ASP.NET Managing Membership and Roles Page - 3

The ProviderBase Class

The ProviderBase class has only one method—Initialize method and one Property Name. This method takes the name of the provider and a name/value collection object is packed with the content of the provider’s configuration section. It initializes the internal state with the values read out of the Web.config file.

The MembershipProviderBase Class

Many of the properties of the MembershipProvider class are implemented by calling a corresponding method or property in the MembershipProviderBase class. All these methods are abstract virtual methods and must be overridden or must be inherited by the MembershipProvider class.

ChangePassword, ChangePasswordQuestionAndAnswer, CreateUser, DeleteUser, FindUsersByEmail, FindUsersByName, GetAllUsers, GetNumberOfUsersOnline, GetPassword, GetUser, GetUserNameByEmail, ResetPassword, UpdateUser and ValidateUser are some of the methods available in the MembershipProviderBase Class. The functionalities exposed by these methods are indicated in the names of the methods themselves. Additonally certain properties are exposed by the MembershipProviderBase class. ApplicationName, EnablePasswordReset, EnablePasswordretrieval, RequiresQuestionAndAnswer are the properties that can be set by the developer. Additional information is also stored with the user by the Provider.

A custom class can be developed from MembershipUser to add users and return an instance of the class using the GetUser method of the membership API. Custom membership providers also can add new users and new custom members.

The Providers collection is the key property for authentication of users with dynamically selected providers. Multiple providers can be supported and different providers can be used for different users.

As mentioned earlier in this tutorial ASP.NET 2.0 comes with its own built in providers—AccessMembershipProvider and SqlMembershipProvider.

The SqlMembershipProvider provides access to all the SQL Server syntax including stored procedures. Multiple applications can use the same database or each application can be set to manage its own database.

All configuration information about the Membership provider is stored in the section of the Web.config file. A number of child < providers > elements are configured under individual provider. The < membership > section supports some attributes such as defaultProvider and UserIsOnlineTimeWindow. What ever the type of data stored, whatever the type of database, a connection string will be needed. The ConnectionStringName attribute points to the configuration for it in the Web.config file where the providers are listed.

Ads

Managing Roles

Applications need to restrict different users to different sections and prevent all users from performing all activities. Authorization is nothing but the process of assigning rights to users. ASP.NET regards roles as a plain string that refers a logical role to the user. Each user can be assigned multiple roles. This information is attached to the identity object and the application code checks authorization the moment the user is successfully authenticated.

The Role manager feature of ASP.NET maintains the relationship between users and their roles or the roles can be defined programmatically by the developer. The easiest method of configuring roles is the Web Application Administration tool. Let us assign roles using the tool.

1. Navigate to Website menu option
2. Click on ASP.NET configuration
3. Click on Security tab and then on Create Roles and enter the names of the roles to be created.
4. In this instance the User Role and the Admin Role has been created.

5. Now the rights of the roles can be configured. At runtime the logged in information about the user becomes available by user object.

6. The Admin is assigned all roles while the user role is denied some roles.

The Role Class

An instance of the Role class is created when the Role management is enabled.. An instance of the Role class is added to the current Httpcontext object. The roles class has an number of methods. AddUserToRole adds an arrary of users to a role.

AddUsersToRoles adds an array of users to multiple rows.
AddUserToRole adds one user to the role.
AddUserToRoles adds an user to multiple roles.
CreateRole create a new role.
DeleteCookie deletes the cookie that the role manager used to cache all the role data.
DeleteRole deletes the role.
FindUsersInRole returns a string array with the names of users in a role. The username matches a specified name.
GetAllRoles returns all the available roles.
GetRolesForUser gets the role assigned for a specified user.
GetUsersInRole returns a string array listing the users that belong to a particular role. RemoveUsersFromRole removes user from role.
RemoveUserFromRole removes a user from the role assigned.
RemoveUsersFromRole removes multiple users from a role.
RemoveUsersFromRole removes multiple users from a role.
RoleExists returns true if the specified role exists.