Asp.Net 2.0 Security : Users, Roles, Profiles - Felix John COLIBRI.

• abstract : Asp.Net 2.0 offers a vaslty improved support for handling security: new Login Controls, and services for managing Users, grouping Users in Roles, and storing User preferences in Profiles
  
• key words : Asp.Net 2.0 Security - Membership - Roles - Profiles - security Providers - Blackfish - CLASS HELPERs
  
• software used : Windows XP Home, Rad Studio 2007 (build 2852.9797)
  
• hardware used : Pentium 2.800Mhz, 512 M memory, 140 G hard disc
  
• scope : Rad Studio 2007
  
• level : Delphi Web developer
  
• plan :
  
  • Membership, Roles, Profiles
    
  • Basic Asp.Net 1.x Security
    
  • Membership and User Management
    
  • Authorization and Roles
    
  • Asp.Net 2.0 Profiles
    
  • Download The Security Source Code
    

1 - Introduction

The User management tasks are quite obvious for message boards, social network sites, web portals, or eCommerce.

The site management must include user accounts, and ways to authenticate the incoming User (check who he really is) and define which resources he should be allowed to get access to.

Asp.Net 1.x already had defined how to authenticate and authorize Users. But all the User management, the Login interface, the storing of those informations had to be coded by the developer.

Asp.Net 2.0 takes a big step forward by including

• User management
  
• the specification of Roles (groups of Users for authorization purposes)
  
• handling of Profiles (personal User properties)
  

• dedicated web controls for handling the most obvious tasks (Login, changing the password etc)
  
• default behaviour specified by parameter files
  
• programmatic support for handling more specific cases
  

2 - Basic Asp.Net 1.x Security

2.1 - Authentication

2.1.1 - Authentication Steps

• in all the pages for which we want to check the user credentials, including eventually the Default.Aspx, we check whether the User is authenticated. This is usually performed in OnPageLoad:

  procedure TDefault.Page_Load(sender: System.Object;     e: System.EventArgs);   begin     if not User.Identity.IsAuthenticated       then  Response.Redirect('LoginForm.aspx')       else Label1.Text:= 'Welcome: '+ User.Identity.Name;   end; // Page_Load

• in the Web.Config file, we add two information
  
  • we want to use Forms Authentication (as opposed to "Windows", "Passport", or any other)
    
  • we want to redirect any user to the login form that we specify
    
  Here is an example:

  <?xml version="1.0" encoding="utf-8" ?> <configuration>   <system.web>     <authentication mode="Forms">       <forms           name="my_login_cookie"           loginUrl="LoginForm.aspx"           timeout="3">       </forms>     </authentication>   </system.web> </configuration>

• the login form itself, LoginForm.Aspx asks the User to enter his credentials (name and password in our case), and decide, based on some logic, whether this user is considered authenticated

  function TLoginForm.f_are_user_and_pass_valid(     p_user_name, p_password: String): Boolean;   begin     Result:= (p_user_name = 'my_user') and (p_password = 'my_pass');   end; // f_are_user_and_pass_valid procedure TLoginForm.login__Click(sender: TObject;     e: System.EventArgs);   begin     if f_are_user_and_pass_valid(         user_textbox_.Text, password_textbox_.Text)       then FormsAuthentication.RedirectFromLoginPage(           user_textbox_.Text,  False);   end; // login__Click

  Where

  • the function f_are_user_and_pass_valid decides, based on hard coded string litteral, whether some user name and password are correct or not
    
  • this function is called by the LoginButton.OnClick, and if the result is True, the RedirectFromLoginPage send to the User the page he first asked for (Default in our case)
    

2.1.2 - Authentication Logic

2.1.3 - Tracing the Authentication Steps

• Cassini (or any other HTTP Server is started)

  

• using Internet Explorer (or any suitable Web Browser), the user requests a page from our site. For instance, Default.Aspx

  

  When the User sends his request, the HTTP request is sent to the Server (partial trace)

  -> | GET /p_92_forms_authentication/Default.Aspx HTTP/1.1 -> | Accept: image/gif, image/x-xbitmap, ...ooo... -> | User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; ...ooo... -> | Host: localhost:81 -> | Connection: Keep-Alive -> | -> |

• the server loads Default, User.Identity.IsAuthenticated returns False, the Server returns an error 302, asking the Browser to redirect to Login.Aspx

  <- | HTTP/1.1 302 Found <- | Server: Cassini/1.0.0.0 <- | Date: Sun, 04 Nov 2007 06:45:03 GMT <- | X-AspNet-Version: 1.1.4322 <- | Location: /p_92_forms_authentication/LoginForm.Aspx <- | Set-Cookie: ASP.NET_SessionId=tvol0y45oij1do45l0opot45; path=/ <- | Cache-Control: private <- | Content-Type: text/html; charset=utf-8 <- | Content-Length: 158 <- | Connection: Close <- | <- | <- | <html><head><title>Object moved</title></head><body> <- | <h2>Object moved to <a href='/p_92_forms_authentication/        LoginForm.Aspx'>here</a>.</h2> <- | </body></html> <- |

• the browser requests the redirected page (we hardly see this in the Browser):

  -> | GET /p_92_forms_authentication/LoginForm.Aspx HTTP/1.1 -> | Accept: image/gif, image/x-xbitmap, image/jpeg, ...ooo... -> | User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; ...ooo... -> | Host: localhost:81 -> | Connection: Keep-Alive -> | Cookie: ASP.NET_SessionId=tvol0y45oij1do45l0opot45 -> | -> |

• the Server sends back the LoginForm.Aspx:

