Understanding ASP.NET Provider Model (Creating Custom Membership and Role Providers) - Part 3

Introduction

In the Part 1 and Part 2 we learnt the concept and internal architecture of ASP.NET provider model. We know that the provider model is extensible and one can implement custom providers to suit his requirement. In this part we will develop two custom providers - one for membership and the other for roles.

Why develop a custom membership and role provider?

Well. There can be many reasons. Here are few:

• You have custom data store (not SQL Server or Access) in which you want to store user data.
• You are using some non-standard database for which there is no inbuilt membership or role providers.
• You want to implement custom encryption mechanism for the data being saved and retrieved
• You want to write database independent membership and role provider

One more reason that I have not listed in the above list is - You may want to use your own table schema instead of using inbuilt one. At first glance it may look odd but it can be a great way to save your work while migrating applications.

Requirements

Let's decide the requirements for building our custom membership and role providers.

• We want to use our application database for storing membership and role information. That also means that we do not have a central database for storing membership details of multiple applications
• We want to store membership details in a table called Users
• We want to store available roles in the system in a table called Roles
• We want to store user-role mapping in a table called UserRoles
• For the sake of simplicity we will not include any encryption-decryption logic
• User can register by supplying user name, password and email. No security question is required
• We do not need features such as password reset and accounting locking

Database access

We will be using BinaryIntellect DatabaseHelper open source component for all our database access.

Creating the Web Site

To begin, create a new web site and add two classes called MyMembershipProvider and MyRoleProvider to App_Code folder. For the sake of simplicity we will be creating all the necessary classes in the web site itself. In a more real world situations you may create a separate class library project to contain these classes.

Configuring the web site to use our providers

Open the web.config file and add the following markup:

<membership defaultProvider="mymembershipprovider">
<providers>
<add name="mymembershipprovider" 
type="MyMembershipProvider" 
connectionStringName="connstr"/>
</providers>
</membership> 

<roleManager enabled="true" defaultProvider="myrolesprovider"> 
<providers> 
<add name="myrolesprovider" 
type="MyRolesProvider" 
connectionStringName="connstr"/> 
</providers>
</roleManager>

Here, we instruct ASP.NET to use MyMembershipProvider class as membership provider and MyRolesProvider class as roles provider.

Creating custom membership provider

Recollect from Part 2 that custom membership providers need to inherit from System.Web.Security.MembershipProvider class. The MembershipProvider class in turn inherits from ProviderBase class. The MembershipProvider class contains several abstract methods that you must implement in your class.

If you are using VS.NET then your job is simple. Right click on the MembershipProvider class in the class definition line and choose "Implement Abstract Class". VS.NET will add dummy delimitations for all the required methods and properties from the MembershipProvider class. The following table lists all the properties and methods that you need to implement (methods are shown with parenthesis).

Property/Method Name	Description
Initialize()*	Receives the connection string name specified in the web.config file. You can use it to perform database operation in your class.
Name*	Represents name of our custom provider
CreateUser()*	Creates a user
UpdateUser()*	Saves modified information about an existing user
DeleteUser()*	Deletes a user
GetUser()*	Gets a user as MembershipUser instance
GetAllUsers()*	Gets all the users as MembershipUserCollection
ChangePassword()*	Changes password of a user
GetPassword()*	Retrieves password of a user. Used when implementing "Forgot Password" feature
ValidateUser()*	Authenticates the user
EnablePasswordReset*	Indicates whether the password can be reset by the user
EnablePasswordRetrieval*	Indicates whether the password can be retrieved by teh user
RequiresQuestionAndAnswer*	Indicates whether user should supply a security question and answer during registration
RequiresUniqueEmail*	Indicates whether the email supplied during registration should be unique
ApplicationName	Name of the web application. This name is used in case you are using a central database for storing membership data of multiple applications
MaxInvalidPasswordAttempts	Indicates the number of times user can try to login to the system
MinRequiredNonAlphanumericCharacters	Indicates minimum no. of non alpha numeric characters that the user must supply during registration and password change
MinRequiredPasswordLength	Indicates the minimum length required for the password when user registers or changes the password
ChangePasswordQuestionAndAnswer()	Allows to change user's security question and answer
FindUsersByEmail()	Searches user database on the basis of email
FindUsersByName()	Searches user database on the basis of user name
GetNumberOfUsersOnline()	Returns total no. of uses that are signed in
GetUser()	Returns MembershipUser instance representing a specific user
GetUserNameByEmail()	Returns the user name on the basis of email
PasswordAttemptWindow	Indicates the time span for multiple login attempts
PasswordFormat	Indicates the format of password e.g.clear, hashed etc.
PasswordStrengthRegularExpression	Indicates a regular expression to be used to check the strength of password
ResetPassword()	Resets the password
UnlockUser()	Unlocks the user account

