In ASP.Net MVC, are the Forms Authentication and Membership Provider tightly coupled?
The Membership provider model is very different than the existing user validation services that I already have that I need to integrate with. I would like to write my own class to manage users, but still use the built in forms authentication and forms cookie to allow a logged-in user to access authenticated sections of the website.
Can I just delete the reference to the MemberShipProvider from web.config and call my own custom class from the controller I use to validate users? Will Forms Authentication still work?
You can either create a custom membership provider as #negadro mentioned or just call the SetAuthCookie after your custom validation.
//your custom validation logic here
FormsAuthentication.SetAuthCookie(userName, rememberMe);
You can create custom membership provider. This answer will help you , i think. How do I create a custom membership provider for ASP.NET MVC 2
Related
I'm trying to implement role based authentication, in my AuthController I have retrieved the user's Windows username and checked it against the database users table to find their record, now that I have found their role I want to assign it to them so that they can access protected routes. What is the simplest way to achieve this?
Right now all I am doing in the AuthController is setting their auth cookie.
The best and correct way is to use ASP.NET MVC Identity Framework. It is designed to handle authentication and authorization of MVC apps. It supports role based auth. You can start from here.
I got MVC 5 application Using asp.net identity for authentication works fine.
I want my MVC 5 application to use authentication from an already existing application with Traditional Asp.net authentication
I want Existing Traditional Asp.net authentication application to be used as single Sign-on and mvc application to use auth cookie
Sure you can.
You can create your own custom ApplicationUser (IdentityUser) and also create your own UserStore that implements the IUserStore interface.
Just check out the default ApplicationUserManager in the first line of the Create function you will see that ApplicationManager get constructed with a new UserStore. There you can plug in your custom User & UserStore.
Here is some good info.
http://www.asp.net/identity/overview/extensibility/overview-of-custom-storage-providers-for-aspnet-identity
I believe you should be able to use the old FormsAuthentication module in MVC5 application.
http://joeylicc.wordpress.com/2013/07/15/forms-authentication-in-asp-net-mvc/
Just make sure to redirect unauthorized requirest to your original login page.
when working with Asp.net MVC. Why we need to register membership provider in the web.config file ?
Membership providers provide the interface between Microsoft ASP.NET's membership service and membership data sources.
The fundamental job of a membership provider is to manage the data regarding a site's registered users, and to provide methods for creating users, deleting users, verifying login credentials, changing passwords, and so on. The Microsoft .NET Framework's System.Web.Security namespace includes a class named MembershipUser that defines the basic attributes of a membership user, and that a membership provider uses to represent individual users.
You willhave more information here Membership provider
Thanks
I am developing an asp.net mvc application and have created my custom user database and registration procedure (need email verification). Can I use FormsAuthentication.SetAuthCookie with my own login procedure, without dealing with asp.net's membership provider? Will doing so work with the [Authorize] attribute?
Yes, you can use FormsAuthentication.SetAuthCookie within your own login procedure, in fact, that's what the default asp.net mvc template uses.
[Authorize] will work since FormsAuthentication.SetAuthCookie populates HttpContext.User.Identity.IsAuthenticated to true.
I'm new to the ASP.NET world. Since I want to use the ORM it seems I would want an Entity to represent the User or Member or whatever, not some data tucked away by the forms authentication api. In fact I don't see how I can live without one.
How do people deal with this? Roll your own authentication? Or is there a best practice for incorporating forms authentication with the Entity Framework?
In short, since I need a User and Role Entity for queries anyway, should I skip the forms auth or find a way to use it?
Thanks
EF and Forms Auth are really two different areas. You can use Forms Auth without ASP.NET Membership very easily and roll your own provider with very little effort.
This tutorial will show you how:
http://msdn.microsoft.com/en-us/library/ms172766(VS.80).aspx
With ASP.NET MVC you should really use standard Auth since you can manage access to controllers using attributes for Roles very easily.
FormsAuthentication on its own does not care about the identity store and can validate only credentials stored in the web.config <credentials> section, through the Authenticate method. Standard implementations of the login page use the static Membership class to manage the identities and credentials in the MembershipProvider specified in the config file (usually SqlProfileProvider).
However, you don't have to use the membership provider functionality of ASP.NET to maintain your identities and you can still use FormsAuthentication just fine. The forms authentication control flow shows that forms authentication deals primarily with creating and maintaining the auth ticket for the user in a cookie. It does not deal with the user identity or profile itself, as it does not care about those.
Thus, you can safely use EF to maintain your user profiles, including credentials and do authentication of the provided credentials in your login page, while still using FormsAuthnetication.