  <- | HTTP/1.1 200 OK <- | Server: Cassini/1.0.0.0 <- | Date: Sun, 04 Nov 2007 06:45:03 GMT <- | X-AspNet-Version: 1.1.4322 <- | Cache-Control: private <- | Content-Type: text/html; charset=utf-8 <- | Content-Length: 974 <- | Connection: Close <- | <- | <- | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <- | <html> <- |   <head> <- |     <title></title> <- |   </head> <- |   <body ms_positioning="GridLayout"> <- |     <form name="_ctl0" method="post"                  action="LoginForm.Aspx" id="_ctl0"> <- |       <input type="hidden" name="__VIEWSTATE"                  value="dDw3ODA0Mj ...ooo... U6r" /> <- |       <span id="Label1" style="Z-INDEX: 3; ...ooo... /> <- |       <input name="user_textbox_" type="text"                  id="user_textbox_" style=" ...ooo... /> <- |       <span id="Label2" style="Z-INDEX: ...ooo... /> <- |       <input name="password_textbox_" type="text"                  id="password_textbox_" style=" ...ooo... /> <- |       <input type="submit" name="login_button_" value="Login"                  id="login_button_" style=" ...ooo... /> <- |     </form> <- |   </body> <- | </html>

  which is displayed like this:

  

• the user type his user name "my_user" and his password "my_pass" and click "Login"

  -> | POST /p_92_forms_authentication/LoginForm.Aspx HTTP/1.1 -> | Accept: image/gif, image/x-xbitmap, image/jpeg ...ooo... -> | Referer: http://localhost:81/p_92_forms_authentication/             LoginForm.Aspx -> | Content-Type: application/x-www-form-urlencoded -> | User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; ...ooo... -> | Host: localhost:81 -> | Content-Length: 124 -> | Connection: Keep-Alive -> | Cache-Control: no-cache -> | Cookie: ASP.NET_SessionId=tvol0y45oij1do45l0opot45 -> | -> | __VIEWSTATE=dDw3ODA0MjA4 ...ooo...             4BNmJU6r&user_textbox_=my_user             &password_textbox_=my_pass&login_button_=Login

  which contains the credentials (non crypted because we did not ask for it)

• the Server asks the Browser to redirect to Default.Aspx

  <- | HTTP/1.1 302 Found <- | Server: Cassini/1.0.0.0 <- | Date: Sun, 04 Nov 2007 06:45:11 GMT <- | X-AspNet-Version: 1.1.4322 <- | Location: /p_92_forms_authentication/default.aspx <- | Set-Cookie: logincookie=FBD8A89 ...ooo...0765F4A667; path=/ <- | Cache-Control: private <- | Content-Type: text/html; charset=utf-8 <- | Content-Length: 1162 <- | Connection: Close <- | <- | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <- | <html> <- |   <head> <- |     <title></title> <- |   </head> <- |   <body ms_positioning="GridLayout"> <- |     <form name="_ctl0" method="post"                  action="LoginForm.Aspx" id="_ctl0">                   ...ooo... same as previous LoginForm                   ...ooo... but with User and Pass filled <- |     </form> <- |   </body> <- | </html>

• since this is a redirection request, the Browser asks for the redirected page:

  -> | GET /p_92_forms_authentication/default.aspx HTTP/1.1 -> | Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */* -> | Referer: http://localhost:81/p_92_forms_authentication/LoginForm.Aspx -> | User-Agent: Mozilla/4.0 (compatible; MSIE ...ooo... -> | Host: localhost:81 -> | Connection: Keep-Alive -> | Cache-Control: no-cache -> | Cookie: ASP.NET_SessionId=tvol0y45oij1do45l0opot45;                  logincookie=FBD8A8940 ...ooo... -> | -> |

• the Server returns, at long last, the Default.Aspx page:

  <- | HTTP/1.1 200 OK <- | Server: Cassini/1.0.0.0 <- | Date: Sun, 04 Nov 2007 06:45:11 GMT <- | X-AspNet-Version: 1.1.4322 <- | Cache-Control: private <- | Content-Type: text/html; charset=utf-8 <- | Content-Length: 490 <- | Connection: Close <- | <- | <- | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <- | <html> <- |   <head> <- |     <title></title> <- |   </head> <- |     <body> <- |       <form name="_ctl0" method="post" action="default.aspx" id="_ctl0"> <- |         <input type="hidden" name="__VIEWSTATE"                  value="dDwyMDQw ...ooo...COAfH2XUVkKIvVc=" /> <- | <- |         <span id="Label1">Welcome: my_user</span> <- |       </form> <- |     </body> <- | </html>

  and the user sees:

  
  

2.1.4 - UML CLASS Diagrams

2.2 - Authorization

For folder authorization, we can be set up using Web.Config:

• for each folder we want to protect, we create the <authorization section and write a combination of <allow and <deny tags
  
• if the user is not allowed to access some resource, he is sent back to the login page
  

• the rules are analyzed in sequential order, and the first which is true exits (the rules after this one are not checked)
  
