Chapter 13: Security and User Authentication

At this point, if you experimented with the auto-generated ASPNETDB database, you can delete the two database files, aspnetdb.mdf and aspnetdb_log.ldf, from your application’s App_Data folder.4

If you’re curious, open the Dorknozzle database using the tool of your choice to see the new tables that have been created—they’re shown in Figure 13.9. You’ll notice your database now has 11 new tables whose names start with aspnet.

Figure 13.9. Membership tables in Dorknozzle

Using the ASP.NET Web Site Configuration Tool

After making the configuration changes we mentioned earlier, run the ASP.NET Web Site Configuration Tool and click the Security tab again. If you look into the App_Data folder, you’ll notice that the tool did not create the ASPNETDB database. Instead, it’s using the Dorknozzle database.

4 It’s interesting to note that if your application isn’t using the ASPNETDB database, you’re free to simply delete its files. This is possible because, as explained earlier, ASPNETDB is a User Instance database, the files of which are opened and read only when needed.

552

Using the ASP.NET Web Site Configuration Tool

Before you start to add users and roles, it’s worth taking a look around. While you’re viewing the Security tab, click the Select authentication type link. You’ll see two options:

From the Internet

You would normally have to select this option to enable forms authentication, but since you have already selected that type of authentication by editing your application’s Web.config file, you’ll find this option is already selected. However, in future, you might want to use this tool to set your preferred authentication type, instead of editing the file manually.

From a local network

Had we not specified forms authentication in the Web.config file, this option, which selects Windows authentication—ASP.NET’s default—would have been selected instead. If you were to re-select this option at this stage, the tool would remove the <authentication> tag from your Web.config file, restoring the default setting.

Leave the From the Internet option selected, and click Done to return to the Security tab.

The Provider tab allows you to change the data provider that’s used to store the security data. Currently, you can only choose AspNetSqlProvider, which uses SQL Server to store the membership data.5

The Application tab shown in Figure 13.10 lets you create and manage application settings in the form of name-value pairs that will be stored in the Web.config file. For example, you might want to add a setting named AdminEmail that contained an email address that could be used by your application to send important administration messages.

We’ve already learned to use Web.config to store connection strings within a dedicated <connectionStrings> tag. Similarly, ASP.NET supports an <appSettings> tag in the same file for the purpose of storing general application settings.

If you click Save, the administration tool will store the setting in your application’s

Web.config file:

<configuration

xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">

5 Pre-release versions of ASP.NET 2.0 also supported the use of Access databases, but that feature was later replaced with support for the ASPNETDB disconnected database.

553

Chapter 13: Security and User Authentication

Figure 13.10. Creating an application setting

<appSettings>

<add key="AdminEmail" value="[e-mail]" />

</appSettings>

To access this data, you need to use the ConfigurationManager class, which is located in the System.Configuration namespace, like this:

Visual Basic

adminEmail = ConfigurationManager.AppSettings("AdminEmail")

C#

adminEmail = ConfigurationManager.AppSettings["AdminEmail"];

Creating Users and Roles

Open the ASP.NET web site, click the Security tab, and click Enable Roles under the Roles section. This will add the following line to your Web.config file:

554

Creating Users and Roles

File: Web.config (excerpt)

<roleManager enabled="true" />

Two new links will appear under Roles: Disable Roles, and Create or Manage Roles. Click Create or Manage Roles, and use the form shown in Figure 13.11 to create two roles: one named Users, and another named Administrators.

Figure 13.11. Creating roles

555