Membership, Roles and Profile - An Example (Part 1)

Introduction

The new membership, roles and profile features introduced in ASP.NET 2.0 significantly reduce development time that is otherwise spent in traditional approaches. Securing your web site by implementing a flexile membership scheme backed with role based security is required in many professional web sites. In this article series we are going to see these features in action with the help of an example.

Example Scenario

Let's assume that we want to develop a security and membership scheme for a professional web site. We want to capture the following details about the user:

• UserID
• Password
• Email
• Security Question
• Security Answer
• Full Name
• Birth Date
• Yearly Salary
• Address

The web site has three roles - NormalUsers, PowerUsers and Administrators. When a user registers with the web site by default he is assigned to NormalUsers role. Later on the administrator may add him to any other role. Whenever anybody tries to access the web site, the user should be asked for User ID and password. Upon supplying a correct User ID and Password the user should be taken to the main page of the web site. Depending upon the role of the user the content of the main page is rendered.

Steps required

In order to meet our requirement we will use ASP.NET 2.0 Membership, Roles and Profile features. The overall steps required in fulfilling our requirements are as follows:

• Configure a SQL Server database to store membership, roles and profile data
• Configure Membership, Roles and Profile providers for the web site
• Create roles in the system
• Create a registration page that will capture above details from the user
• Create a login page
• Create the main page with content

Configure a SQL Server database

In order to store Membership, Roles and Profile data in a SQL Server database we must configure it using aspnet_regsql.exe command line tool. The tool starts a wizard that guides you through the steps. The tool creates certain tables and stored procedures in the database that are used by these features. Figure 1 and Figure 2 shows the main steps of this tool.

Figure 1

Figure 2

The step indicated by Figure 1 allows us to configure the database for membership, roles and profile services. The same step can be used if at all we decide to remove the services for some reason. The step indicated by Figure 2 allows us to specify the database that is to be configured.

Though not mandetory it would be interesting to know the tables used by these features. The following table lists the tables used by membership, roles and profile features respectively.

Configure Membership, Roles and Profile providers for the web site

once you configure the database the next step is to configure membership, roles and profile providers for your web site. In order to do so open the web.config file and add the following markup in it:

<connectionStrings>
<add name="connstr" connectionString="data source=
.\sqlexpress;initial catalog=northwind;
integrated security=true"/>
</connectionStrings>

<system.web>
<authentication mode="Forms">
<forms loginUrl="login.aspx"></forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>

<membership defaultProvider="provider1">
<providers>
<add name="provider1" connectionStringName="connstr" 
type="System.Web.Security.SqlMembershipProvider"/>
</providers>
</membership>

<roleManager enabled="true" defaultProvider="provider2">
<providers>
<add name="provider2" connectionStringName="connstr" 
type="System.Web.Security.SqlRoleProvider"/>
</providers>
</roleManager>

<profile defaultProvider="provider3">
<providers>
<add name="provider3" connectionStringName="connstr" 
type="System.Web.Profile.SqlProfileProvider"/>
</providers>
<properties>
<add name="FullName"/>
<add name="DOB" type="System.DateTime"/>
<add name="Salary" type="System.Double"/>
<group name="Address">
<add name="Street"/>
<add name="Country"/>
<add name="State"/>
<add name="PinCode"/>
</group>
</properties>
</profile>

The markup consists of various sections.

• The <authentication> section configures our web site to use Forms based authentication
• The <authorization> section denies access to anonymous users
• The <connectionStrings> section stored the connection string to the Northwind database. This connection string is used by other tags such as <membership> and <roleManager>
• The <membership> tag configure the membership provider used by our web site. Through this tag ASP.NET knows about the data store used by our web site for membership data
• The <roleManager> tag configure the role provider used by our web site. Through this tag ASP.NET knows about the data store used by our web site for roles related data
• The <profile> tag configure the profile provider used by our web site. Through this tag ASP.NET knows about the data store used by our web site for profile data. The <properties> sub section of this tag specifies the profile properties and groups. Observe how the data type of certain properties is mentioned via type attribute. Note that the user information is captured partly by the membership features (User ID, Password, Email, Security Question, Security Answer) and partly by Profile features (Full Name, Birth Date, Salary, Address)

Creating roles

In order to create roles needed by our application, we will use Web Site Administration Tool accessible via WebSite > ASP.NET Configuration menu option.

Figure 3 shows the Security tab of this tool.

Figure 3

As you can see the Roles section allows you to create or manager roles of the web site. Figure 4 shows the roles created using this tool.

Figure 4

Creating a user registration page

Traditionally developers used to create a user registration page by assembling various controls such as TextBoxes, DropDownLists and Buttons. Fortunately ASP.NET 2.0 comes with a control called CreateUserWizard that simplifies the job. This control not only provides readymade registration functionality but also allows you to customize it. In our example the first five pieces about a user i.e. User ID, Password, Email, Security Question and Security Answer are collected by the control out of the box. In order to collect the remaining pieces we need to customize the control by adding our own "Wizard Step".

Proceed by adding a new web form called Login.aspx. Drag and drop a CreateUserWizard control on it. From the smart tags select "Add/Remove wizard steps" to open a dialog as shown in Figure 5.

Figure 5

Add a new "Templated Wizard Step" using Add button and set its Title property to "User Profile" and StepType property to Step. Now design the step as shown in Figure 6.

Figure 6

The template consists of TextBoxes and RequiredFieldValidator controls for accepting extended user information (profile). After you finish designing the template add the following code in NextButtonClick event handler of the CreateUserWizard control. This event is raised when the user click on any Next button.

protected void CreateUserWizard1_NextButtonClick
(object sender, WizardNavigationEventArgs e)
{
if (e.CurrentStepIndex==1)
{
TextBox t;

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox1");
Profile.FullName = t.Text;

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox2");
Profile.DOB = DateTime.Parse(t.Text);

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox3");
Profile.Salary = double.Parse(t.Text);

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox4");
Profile.Address.Street = t.Text;

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox5");
Profile.Address.Country = t.Text;

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox6");
Profile.Address.State = t.Text;

t = (TextBox)CreateUserWizard1.ActiveStep.
Controls[0].FindControl("TextBox7");
Profile.Address.PinCode = t.Text;
}

}

Here, we check the index of the current step via CurrentStepIndex property of WizardNavigationEventArgs class. Inside the if condition we get reference to each TextBox with the help of FindControl() method. The value entered in the textBox is then assigned to the corresponding profile property. Note that the profile properties that you specified in the web.config file appear as properties of the Profile object.

We want that initially all the users be part of NormalUsers role. This is done by handling CreatedUser event of the CreateUserWizard control.

protected void CreateUserWizard1_CreatedUser
(object sender, EventArgs e)
{
Roles.AddUserToRole(CreateUserWizard1.UserName
, "NormalUsers");
}

Here, we used AddUserToRole() method of the Roles object to add the current user to NormalUsers role. The user name is retrieved via UserName property of CreateUserWizard control.

Finally, set the ContinueDestinationPageUrl property of CreateUserWizard control to Default.aspx.

That's it! You can now run the Login.aspx and create new users in the system using the CreateUserWizard control.

In the next part we will see:

• How administrator can assign users to one or more roles.
• How users can login to the web site.
• How to develop Default.aspx that shows content for different roles.

Till then stay tuned!