• the two wildcards are
  
  • ? for ANONYMOUS
    
  • * for ALL
    

	we add the following section to Web.Config (in the root page):   <configuration>   <system.web>       <authentication mode="Forms">       <forms           name="my_login_cookie"           loginUrl="LoginForm.aspx"           timeout="3">         <credentials passwordFormat= "Clear">           <user name="my_user" password="my_pass" />           <user name="joe" password="joe_pass" />           <user name="ann" password="ann_pass" />         </credentials>       </forms>     </authentication>       <authorization>       <deny users="?" />       <allow users="my_user" />       <allow users="my_user,joe,ann" />       <deny users="ann" />     </authorization>     </system.web> </configuration>
	we create a my_login.aspx page, which contains 2 Textboxes and one Button, which checks the user and pass: procedure TLoginForm.login__Click(sender: TObject;      e: System.EventArgs);   begin     if FormsAuthentication.Authenticate(user_textbox_.Text,            password_textbox_.Text)       then FormsAuthentication.RedirectFromLoginPage(           user_textbox_.Text,  False);   end; // login__Click
	all pages are now protected by the Asp.Net checks, and there is no need to write explicit checks. For instance, in the Default.Page_Load, we have: procedure TDefault.Page_Load(sender: System.Object;      e: System.EventArgs);   begin     Label1.Text:= 'Welcome: '+ User.Identity.Name;   end; // Page_Load
	when we run the project, the login is presented. Only MY_USER and JOE will see the Default.Aspx,

• authentication can ONLY be places in the root Web.Config, but authorization can be placed in any folder of our site
  
• the test User.Identity.IsAuthenticated in each page is no longer necessary
  
• we could hash the password in Web.Config, to avoid people on the Server having access to Web.Config to see those passes
  
• we could write code to place the user, password, authorization in some database, instead of placing them in Web.Config
  

3 - Membership and User Management

3.1 - Asp.Net 2.0 Membership Services

• creating, updating, deleting user accounts
  
• enabling the developer to include visual controls for doing so.
  

• predefined controls for Login, Logout, registration etc. So we no longer have to create forms with the user name and password TextBoxes and "Login" button
  
• a pre-defined API for managing Users, which includes
  
  • a set of CLASSes
    
  • an implementation of the persistence of the users (saving the information on disc)
    

3.2 - Initializing Membership

So someone has to initialize the store, at least with a first User / Pass.

For Delphi, by default, the data is stored in a Blackfish database. So, initializing this data amounts to adding some rows to the user table. This can be done

• using the Data Explorer
  
• using a Delphi project (Win32, Vcl.Net or Asp.Net)
  

3.2.1 - Creating the Membership database

Let's create this project:

	select "File | New | Asp.Net Web Application", specify the path and app name, like "membership_admin"
	run the project once
	the disc will contain a new APP_DATA path and the .jds database:

We can examine this database using the Data Explorer:

	select "Data Explorer | dbExpress | BLACKFISHSQL | right click | Add New Connection"
	enter a connection name, like "bfs_asp_admin" click "Ok"
	a new node is created in the treeview
	select "bfs_asp_admin | Modify Connection", and enter the host and .jds path: test the connection and click "Ok"
	select the bfs_asp_admin node, and expand the node to display the database schema:

3.2.2 - Creating the Database with ASPNET_REGDB.EXE

Delphi simply creates the APP_DATA path, creates a new empty .JDS database, and initializes the empty TABLEs. This TABLE creation is performed by running a Delphi .EXE which is placed by the Delphi installation in the .Net Framework directory:

You may notice that there is an ASPNET_REGSQL.EXE in the same directory, and this one if from Microsoft, and it will create Sql Server tables.

If your Delphi version does not create the bsql_aspnet.jds database, you can create the database using any technique (the Data Explorer, or any Win32 or Vcl.Net code).

Here is an example where we will create the same database in a temporary folder MY_APP_DATA

	select "Data Explorer | dbExpress | BLACKFISHSQL | right click | Add New Connection"
	enter a connection name, like "bfs_membership_base" click "Ok"
	a new node is created in the treeview
	select "bfs_asp_admin | Modify Connection", and enter the host and .jds path, like: LocalHost C:\programs\us\web\asp_net\membership_roles_profile\ 02_membership\21_membership_admin\my_app_data\bfs_membership.jds
	click "Advanced" and toggle "Create" to True
	click "Ok"
	click "Test Connection"
	an empty Blackfish database is created
	click "Ok" to save the new connection

And here is how to create the empty Membership TABLEs in this database:

	open Notepad, and ask aspnet_regdb to display its commands in a command-line box:   C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regdb.exe /?
	save this under aspnet_regdb_help.bat (is is in the downloadable .ZIP) and run it
	here are the aspnet_regdb commands:
	since this help talks about MACHINE.CONFIG, here is this file's location: and this file, after Delphi installation, contains a Blackfish entry, with the BlackfishSQLAspDB connection name:   <?xml version="1.0" encoding="UTF-8"?> <configuration>   ...ooo...     <connectionStrings>     <add name="BlackfishSQLAspDB" connectionString="host "...ooo... />     <add name="LocalSqlServer" connectionString="data " ..ooo... />   </connectionStrings>       ...ooo... </configuration>

Now we can create the Membership TABLEs in this database:

	open Notepad, and type the line which will execute aspnet_regdb in order do create the empty TABLEs (Ed: the command on a single line):   C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regdb.exe     bfs_membership_base -A pause Save this under a .BAT name and start the .BAT
	the table is created And the .Jds size jumped from 52 K to 272 k

Instead of using the name of our connection ("bfs_membership_base") we could have used the MACHINE.CONFIG name, which is BlackfishSQLAspDB. In fact this is also the name of a default Ado.Net provider connection (Ed:: partial)

Also note that the database is hardcoded, and still works for any of our Asp.Net project. This works because the database name uses the |DataDirectotry| "macro", which stands for "the App_Data subdirectory of the current project".

