Chapter 13 from my book, Core Internet Application Development with ASP.NET 2.0

1. Chapter 13 Security, Membership, and Role Management If thou be’st not immortal, look about you: security gives way to conspiracy. The mighty gods defend thee! William Shakespeare, Julius Caesar, Act II, Scene 3

17. Trust Levels No capability to interact with resources. Intended for sites with little dynamic content. Minimal Models a read-only application because no network access to other servers is allowed. Low Permissions are limited to what the application can access in its own folder structure. Thus, although a medium trust application can access a SQL Server database, it cannot access files or folders outside its own virtual directory hierarchy. As well, it has no reflection permissions, so those applications that require reflection (such as the typical object/relational mapper) may not work. Intended to be used for hosting environments that contain multiple customers’ sites. Medium Code can use most of the .NET Framework. The limitations are no unmanaged code, no enterprise services, and limited use of reflection. High The application is fully trusted. All .NET code is allowed to run and thus any .NET classes can be used (however, still subject to operating system and Windows ACL limitations). This is the default. Full Description Trust Name

20. Forms Authentication <system.web> … <authentication mode=&quot;Forms&quot; > <forms loginUrl=&quot;Login.aspx&quot; /> </authentication> <authorization> <deny users=&quot;?&quot;/> </authorization> </system.web>

25. How does it work?

29. Provider Model

31. Provider-based Services Manages the special set of controls for creating Web sites that enable end users to modify the content, appearance, and behavior of Web pages directly within the browser. Web Parts Used by ASP.NET health monitoring subsystem that allows the monitoring of a Web application. Web events Provides a description of a site’s structure. Site map Maintains user state between requests. Session state Handles role-based security. Role management Manages user preferences and user information across visits. Profile Manages user accounts. Membership Handles encryption and decryption of sections of the ASP.NET configuration files. Encryption Description Service

32. Provider Classes

35. WAT

37. Membership Class Returns true if the specified user name and password are valid (i.e., exist in the data store). ValidateUser Updates the data source with the information contained in the specified MembershipUser object. UpdateUser Returns the user name for the specified email. GetUserNameByEmail Returns a MembershipUser object for the current logged on user. GetUser Gets the number of users that is currently accessing the application. GetNumberOfUsersOnline Returns a MembershipUserCollection of all users. GetAllUsers Generates a random password of the specified length. GeneratePassword Returns a MembershipUserCollection of users whose user name matches the passed user name. FindUsersByName Returns a MembershipUserCollection of users whose email matches the passed email. FindUsersByEmail Deletes an existing user from the membership data store. DeleteUser Adds a new user to the membership data store. CreateUser Description Name

40. Login Controls Allows user passwords to be retrieved and sent to the email for that account. PasswordRecovery Displays one of two possible interfaces: one for authenticated users and one for anonymous users. LoginView Displays a login link for nonauthenticated users and a logout link for authenticated users. LoginStatus Displays the name of the authenticated user. LoginName Displays a customizable user interface for gathering user credentials. Login Based on the Wizard control covered in Chapter 4. A multistep process for gathering the user name, password, email address, and password question and answer. CreateUserWizard Lets users change their password. ChangePassword Description Name

41. Login Control <asp:Login ID=&quot;logSignin2&quot; runat=&quot;server&quot; TextLayout=&quot;TextOnTop&quot; CssClass=&quot;loginStyle&quot;> <TitleTextStyle CssClass=&quot;loginTitle&quot; /> <InstructionTextStyle Font-Italic=&quot;True&quot; ForeColor=&quot;Black&quot; /> <TextBoxStyle Font-Size=&quot;0.8em&quot; /> <LoginButtonStyle CssClass=&quot;buttonStyle&quot; /> </asp:Login>

43. LoginName and LoginStatus Controls <asp:LoginName ID=&quot;logName&quot; runat=&quot;server&quot; FormatString=&quot;Welcome {0}&quot; /> <asp:LoginStatus ID=&quot;logStat&quot; runat=&quot;server&quot; LoginImageUrl=&quot;images/btn_login.gif&quot; LogoutImageUrl=&quot;images/btn_logout.gif&quot; LogoutAction=&quot;Refresh&quot; />

45. LoginView Controls <asp:LoginView ID=&quot;logView&quot; runat=&quot;server&quot;> <AnonymousTemplate> <strong>For more features</strong><br /> <asp:LoginStatus ID=&quot;logStat&quot; runat=&quot;server&quot; LoginImageUrl=&quot;images/btn_login.gif&quot; LogoutImageUrl=&quot;images/btn_logout.gif&quot; LogoutAction=&quot;Refresh&quot; /> </AnonymousTemplate> <LoggedInTemplate> <strong>Rate this book</strong><br /> <asp:RadioButtonList ID=&quot;radList&quot; runat=&quot;server&quot;> <asp:ListItem Selected=&quot;true&quot;> No Rating</asp:ListItem> <asp:ListItem> <img src='images/stars1.gif'/></asp:ListItem> <asp:ListItem> <img src='images/stars2.gif'/></asp:ListItem> <asp:ListItem> <img src='images/stars3.gif'/></asp:ListItem> <asp:ListItem> <img src='images/stars4.gif'/></asp:ListItem> <asp:ListItem> <img src='images/stars5.gif'/></asp:ListItem> </asp:RadioButtonList> <asp:Button ID=&quot;btnRate&quot; runat=&quot;server&quot; Text=&quot;Rate Book&quot; /> </LoggedInTemplate> </asp:LoginView>

47. ChangePassword <asp:ChangePassword ID=&quot;chngPass&quot; runat=&quot;server&quot; CssClass=&quot;passChangeStyle&quot; > <CancelButtonStyle CssClass=&quot;buttonStyle&quot; /> <ChangePasswordButtonStyle CssClass=&quot;buttonStyle&quot; /> <ContinueButtonStyle CssClass=&quot;buttonStyle&quot; /> <TitleTextStyle CssClass=&quot;titleStyle&quot; /> <TextBoxStyle CssClass=&quot;textboxStyle&quot; /> </asp:ChangePassword>

49. PasswordRecovery <asp:PasswordRecovery ID=&quot;passRec&quot; runat=&quot;server&quot; CssClass=&quot;passRecovStyle&quot;> <InstructionTextStyle CssClass=&quot;instructionStyle&quot; /> <SuccessTextStyle CssClass=&quot;instructionStyle&quot; /> <TextBoxStyle CssClass=&quot;textboxStyle&quot; /> <TitleTextStyle CssClass=&quot;titleStyle&quot; /> <SubmitButtonStyle CssClass=&quot;buttonStyle&quot; /> <MailDefinition From=&quot;abc@abc.net&quot; Subject=&quot;Password Recovery&quot; /> </asp:PasswordRecovery>

51. CreateUserWizard Control <asp:CreateUserWizard ID=&quot;createUser&quot; runat=&quot;server&quot; … > <WizardSteps> <asp:WizardStep > … </asp:WizardStep> <asp:WizardStep > … </asp:WizardStep> </WizardSteps> </asp:CreateUserWizard>