Custom Role mebership provider

Question

1.00/5 (1 vote)

See more:

We are trying to implement Role membership provider for securing our web application. We will be creating custom Role memebership provider as we already have our Ingres database containing all the required tables.
What we need to accomplish is along with Role we want another field let's say FacilityID to determine what all a logged on user can access in the application. How can we fit in this additional condition in Role membership model. Will a custom Profile provider be any help to us?
Any suggestion or related links would be helpful.

Posted 20-Apr-10 6:04am

sspjb

Add a Solution

4 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Gregory Gadow · Answer 1 · 2010-04-20T06:30:00

I had to do something similar a few years ago. We ended up implementing custom versions of MembershipProvider, MembershipUser and RoleProvider, all found in the System.Web.Security namespace.

Keep in mind that these are just classes. As with any inheritable class, your derived classes can add any method or property that you want. The constructor on our user class, for example, retrieves information about the user's roles and saves them as a list within the object; this allowed us to implement properties like HasAdministratorRole, which makes security checking very easy. We also implemented methods like LockUser and UnlockUser, which encapsulate calls to the membership provider to cancel or allow web access.

Exactly how you implement the new properties will depend a lot on your particular security model and needs, I can't really offer any advice on that. One book I found useful (still on my shelf although obviously out-dated) is "Pro ASP.NET 2.0 in VB 2005" by Laurence Moroney and Matthew MacDonald. That, and a lot of trial and error. X|

Good luck.

sspjb · Answer 2 · 2010-04-22T08:16:00

Thanks for the reply. Can you please elaborate on the role provider functionality you had implemented.

Gregory.Gadow: The entire class is 596 lines, which is a bit long to simply post. But basically....

We set up three tables in our Web database: WebUsers, WebRoles and WebUserRoles. Each user has a single entry in WebUsers. Each role has a single entry in WebRoles. WebUserRoles holds a list of what roles each user has; for example, I have three entries in that table, which allows me in the roles of Administrator, Publisher and FieldRep.

The class is written in VB.Net for the 2.0 framework and inherits from System.Web.RoleProvider. I overrode everything except the Description and Name properties to guarantee that I would have access to all the functionality I might need: the code access the web tables to do things like create and delete roles, add users to and remove them from roles, see if a given user has a given role, get a list of all roles that a given user has, and so on. Overriding the Initialize method allows me to put configuration info in the web.config file and read it out when an instance of the class is started.

Mind you, we set up our own web user management system, which allowed us to set up only what we needed and implement it exactly as we wanted. That greatly simplified my work, but it also meant we could not use Microsoft's web user management tools. If you want to use those tools, you will need to track down some scripts from Microsoft (I don't remember where they are, sorry) that you can run to set up your database to meet Microsoft's requirements.

sspjb · Answer 3 · 2010-04-22T10:56:00

So essentially we have to add our own methods to be able to accomplish additional condition for fetching user's role per facility.

Also the application we are implementing will be a kind of centralized security application. So a user trying to access any application will first be redirected to this security application and on successful authentication will be redirected to respective app. So we have to do all the exception handling here so that there is no additional code required in the individual web apps. If you have any refrence kindly let me know.
Thanks again!

gmtzgtz · Answer 4 · 2011-10-13T14:37:00

Solution 4

This post may help:

http://willmtz.blogspot.com/2011/09/using-aspnet-profile-feature-in-web.html[^]

Posted 13-Oct-11 14:37pm

gmtzgtz

Comments

fjdiewornncalwe 19-Oct-11 13:52pm

The question is a little old to be getting a new answer now. Please refrain from answering old questions like this in the future.

Custom Role mebership provider

4 solutions

Solution 1

Solution 2

Solution 3

Solution 4

Add your solution here

Preview 0