3.2.3 - Creating a Database and User manually

But for Delphi, we have to extract them from the current table. You can either use a script extractor (we published several of those), or use the Dbx4 metadata facilities, or, for simple projects like this, simply look at the Data Explorer description:

	select "Data Explorer | dbExpress | BLACKFISHSQL | bfs_asp_admin | Tables | ASPNET_USERS | Alter Table"
	the schema is displayed

Base on this view, an adequate script would be:

Using this script, we can create the ASPNET_USERS Table by several means:

• using the Data Explorer Active Query Builder (see our Dbx4 Programming paper)
  
• using code from any Delphi application
  

	on the previously create blank Asp.Net application, select "Design", and in the Object Inspector, select "DOCUMENT" and then set PageLayout to GridLayout
	make sure the "Project Manager | References" contains the following assemblies (Ed: for this step and the other steps presented later):   Borland.Data.DbxCommon.Dll   Borland.Data.CommonDriver.Dll   Borland.Data.AdoDbxClient.Dll   Borland.Data.BlackfishSql.LocalClient.Dll and if not, add them ("right click | Add reference" etc)
	select "Tools Palette | BlackfishSQL | DataStoreConnection", drag it on the Form and select "Object Inspector | ConnectionString | Ellipsis", and in the dialog, select the "bfs_membership_manual.jds" database: test it and close
	select "Tools Palette | BlackfishSQL | DataStoreCommand", drag it on the Form and set its Connection to DataStoreConnection1
	drag a Button on the Form, and in its Click event, create the ASPNET_USERS Table: const k_create_aspnet_users_request=           'CREATE TABLE aspnet_users'         + '  ('         + '      applicationid CHAR(36) NOT NULL,'         + '      usreid CHAR(36) NOT NULL,'         + '      username VARCHAR(256) NOT NULL PRIMARY KEY,'         + '      loweredusername VARCHAR(256) NOT NULL,'         + '      mobliealias VARCHAR(16),'         + '      isanonymous BOOLEAN NOT NULL,'         + '      lastactivitydata TIMESTAMP NOT NULL'         + '    )' ; procedure execute_datastore_command(p_c_datastore_command: DataStoreCommand;     p_request: String);     // -- assumes the connection is open   begin     with p_c_datastore_command do     begin       CommandText:= p_request;       ExecuteNonQuery;     end; // with p_c_datastore_command   end; // execute_datastore_command procedure TDefault.create_user_table__Click(sender: System.Object;     e: System.EventArgs);   begin     DataStoreConnection1.Open;     execute_datastore_command(DataStoreCommand1,         k_create_aspnet_users_request);     DataStoreConnection1.Close;   end; // create_user_table__Click
	your USES clause should contain the following UNITs (Ed: for this and for the next steps below):   System.Data.Common   Borland.Data.DataStore   Borland.Data.AdoDbxClientProvider;
	run and click on the Button
	the Table is created If you select the Data Explorer, and refresh the "bfs_membership_manual" connection, you will also see the Table

3.2.4 - The Delphi Security Tables

And

• the ASPNET_APPLICATIONS is there to allow the same database to be used by several Asp.Net applications. This can be later used by using the user PLUS the application for deciding what to authorize or deny
  
• the ASPNET_USERS mainly contains the User name
  
• in a separate Table, the ASPNET_MEMBERSHIP contains the User password, with lots of similar informations (the view above is truncated for this Table)
  

• ASPNET_ROLES define the role name
  
• ASPNET_USERINROLES allow to link users in roles, in a typical n to n fashion (a user can have many roles, and a role obviously contains many users)
  

• for a given User, the ASPNET_PROFILE contains lists of properties (what the User likes)
  

Please note:

• all ID's are 36 character strings. Looking at the Sql Server scripts, the type is "uniqueidentifier" and is exactly the size of a GUID
  
• we will not use GUIDs which are quite cumbersome to handle, but use a simple ID scheme:
  • 100x for Applications
    
  • 200x for Users
    
  • 300x for Roles
    

3.3 - Creating the First User

3.3.1 - Entering new Users

There are several ways to do this:

• using the Microsoft Asp.Net web administration pages
  
• or directly inserting data in our database Tables
  
  • using the Data Explorer
    
  • by code
    

3.3.2 - The Microsoft Asp.Net Configuration application

	start the Asp.Net Application for which you want to enter users (remember, the database is located, by default in the APP_DATA subdirectory of each Asp.Net application)
	select "Project Manager | your_project.dll | right click Asp.Net_Configuration"
	the main page of the administration tool is displayed:
	select "Security"
	a page allows to select which part you want to manage (users, roles, allow / deny rules) (Ed: top truncated)
	select "Create user"
	an entry web page is displayed:
	fill in the edit boxes and click "create user"

• all the Asp.Net administration pages are in source code in the following directory:

  

• whenever we start the admin tool, there is some delay, since it has to find our security database and recompile the complete tool
  

3.3.3 - Direct Database User Entry with the Data Explorer

	select "Data Explorer | dbExpress | BLACKFISHSQL | bfs_asp_admin | Tables | ASPNET_APPLICATIONS | right click | Retrieve Data From Table"
	the ASPNET_APPLICATIONS empty Table is displayed
	enter "my_app my_app 1001" and select "right click | Update"

• the "Retrieve Data From Table" menu caption which allows Table inserts is quite strange. In fact, in our Dbx4 or Blackfish tutorials, we never succeeded, always trying to insert after the Table had been displayed using a double click.
  

