give the presentation in very limited time of 15 minutes and we could not finish it in time. It was a really bad feeling. Try to think of yourself spent days coding a program and had only five minutes to show it off. It is hard to admit but this is normal situation. Good developers should learn some presentation skills too.

The winner was a team from CPE, Kasetsart University. Their project is an application that helps people who cannot read to be able to understand a book. By let the web camera point to the contents of the book. The application quickly recognizes the word on the page and displays the image and details of that word on the screen in a stylish way using WPF. User can also browse to the word he/she interested in by pronouncing that word to the microphone. The demo was really great and I can tell that this is the obvious winner of this year, right after I attend their presentation.

Our project is multi-user virtual chemistry lab software. At the stage of proposal submission, without any research, I thought it would not be so hard to develop such kind of system. But after that, when I tried to model it, I realize this was too big for a team with two inexperienced developers! More importantly, to correctly and effectively model this kind of system, you need a solid understanding of Chemistry which I actually got a “C” in my first Intania year T-T

Since this is a tech blog, I may go into the details of implementation. Here is my “ugly” class diagram at one stage of the development. Please note that it is “ugly” in term of OO design (Visual Studio 2005 generates this polish diagram quite well). It is “ugly” because it cannot support many of the system behaviors.

With this diagram, number of kind of lab equipment is fixed because I use a class to represent equipment. I am wondering if I could dynamically create new equipment at runtime. Those reflection stuffs might be able to do this sort of thing.

That is all my part. Another part is a client that my friend develops using the WPF as presentation layer. The client sends the interaction between lab equipment and get result from Web Service which wraps my part. This diagram below may help visualize architecture of our project (I designed this diagram using Expression Design, it is suitable for creating this kind of image than Adobe Photoshop).

Here are some screenshots of the client, ChemL1ve! Action.

For those who want to join next year’s Imagine Cup s/w design competition, I suggest that you should focus more on your ideas than the implementation details and make sure that your application can really solve the problem addressed. And keep in mind that this is “ideas” and “software design” competition. Do not mess with the coding too much. Just make sure that the app will not throw any uncatched exceptions during the demonstration : )