In our example we will code the methods and properties marked with * above. The remaining members will simply throw a "Not implemented" exception.

The complete source code of our custom membership provider can be found in the download (MyMembershipProvider.cs). As an example CreateUser() method implementation is given below:

public override MembershipUser CreateUser
(string username, string password, 
string email, string passwordQuestion, 
string passwordAnswer, bool isApproved, 
object providerUserKey, 
out MembershipCreateStatus status)
{
MembershipUser user = new MembershipUser(Name, 
username, providerUserKey, email, passwordQuestion,
 null, isApproved, false, DateTime.Now, DateTime.Now, 
DateTime.Now, DateTime.Now, DateTime.Now);
string sql = "INSERT INTO USERS(USERNAME,PASSWORD,
EMAIL,ISACTIVE) VALUES(@UID,@PWD,@EMAIL,@ISACTIVE)";
db.AddParameter("@UID", username);
db.AddParameter("@PWD", password);
db.AddParameter("@EMAIL", email);
db.AddParameter("@ISACTIVE", 
(isApproved == true ? "Y" : "N"));
int i = db.ExecuteNonQuery(sql);

if (i > 0)
{
status = MembershipCreateStatus.Success;
return user;
}
else
{
status = MembershipCreateStatus.ProviderError;
return null;
}
}

Creating custom roles provider

Creating custom roles provider involves creating a class that inherits from RoleProvider class. The following table lists all the properties and methods that you need to implement (methods are shown with parenthesis).

Property/Method Name	Description
Initialize()*	Receives the connection string name specified in the web.config file. You can use it to perform database operation in your class.
Name*	Represents name of our custom provider
CreateRole*	Create a new role
DeleteRole*	Deletes an existing role
GetAllRoles*	Returns all roles as string array
RoleExists*	Checks if role exists in the database
AddUsersToRoles*	Adds users to specified roles
RemoveUsersFromRoles*	Removes users from specified roles
GetRolesForUser*	Returns all the roles for a specific user
GetUsersInRole*	Returns all the users belonging to a specified role
IsUserInRole*	Checks if a user exists in a specified role
ApplicationName	Name of the web application. This name is used in case you are using a central database for storing membership data of multiple applications
FindUsersInRole	Searches for users belonging to a specified role

In our example we will code the methods and properties marked with * above. The remaining members will simply throw a "Not implemented" exception.

The complete source code of our custom membership provider can be found in the download (MyRolesProvider.cs). As an example CreateRole() method is given below:

public override void CreateRole(string roleName) 
{ 
db.AddParameter("@ROLE", roleName); 
db.ExecuteNonQuery
("INSERT INTO ROLES(ROLENAME) VALUES(@ROLE)"); 
}

Testing our providers

There are four test web forms provided along with the download - Default.aspx, Login.aspx, RoleManager.aspx and UserRoles.aspx. The first two test the membership provider and the later two test the roles provider. We use essentially the same Membership and Roles classes of ASP.NET. These classes in turn call our custom provides to get the job done.

Summary

In this article we saw how easy it is to develop your own providers for membership and role management. You can extend the application to suit your needs. You can also add more security features such as encryption and password strength.