3.3.4 - Direct Database User Entry with Delphi code

First we will add a row to the ASPNET_USERS Table. All the rows are NOT NULL, so we must fill them all. To do this, we will use a parametrized query:

And here is the code:

	reopen the previously created application "membership_admin" which created the ASPNET_USERS Table
	drop a new DataStoreCommand and, in the Object Inspector rename it "insert_user_command_" connect Connection to DataStoreConnection1 select "Parameters | ellipsis" and in the Parameter editor, add four parameters, three of type VarChar, and the last of type TimeStamp
	add two Textboxes for the user id and user name, and a Button, and in the Click event, add a new user to the Table: const k_add_user_request=            'INSERT INTO aspnet_users'          + '  (applicationid, userid, username, loweredusername,'          + '      isanonymous, lastactivitydata)'          + '  VALUES (1001, ?, ?, ?, False, ? )'          ; procedure TDefault.add_user__Click(sender: System.Object;      e: System.EventArgs);   begin     DataStoreConnection1.Open;     insert_user_comand_.CommandText:= k_add_user_request;     insert_user_comand_.Prepare;     insert_user_comand_.Parameters[0].Value:= id_textbox_.Text;     insert_user_comand_.Parameters[1].Value:= user_name_textbox_.Text;     insert_user_comand_.Parameters[2].Value:= user_name_textbox_.Text;     insert_user_comand_.Parameters[3].Value:= DateTime.Now;     insert_user_comand_.ExecuteNonQuery;     DataStoreConnection1.Close;   end; // add_user__Click
	run and enter some users

To be able to start anew, we also added buttons for

• dropping the Table
  
• deleting all rows
  
• displaying the users in a TextBox
  

Please note

• we froze the application code to the 1001 value, but, of course, you could also use a Textbox to enter this value
  
• we could not enter the dates in the Data Explorer, but since we do it by code this is of little importance
  
• we chose to create the parameters in the Object Inspector, but they could also have been created by code (this is done in some of our later examples)
  

We used the same technique, and added to this application the possibility to create this membership table, and enter some value.

Here is the creation request:

and the insertion request (we enter only the mandatory fields):

In fact, the application .ZIP source code that you can dowload from our web site, contains code for creating, dropping, adding, deleting and listing the three Tables involved in membership management (application, users, membership).

3.3.5 - Managing the users

We wrote an application which does the same, using the Tables already created. Here is a snapshot:

The code simply uses the separate inserts of the previous application, and makes sure that the entered values are synchronized (same applicationid and same userid for each entry).

To use this application

	enter an application id and name
	enter the user id, name and password

The "generate ids" is there to quickly enter new users: we click on this button to generate a new value (say 7) and this will initialize the user id, name and password (200_7, user_7, pass_7) and increment the seed id.

Naturally you can enter more meaningful values instead of our artificial "user_4" etc.

3.4 - Membership Providers

3.4.1 - Provider definition

• the provider user can make some calls, usually based on some predefined abstract CLASSes
  
• the provider implementor writes the code which stores and transfer the information, by implementing a descendent of the base provider CLASS and saving the data on disc.
  

3.4.2 - The Membership Provider System

• the basic contract is defined by the ABSTRACT MembershipProvider CLASS
  
• Microsoft provided an SqlMembershipProvider implementation, and CodeGear wrote a BlackfishMembershipProvider and an InterbaseMembershipProvider
  
• for specific behaviour, it is of course possible to write other MembershipProviders: some will save the data as .XML file, some will use ODBC as data access, or even .TXT files
  

At the developper level, we use a Membership CLASS which only calls the methods defined in the ABSTRACT CLASS. The consequence is that if we create any other descendent of the MembershipProvider, our Asp.Net code should not be modified in any way. We decoupled the Membership calls of our applications from the way the data is stored on disc.

This can be represented with the following diagram:

A couple of notes

• the database schema used to persist the security data on disc is irrelevant. The developer code should only call the Membership methods, and the providers will take care of talking to the database.
  
• in fact we could use different Tables that those presented above, if we are willing to write a MembershipProviders which talks to those Tables
  
• therefore directly reading and writing data to the ASPNET_APPLICATIONS, ASPNET_USERS and ASPNET_MEMBERSHIP Tables is not a good idea. The schema we presented is the one implemented by Delphi, and it closely follows the Microsoft schema. But those could change in the future, whereas the ABSTRACT MembershipProvider CLASS should remain more stable.
  For instance using the Asp.Net Configuration application should be safe. We directly wrote to the Tables because we felt it was quicker (= could be replayed very easy).
  

3.4.3 - The Web.Config Membership entries

• a <membership section
  
• if we use some database, a <connectionString section
  

Here is the default Web.Config (Ed : truncated):

Here is another example with our own MembershipProvider:

And:

• the <connectionString section specify database connections. In our case, there is only the MembershipProvider database
  
• the <membership section contains
  
  • a provider name (any name will do)
    
  • the MembershipProvider CLASS
    
  • eventually, the database to use
    

3.5 - Using the Membership CLASS

3.5.1 - The Membership CLASS

• either directly call Membership methods
  
• or use predefined Microsoft login components which indirectly use the Membership CLASS
  

3.5.2 - The MembershipUser CLASS

Many of the querying functions return a MembershipUser instance, or a MembershipUserCollection.

