Custom membership provider in web Applications - asp.net

Question

I need to implement my own custom provider for Membership in my web application. After implementing it partially successfully, I am looking for answers on below question:
Which all function I need to override in my application
Which all classes i need to inherit from. So far I used classes: MemberShipProvider, RoleProvider.
Can the ASP.NET automatically connect to the correct table of my database. Is there any settings for this? like specifying the default table name ?
Is there any Builtin function for setting the password as Salted Hash? OR I need to implement this on my own?
the WAT Tool will be helpful for me still OR it will be limited in functionality, As i found that it may atleast help in debugging?
I found that some function i've missed to override and also I think I did same with RoleProvider also. If there is any complete list OR so.. that's bound to help me

Answer 1

1) Which all function I need to override in my application
You mainly need to override GetUser and ValidateUser in order for Membership Provider to work with Login Control. The rest are optional.
public class CustomMembershipProvider : MembershipProvider
{
public override MembershipUser GetUser(string username, bool userIsOnline)
{
throw new NotImplementedException();
}
public override bool ValidateUser(string username, string password)
{
throw new NotImplementedException();
}
}
2) Which all classes i need to inherit from. So far I used classes:
MemberShipProvider, RoleProvider.
MembershipProvider is a must. If you want to authorize a user by roles, you need to implement RoleProvider.
3) Can the ASP.NET automatically connect to the correct table of my
database. Is there any settings for this? like specifying the default
table name ?
The reason you are overriding Membership Provider is you want to work with custom tables that you created. You are in charged of returning data from database; Membership provider no longer requires to know the name of your tables. Therefore, the answer is No - there is no setting.
4) Is there any Builtin function for setting the password as Salted Hash?
OR I need to implement this on my own?
Here are the methods that Membership Provider uses to generate hash password -
private static string GenerateSalt()
{
byte[] numArray = new byte[16];
(new RNGCryptoServiceProvider()).GetBytes(numArray);
string base64String = Convert.ToBase64String(numArray);
return base64String;
}
private string EncodePassword(string pass, int passwordFormat, string salt)
{
byte[] numArray;
byte[] numArray1;
string base64String;
bool length = passwordFormat != 0;
if (length)
{
byte[] bytes = Encoding.Unicode.GetBytes(pass);
byte[] numArray2 = Convert.FromBase64String(salt);
byte[] numArray3 = null;
HashAlgorithm hashAlgorithm = HashAlgorithm.Create(Membership.HashAlgorithmType);
if (hashAlgorithm as KeyedHashAlgorithm == null)
{
numArray1 = new byte[(int) numArray2.Length + (int) bytes.Length];
Buffer.BlockCopy(numArray2, 0, numArray1, 0, (int) numArray2.Length);
Buffer.BlockCopy(bytes, 0, numArray1, (int) numArray2.Length, (int) bytes.Length);
numArray3 = hashAlgorithm.ComputeHash(numArray1);
}
else
{
KeyedHashAlgorithm keyedHashAlgorithm = (KeyedHashAlgorithm) hashAlgorithm;
if (keyedHashAlgorithm.Key.Length != numArray2.Length)
{
if (keyedHashAlgorithm.Key.Length >= (int) numArray2.Length)
{
numArray = new byte[(int) keyedHashAlgorithm.Key.Length];
int num = 0;
while (true)
{
length = num < (int) numArray.Length;
if (!length)
{
break;
}
int num1 = Math.Min((int) numArray2.Length, (int) numArray.Length - num);
Buffer.BlockCopy(numArray2, 0, numArray, num, num1);
num = num + num1;
}
keyedHashAlgorithm.Key = numArray;
}
else
{
numArray = new byte[(int) keyedHashAlgorithm.Key.Length];
Buffer.BlockCopy(numArray2, 0, numArray, 0, (int) numArray.Length);
keyedHashAlgorithm.Key = numArray;
}
}
else
{
keyedHashAlgorithm.Key = numArray2;
}
numArray3 = keyedHashAlgorithm.ComputeHash(bytes);
}
base64String = Convert.ToBase64String(numArray3);
}
else
{
base64String = pass;
}
return base64String;
}
5) the WAT Tool will be helpful for me still OR it will be limited in
functionality, As i found that it may atleast help in debugging?
Yes, you can still use website administration tool, but it depends on those methods that you override.
For example, if you do not override role provider, assigning a user to a role won't work.
http://www.asp.net/general/videos/how-do-i-create-a-custom-membership-provider
http://www.davidhayden.com/blog/dave/archive/2007/10/11/CreateCustomMembershipProviderASPNETWebsiteSecurity.aspx
http://www.shiningstar.net/aspnet_articles/customprovider/CustomProvider.aspx
http://www.devx.com/asp/Article/29256/0/page/3
http://www.15seconds.com/issue/050216.htm
http://www.codeproject.com/KB/aspnet/CustomMembershipProviders.aspx
http://www.codeproject.com/KB/aspnet/WSSecurityProvider.aspx