I'm working on a School project and I just started working on the presentation layer.
I want to use the rolemanager that asp.net provides to limit certain pages and elements to certain groups of users.
Now when making the database for everything I already took account for making a table for my users which contains a role,username and password variable.
Now I'm trying to find a way to link these so that I can still use the role limiting functions
My project is in ASP.NET using .NET Framework
Greetings
Related
I am creating a sort of intranet system in ASP.NET that requires me to hide/show/disable/enable certain things depending on the logged on user's role. So far I have been using ASP.NET Membership (what I learned in school) however I am running into problems with having to customize things. We need usernames and passwords but we also need to add custom fields like first name, last name, clearance level (which will be used to set the user's role when they are added) and some arbitrary descriptive fields like employee title and office location.
We're using Microsoft Access (OleDB Connection in ASP) for the bulk of our database needs and we have an employee table that stores all the info we need (like names and clearance levels). I wanted to find a way to link records in those tables to the user that was set up through ASP. We need to be able to create, edit and delete users not through the web configuration tool but through the site we're creating (it will be managed by someone not familiar with ASP). Since ASP Membership uses SQL Server, it is becoming complex for me to try and find a way to connect the user tables generated by ASP and the employee tables created for the project.
I have now read online that there are two other versions of this kind of Membership system: SimpleMembership and Identity. Just by habit I'm leaning towards the most recent iteration (Identity), however I am now reading it is harder to query the user tables for appropriate role info and such.
Which would be the best for a system that has 3 specific roles and must disable/hide specific things depending on the role? And which one would be best for allowing me to create my own Add/Edit/Delete pages for users within the system?
MembershipProvider is depricated and replaced by Asp.Net Identity. Use Identity if this is a new project. Think of migration from MembershipProvider to Identity if it is a brown-field project, but it can take a week of time.
Identity is highly customisable and it is easy to add extra fields on a user and CRUD for users is very easy, especially if you know Entity Framework.
I'm creating an ASP.NET website and intend to have multiple "Applications", each with its own set of users. Effectively I need a way to have different groups that people can register with, so "UserA" can be created in "ApplicationA" and "UserA" can also be created in "ApplicationB". I do not want UserA to be created in all Applications, the user has to feel as though they're creating a separate user account for each application.
I think I can do this with ASP.NET's Membership provider and the Applications table, but I'm having a hard time finding good tutorials on how to do this (searching on "Applications" just leads me to how to create ASP.NET Applications, not how the Applications table relates to the ASP.NET Membership). Can anyone point me in the right direction here?
Yes, you can use ASP.Net Membership for your applications that you have stated.
Please use new ASP.Net Universal Provider. (Membership which generates aspnet_xxx tables is an old one.)
Also make sure to set the following in web.config -
set applicationName (in membership, roleManager) for each appliation.
set machineKey
here is the schema:
http://superpatrick.files.wordpress.com/2007/11/aspnet_membership_schema_updated.png
here is some info about the membership
http://www.asp.net/web-forms/tutorials/security/membership/creating-the-membership-schema-in-sql-server-vb
I have used asp.net so far to create personal web applications, for example, an application where I maintain to-do tasks in an MS SQL Server database or a customer management and support system. I use the basic authentication via web.config where I can create another user who can look and work with such a database, but then all the data is shared between him and me.
But now I want to convert this application into a membership model where a user signs up and will get to use his own personal list of to-do tasks. I can think of the following approach. Please correct me if I'm wrong on some point or if I have missed something.
Steps:
Add a membership user table and use the primary key of this table to access other tables where I will need to add this column, the to-do list in this case.
Next, I will need to write the Login, Signup and User management logic to maintain the user table. Here, I was hoping to find some working samples but all searches give me only ASP.NET MVC membership samples. I don't want to use MVC because I am using third-party asp.net components. As far as I know I can not use MVC with those components. Any links to ready made samples similar to MVC but for asp.net?
I also want the users to be able to login with their google id, dropbox id, etc. Is this possible while having my own login/signup? How does user table change then? Is the Email Address the only data to link up all these things? For example, if someone logs in with google id, I authenticate using Google oauth 2 API but use the email address as the data to add or locate that user to give him his data tables. I'm confused on how this kind of user table looks where all kinds of logins are possible along with a custom one. Any ideas?
http://www.shiningstar.net/ASPNet_Articles/SqlMembershipProvider.aspx
This should help talk you through what you need to do.