This can be represented like this (Ed: partial):

The MembershipUser CLASS allows us to perform many usual User management tasks:

• change the password
  
• find a User using his email (when he forgot his password)
  

3.5.3 - Using the Membership CLASS in code

select the Default.Aspx page, drop a TextBox and a Button which displays all the users in the TextBox: procedure TDefault.list_users__Click(sender: System.Object;     e: System.EventArgs);   var l_c_membership_user_collection: MemberShipUserCollection;       l_i_user_enumerator: iEnumerator;   begin     l_c_membership_user_collection:= MemberShip.GetAllUsers();     l_i_user_enumerator:= l_c_membership_user_collection.GetEnumerator;     while l_i_user_enumerator.MoveNext do       with l_i_user_enumerator.Current as MembershipUser do         display(UserName+ ' '+ PasswordQuestion);   end; // list_users__Click

3.6 - The Asp.Net 20 Login Controls

• the most obvious ones:
  
  • Login which simply let the User enter his credentials (exactly like we did in our first example)
    
  • LoginView which is a templated (parametrized) version of the same
    
  • LoginStatus which allows to logout, or, for anonymous users, to login
    
  • PasswordRecovery which does what the name says
    
  • ChangePassword allows a User to change his password
    
  • LoginName is used to display the name of the User: "Hello SuchAndSuch, we are very happy to have you onboard, winds are East-North East, the ground temperature is 55" etc
    
• CreateUserWizard is a multi page component for creating new users
  

3.7 - The Login Component

Well, not quite. This is a deluxe version of the usual login. You naturally have labels which specify what the TextBoxes should contain, but also a validator, and many configurable features.

Here is a simple example of using this control:

	select "File | New | Asp.Net Web Application", specify the path and app name, like "membership_login"
	run the project once, and enter some users (or copy the BSQL_ASPNETDB.JDS files from a previously initialized database to the local APP_DATA folder)
	select "File | New | Delphi for .Net | New Asp.Net file | Asp.Net Page" and name this page LOGIN.ASPX
	select "Tool Palette | Web Login"
	all the security components are presented:
	select Login and drop it on the Form
	select the DEFAULT.ASPX page, and drop a Button, just to be sure this page does not appear just blank
	open the WEB.CONFIG file, and make sure that the <connectionString section contains your database connection string (the default should be allright) the <membership section contains a reference to this database the <authentication specify WindowForms the <authorization sections denies anonymous users Check the figure above to be sure this is all setup
	compile and run
	the login page is presented:
	enter one of your users credentials. In our case "user_1" and "pass_1" will be fine
	the Default page is presented

3.7.1 - Customizing the Login

• first there are the usual Object Inspector properties. Background color, label captions, default user etc can be all adjusted. Here is an example:

  

  As usual, those properties can be directly setup in the .ASPX file

• we can also use .CSS style sheets for modifying the Login style

• we can also add validation rules or add additional controls using TEMPLATEs
  

which will look like this:

Sure, nothing fancy, but if the user does not enter his name, he will receive an accurate error message. We could of course add more sophisticated validation, using regular expression validators (only letters etc)

3.7.2 - Login Control Properties and Events

The events fire in the following order:

Here is an example which redirects the user to the URL specified in the Login.PasswordRecoveryUrl if the error count exceeds 5:

3.8 - The LoginStatus Control

• either a "Logout" hyperlink
  
• or a "Login" hyperlink
  

When the user is not authenticated, the page will display "login", and clicking this link will redirect the user to the default login page.

3.8.1 - The ChangePassword, LoginName, PasswordRecovery and LoginView Controls

Just a couple of comments:

• the PasswordRecovery uses SMTP to sent the lost password to the User and this is configured once again using Web.Config
  
• the LoginView is a TEMPLATEd control allows to display different elements based on the status of the user (logged in or not) or even based on the user role. So it uses the TEMPLATE technique, but what is displayed depends on the User status
  

3.8.2 - The CreateUserWizard Control

Wizard controls are a kind of elaborate MultiView control. They contain steps corresponding to different pages, and the navigation is automatically built-in. We configure those controls using the "Smart Tabs", which are some kind of menus (actually windows) which are opened and closed using the right-top arrow of the control.

For the CreateUserWizard, there are two mandatory "steps"

• one step (page) for entering the User parameters (name, password, e-mail) etc
  
• another step which reports any error (duplicate user name etc) or success, and lets the User navigate to some other page
  

	select "File | New | Delphi for .Net | New Asp.Net file | Asp.Net Page" and name this page CREATE_USER_WIZARD.ASPX
	select "Tool Palette | Web Login | CreateUserWizard" and drag it on the Form:
	the control is displayed, with the first step and the smart tab menu open:
	change any properties you like in the Object Inspector
	open the "smart tab" menu by right clicking the top right small arrow. Then select "Step | Complete"
	the second step is displayed:
	in the Object Inspector, specify the ContinueDestinationationUrl. We simply chose ~/Default.aspx
	in the smart tab, select the first step again
	select the Default page, add a Button which will transfer the control to the create_user_wizard.aspx page: procedure TDefault.create_user__Click(sender: System.Object;      e: System.EventArgs);   begin     Server.Transfer('create_user_wizard.aspx', True);   end; // create_user__Click
	compile, run, enter your credentials, in the Default page, click "create_user_"
	the first step of the wizard is displayed
	fill the credential Textboxes and click "Create User"
	if the operation succeeds you will see:
	click "Continue"
	the Default page is presented

4 - Authorization and Roles

4.1 - Using Roles

In addition to storing user names and passwords (authentication), we usually also specify which pages each User is allowed to request (authorization). Here also, Web.Config can be used with individual User references, but for many Users, we can group them in Roles. For instance "Admin", "Guest", "Accounting" etc. Those roles can the be used anywhere the user name were used for authorization purposes.

4.2 - Role service architecture

• a RoleProvider which is an ABSTRACT CLASS defining the available methods
  
• a Roles CLASS which we can use to manage the roles
  

Please note

• those CLASSes are MUCH simpler to implement, since they are mainly handling STRINGs or ARRAY OF STRINGs
  
• this is probably the reason why there is no separate "role" CLASS (whereas there was a "user" CLASS)
  

4.3 - Creating the Roles Table

Nevertheless, we included a .ZIP source file which creates the Tables and drops them, and a second application which fills some value by directly writing into the Role Tables.

