Build a member system in ASP.NET 2.0 without using the Providers

ASP.NET 2.0 Provider Model

If you search for something like "authentication, authorization, member, role, user with ASP.NET," the first thing that is likely to come up is the famous ASP.NET 2.0 Provider Model.

A provider is a software module that provides a uniform interface between a service and a data source. Providers abstract physical storage media, in much the same way that device drivers abstract physical hardware devices.

To make things simple, providers are interfaces those represent ASP.NET 2.0 services: Membership, Profile, Role, Sitemap, Session State etc. The implementing classes of these providers are responsible for storing state data in storage media that maybe a SQL Server database, MySQL database, XML file or even a plain text file. We can say that the Provider Model is somekind of Strategy Pattern.



One of the providers is Membership Provider which standardized the way ASP.NET developers implement a member system in ASP.NET 2.0. By using Membership Provider, many benefits are gained. For example,

• Every ASP.NET programmers implement the member system the same way. So it is easy to understand/work across different projects.
• Easy to migrate to other database. Just change/reimplement the provider!
• Can take advantage of ASP.NET's ready-out-of-the-box Login controls: Login, PasswordRecovery, CreateUserWizard, ChangePassword etc.

So, What are the problems ?

While there are so many benefits, ordinary developers suffered from Provider Model from many reasons.

• It takes too much effort to implement a provider. Take a look at Implementing a Membership Provider. I just don't want to waste time reading this document just to build a member system on my small website.
• The Login Controls looks inflexible to many developers. It gives the impression that they will not allow the developers to do things the way they want. Despite the fact that these controls are highly customizable ... with some efforts.
• It has too steep learning curve. In a time-crisis situation, developers may consider implementing member system the manual way.
  

This makes some developers turn back from Provider Model and implement their own logics.

The member system we are going to implement is simple, utilizing only the FormsAuthentication in ASP.NET 1.x style.

• Create new user
• Login and Logout
• Restrict access to pages in directory according to user's roles

Note that the readers' experience on ASP.NET and ASP.NET 2.0 are assumed :) and most of the code comes from "Role-based Security with Forms Authentication" by Heath Stewart.

Create new user

This is straight-forward. Just layout some fields and add some validators. The initial user data is then inserted into the database.

Login and Logout

We must first have the logic for authentication. For example, the person with username and password pair are queried from database.

<br />public static bool Authenticate(string username, <br /> string password)<br />{<br /> PersonCollection persons = new PersonCollection()<br /> .Where("username", username)<br /> .Where("password", password)<br /> .Load();<br /> return persons.Count == 1;<br />}<br />

We then need to modify the web.config file to indicate the authentication method and the location of login page. Add these lines under <system.web>

<br /><authentication mode="Forms"><br /> <forms name="items_auth" loginurl="SignIn.aspx"><br /><br /> </forms><br /></authentication><br />

Next, for the login logic, here is my sample code.

<br />protected void uxLogin_Click(object sender, ImageClickEventArgs e)<br />{<br /> string username = <br /> (LoginView1.FindControl("uxUsername") as TextBox).Text;<br /> string password = <br /> (LoginView1.FindControl("uxPassword") as TextBox).Text;<br /><br /> if (MembershipManagement.Authenticate(username,password))<br /> {<br /> FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(<br /> 1,<br /> username,<br /> DateTime.Now,<br /> DateTime.Now.AddMinutes(15),<br /> false,<br /> "Customer",<br /> FormsAuthentication.FormsCookiePath);<br /><br /> string hash = FormsAuthentication.Encrypt(ticket);<br /> HttpCookie cookie =<br /> new HttpCookie(FormsAuthentication.FormsCookieName,hash);<br /> Response.Cookies.Add(cookie);<br /><br /> string returnUrl = Request.QueryString["ReturnUrl"];<br /> if (returnUrl == null) returnUrl = "./";<br /> Response.Redirect(returnUrl, false);<br /><br /> }<br /> else<br /> {<br /> Label uxMessage = (LoginView1.FindControl("uxMessage") as Label);<br /> uxMessage.Text = "* Cannot log into the system";<br /> uxMessage.Visible = true;<br /> }<br />}<br />

In this case, every succeeded authentication will give the current user the role of "Customer."

Finally, add the Global.asax file to your project if none exists. You can add the Global.asax file from Add New Item Dialog. Overrides the Application_AuthenticateRequest method like this:

<br /><br />protected void Application_AuthenticateRequest(object sender,<br /> EventArgs e)<br />{<br /> if (HttpContext.Current.User != null)<br /> {<br /> if (HttpContext.Current.User.Identity.IsAuthenticated)<br /> {<br /> if (HttpContext.Current.User.Identity is FormsIdentity)<br /> {<br /> FormsIdentity id = <br /> (FormsIdentity)HttpContext.Current.User.Identity;<br /> FormsAuthenticationTicket ticket = id.Ticket;<br /> <br /> // Assign roles to user<br /> string userData = ticket.UserData;<br /> string[] roles = userData.Split(',');<br /> HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(id, roles);<br /> }<br /> }<br /> }<br />}<br />

Restrict access to pages in directory according to user's roles

To protect a directory, add a separate web.config files containing these lines to each directory.

<br /><?xml version="1.0"?><br /><!--<br /> ...<br />--><br /><configuration><br /> <appSettings/><br /> <connectionStrings/><br /> <system.web><br /> <authorization><br /> <allow roles="Customer"/><br /> <deny users="*"/><br /> </authorization><br /> </system.web><br /></configuration><br />

The allow tag specifies roles those can access the directory.

You can now also use ASP.NET's Login Controls

• LoginView Control: To display different message to users those have been logged in and those not.
• LoginStatus Control: To display Login/Logout link.
• LoginName: To display username of current user. Same as using HttpContext.Current.User.Identity

Hope this post help those ASP.NET developers, especially for those with time-constraint :)

ASP.NET Provider Model Support in MySQL

After a long googling, I found that ASP.NET Membership Provider seems to be a good architectural choice for my project at the faculty. Microsoft prepared the providers for SQL Server out of the box. But I need my data store to be MySQL server. So something is needed to be done.

I first downloaded and installed MySQL Connector/Net 5.2.2. The installer also configured the machine.config file on my system too.

After that, I configured my project's web.config file to override the default connection string.

<connectionStrings> <remove name="LocalMySqlServer"/> <add
name="LocalMySqlServer"
connectionString="Datasource=localhost;Database=mydb;uid=root;pwd=root;"
providerName="MySql.Data.MySqlClient"/> </connectionStrings>

Then, I loaded the ASP.NET Web Site Administration Tool from Visual Studio 2008 and click on the Provider Configuration / Select a different provider for each feature (advanced) links to config MySQL providers with my project.

After the providers are configured, I went to the Security page but it provide me with error message.

Unable to initialize provider. Missing or incorrect schema.

I found out later that I need to create the database before MySQL connector can generated the schema. This is easily done by using MySQL's create database mydb command. Everything works fine in the end. All tables are generated.

mysql> show tables
-> ;
+-------------------------+
| Tables_in_mydb |
+-------------------------+
| my_aspnet_applications |
| my_aspnet_membership |
| my_aspnet_profiles |
| my_aspnet_roles |
| my_aspnet_schemaversion |
| my_aspnet_users |
| my_aspnet_usersinroles |
+-------------------------+
7 rows in set (0.00 sec)

Hope this helps people who are struggling with this problem :)

Other helpful blog on the topic:

• http://blog.nolanbailey.com/2008/03/08/mysql-aspnet-membership-and-role-provider/194