I got the exact solution that combines membership with oauth and is built into ASP.NET 4.5. What is more, there is a video that demos it all!
http://www.asp.net/vnext/overview/aspnet/oauth-in-the-default-aspnet-45-templates
Hai,
i am trying to store the user permissions for my web site.But I am little bit confused with xml and Database. For each user in site have different permissions. Have u ever faced this issue? for Example , if my site is a shopping site , for a local user , the report menu need not to display. A sales man need not to display the purchase page. and so on ..
I think you understood my problem .I have done this user management using a xml file . For each user a new node will create according to the menu and keep in the xml file . Next time the user login ,checks the permissions and and show only the allowed menus.
My boss tell me to do the same thing using the Database. by using XmlDataSource it is quite simple to bind data to the treeview (for setting permission) and binding to the menustrip also.
He is pointing the security problem . i don't think like so.
Which is better ? DB or XML
http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx
My advice would be to use asp.net membership and roles (written by Microsoft). It is a very good security solution - login security, roles (permissions) and is stored in a SQLServer database (not sure if it can be stored elsewhere).
I use it on my site and you can use membership controls straight out of the box (login forms, change password, etc.) or you can roll your own.
The only tricky bit I found was setting up the membership tables, views and stored procs in my dB (you download a dB script), but really it was fairly straightforward to implement.
Here's a link to asp.net membership and roles
ASP .NET Membership and Roles (part of the Provider Model introduced on ASP .NET 2) is (IMHO) nice only when you need some basic stuff. The issue is that you need to use the whole system using SQL Server, but if you are planning to move to a different DB provider (MySQL, SQLite, etc..) then you'd have to implement your own provider (which is at best painful), and learn how the whole pieces fit each other. Granted, finding a custom implementation it's quite easy, but is not a copy & paste thing.
Another bad thing of the default provider model is that you will get a ton of SQL stored procedures, also called maintainance nightmares. The issue is that if your site scales, then these SP's will make your life a living hell (been there) and if you even dare to change hostings then you're in for a treat, so my advice would be make your own permissions hierarchy and use it the way you wish. Also, look for advices and some pre-existing solutions to the permissions problem which is quite common.
Website security can be split up into to distinct parts.
Authentication: Logging in
Authroization: Roles/Permissions.
The ASP.NET Forms Authentication Provider is a great way to implement authentication. I recently created a custom provider that communicates with our companies X500 directory (LDAP). It was very straight forward.
For Authorization, we implemented the entlib security application block. It allows you to keep Roles/Permissions in a separate location that can be accessed by your UI as well as your service layers (assuming your developing a scale-able solution). You may also want to look at the Windows Itentity Foundation which is slated to supersede entlib security application block, however it is only available for .NET 4.0.
I am trying to make an asp.net website using Visual web dev and C# that accesses data in an SQL database. For my site, I need to be able to save and access additional user properties such as age and gender. I have been playing around with the built in .NET Login tools but I don't understand how to keep track of the additional properties (age, gender...) I could store all the users information in my own database but how do I correlate the users data in my DB to the usernames in the member database that is automatically created?
Probably profiles are perfect and quite easy to use for your purpose. ASP.NET manages the relation between users and their associated profile data (which you can customize for your needs) quite comfortable. Here is short introduction video:
http://www.asp.net/learn/videos/video-44.aspx
Are you using an ASP.NET website project or web application project? The video (and most information in MSDN) is related to website projects. For web applications there are some complications to take into account when you use profiles.
(Some hints if you are using a web application project:
How to assign Profile values?
If you are using an website project you can ignore this)
As Slauma said ASP.Net Profiles is a great way to do this using the Membership API.
But I don't like the way profiles use delimited list serialized in the database, and I've heard reports of speed issues under heavy load.
I Use Membership API on just about all applications, except for the profile bit.
To store user profiles, you can create a separate table. Maybe called 'UserProfile'. Add a column with a unique index for 'username' and/or 'email'. Which ever you treat as the user's username. Now you can use that column to pull profile information at runtime.
As a bonus, if you use an ORM like Entity framework, you can now write simple LINQ queries to pull your user information.