There are two Tables involved: ASPNET_ROLES and ASPNET_USERSINROLES. The general schema has been presented above.

To create the ASPNET_ROLES Table, we can use the following request:

and to create the ASPNET_USERSINROLES:

The content of the application which contains those requests parallels the application we used for memberships. You can download it below

Here is a snapshot of this application:

4.4 - Adding Roles and Linking them to Users

4.4.1 - Using the Asp.Net Configuration tool

	start the Asp.Net Application for which you want to enter roles (the database is located, by default in the APP_DATA subdirectory of each Asp.Net application, and it must be initialized and filled with some Users)
	select "Project Manager | your_project.dll | right click Asp.Net_Configuration"
	the main page of the administration tool is displayed:
	select "Security"
	a page allows to select which part you want to manage (users, roles, allow / deny rules)
	select "Create or Manage Roles"
	a Role entry page is presented:
	enter a Role name, say "Sales" and click "Add role'
	the role is added to the database. In addition it now is listed in the GridView below the Role entry TextBox
	select the "Sales" Role and click "Manage"
	a dialog allows us to select users
	type a user name ("user_3") in our case and click "Find User"

4.4.2 - Using Delphi Code

To add a new Role we simply send an INSERT INTO request.

To allocate Roles to Users, we added two ListBoxes which display the userid and roleid available. To enter a new (user role) combination, we simply select a Role and a User and click on the Button.

Here are some explanation about this application:

• to fill both ListBoxes, we use the following code:

  procedure TDefault.fill_users_roles__Click(sender: System.Object;     e: System.EventArgs);   begin     DataStoreConnection1.Open;     general_command_.CommandText:=         'SELECT userid, username FROM aspnet_users';     DataStoreDataAdapter1.SelectCommand:= general_command_;     DataStoreDataAdapter1.Fill(DataSet1.Tables[0]);     user_listbox_.DataSource:= DataSet1.Tables[0].DefaultView;     user_listbox_.DataTextField:= 'username';     user_listbox_.DataValueField:= 'userid';     general_command_.CommandText:=         'SELECT roleid, rolename FROM aspnet_roles';     DataStoreDataAdapter1.SelectCommand:= general_command_;     DataStoreDataAdapter1.Fill(DataSet1.Tables[1]);     roles_listbox_.DataSource:= DataSet1.Tables[1].DefaultView;     roles_listbox_.DataTextField:= 'rolename';     roles_listbox_.DatavalueField:= 'roleid';     DataBind;     DataStoreConnection1.Close;   end; // fill_users_roles__Click

• this code is called for the first request of the page:

  procedure TDefault.Page_Load(sender: System.Object;     e: System.EventArgs);   begin     if not IsPostBack       then fill_users_roles__Click(Nil, Nil);   end; // Page_Load

• the code to insert the link is the following:

  const k_add_userinrole_request=           'INSERT INTO aspnet_usersinroles'         + '   (userid, roleid'         + '   ) '         + '  VALUES (?, ?)'         ; procedure TDefault.add_userinrole___Click(sender: System.Object;     e: System.EventArgs);   var l_user_id: String;       l_role_id: String;   procedure display_selected_values;     begin       with user_listbox_.SelectedItem do         l_user_id:= Value;       with roles_listbox_.SelectedItem do         l_role_id:= Value;     end; // display_selected_values   begin // add_userinrole___Click     display_selected_values;     if do_add_checkbox_.Checked       then begin           DataStoreConnection1.Open;           l_request:= k_add_userinrole_request;           display(l_request);           insert_usersinroles_command_.CommandText:=               k_add_userinrole_request;           insert_usersinroles_command_.Prepare;           insert_usersinroles_command_.Parameters[0].Value:= l_user_id;           insert_usersinroles_command_.Parameters[1].Value:= l_role_id;           insert_usersinroles_command_.ExecuteNonQuery;           DataStoreConnection1.Close;         end;   end; // add_userinrole___Click

• and here is a snapshot of this second Roles application:

  
  

• we used the traditional Asp.Net 1.x DataBinding route rather then the more recent GridViewDataSource route, but of course the latter is also possible
  
• our ListBoxes display the names, but their value field contains the ID's which are used to fill the ASPNET_USERSINROLES Table. When we include in the ListBox both DataTextField and DataValueField, those Textboxes in fact play the role of a LookupListBox
  
• there is no ListBox.OnClick: we can select items in the ListBoxes, and only when we send the page to the Server (by clicking on any Button) are the selected items available. In our code example, we used the ListBox.SelectedItem to grab the userid and roleid.
  

4.5 - Authorization Rules

4.5.1 - User Authorization Rules

• the <authorization section of Web.Config contains a sequence of
  
  • <allow users sections telling which Users you want to accept
    
  • <deny users sections telling which Users you want to refuse
    

• in each section, we can put either a single User, or comma delimited lists
  
• there are two wildcards:
  
  • * (star) for "any"
    
  • ? (question mark) for "anonymous"
    
• the rule sequence is evaluated from top to bottom, and the first success stops the evaluation rule
  

• here is how to deny anonymous, but accept anybody else:

  <configuration>   <system.web>       <authorization>       <deny users="?" />       <allow users="*" />     </authorization>     </system.web> </configuration>

  and anonymous users are thrown out by the first rule, other users accepted by the second

• the ordering is very important. This rule will accept everybody:

  <configuration>   <system.web>       <authorization>       <deny users="?" />       <allow users="*" />     </authorization>     </system.web> </configuration>

  since the first rule always suceeds, and the second rule is never analyzed
  

There are additional possibilities to specify the User PC, or to allow / deny not only complete directories but also individual files.

Now the interesting part: it would be foolish to try to allow or deny individual users to some pages. But this is not the case for Roles. So we can build a set of Roles when we create the site, and gradually assign those Roles to the Users. Here is an example:

4.6 - Using Code for Authorization

4.6.1 - Using the Page properties

The iPrincipal INTERFACE contains an Identity property, which implements iIdentity. This INTERFACE has an IsAuthenticated method which can be used to check authentication

The following figure summarizes those relationships:

4.6.2 - The Roles CLASS

Here is an example of adding all authenticated Users to the "Employee" Role:

5 - Profiles

5.1 - Why use Profiles

The detail of the Profile of each User is free: we may store addresses (street, city etc), or presentation preferences, birthday date etc.

5.2 - The Profile architecture

5.3 - Creating the Profile Table

This deserves some explanation:

• the propertynames field stores the name, format, position and length of each Profile element
  
• the propertyvaluesstring and propertyvaluesbinary store the (string or binary) content of each element
  
• aside from the first and last column, the name, string and binary columns are all BLOBS. For BlackfishSql, this is defined as VARCHAR without any size (if you add one parameter, it is the maximum size. You can use 2 sizing parameters, the minimum being 14, but using no value at all works just fine)
  

5.4 - Profile content Storage Structure

First let's look at the rules:

• The Profile elements you want to use are specified in Web.Config, as a list of entries, one for each element.

  Lets assume that we want to store person addresses: FirstName, Street etc. Our Profile section in Web.Config could look like this:

  <configuration>   <system.web>       <profile>       <properties>         <add name="FirstName" defaultValue="John DOE"/>         <add name="Street" defaultValue="1, Main Street"/>         <add name="City"/>         <add name="Zip"/>         <add name="State"/>       </properties>     </profile>     </system.web> </configuration>

  Note that

  • the elements of each profile are called "properties"
    
  • the main information for each property is its Name
    
  • we can optionally add default values, format or serialization information, even specific providers
    
• when we add a Profile, add a row to the ASPNET_PROFILE Table. In this row, we must place the values in the string or binary fields, and the name field encodes the format, position and size of this information.

  Let's take a simple example:

  • you enter the following properties

    FirstName 'dddd' Street : 'CCC' City : 'bb' Zip : 'A' State : ''

  • since we only have string values, all content will be placed in the propertyvaluesstring field (the propertyvaluesbinary field will be empty)

    And this content will be the concatenation of the values:

    ddddCCCbbA

  • the propertynames field will be:

    FirstName:S:0:4:Street:S:4:3:City:S:7:2:Zip:S:9:1:StateS:10:0

    which means:

    • the first field's name is "FirstName", the content starts at index 0 and its length is 4
      
    • the second field's is "Street", the value starts a 4 for a length of 3 etc
      

5.5 - Adding Values to the Profile

Here is our code:

• for adding a new Profile:

  const k_add_profile_request=           'INSERT INTO aspnet_profile'         + '  (userid, propertynames'         + '    , propertyvaluesstring, propertyvaluesbinary'         + '    , lastupdateddate)'         + '  VALUES (?, ?, ?, ?, ? )'         ; type t_array_of_string= array of string; procedure array_to_profile_strings(p_property_name_array, p_property_array: t_array_of_string;     var pv_property_string, pv_value_string: String);     // -- assumes all types are String (not binary)   var l_property_index: Integer;       l_property_name, l_property_value: String;       l_property_length, l_position: Integer;   begin     pv_property_string:= ''; pv_value_string:= '';     l_position:= 0;     for l_property_index:= 0 to Length(p_property_array)- 1 do     begin       l_property_name:= p_property_name_array[l_property_index];       l_property_value:= p_property_array[l_property_index];       l_property_length:= Length(l_property_value);       pv_value_string:= pv_value_string+ l_property_value;       if pv_property_string<> ''         then pv_property_string:= pv_property_string+ ':';       pv_property_string:= pv_property_string+ l_property_name           + ':S:'+ l_position.ToString+ ':' + l_property_length.ToString;       Inc(l_position, l_property_length);     end; // for l_property_index   end; // array_to_profile_strings procedure TDefault.add_profile__Click(sender: System.Object;     e: System.EventArgs);   var l_property_name_array: t_array_of_string;       l_property_value_array: t_array_of_string;   procedure fill_property_arrays;     begin       SetLength(l_property_name_array, 5);       SetLength(l_property_value_array, 5);       l_property_name_array[0]:= 'Name';       l_property_value_array[0]:= firstname_textbox_.Text;       l_property_name_array[1]:= 'Street';       l_property_value_array[1]:= street_textbox_.Text;       l_property_name_array[2]:= 'City';       l_property_value_array[2]:= city_textbox_.Text;       l_property_name_array[3]:= 'Zip';       l_property_value_array[3]:= zip_textbox_.Text;       l_property_name_array[4]:= 'State';       l_property_value_array[4]:= state_textbox_.Text;     end; // fill_property_arrays   var l_property_name_string, l_property_value_string: String;   begin // add_profile__Click     // -- compute the values     fill_property_arrays;     array_to_profile_strings(l_property_name_array,         l_property_value_array,         l_property_name_string, l_property_value_string);     // -- insert into     DataStoreConnection1.Open;     insert_profile_comand_.CommandText:= k_add_profile_request;     insert_profile_comand_.Prepare;     insert_profile_comand_.Parameters[0].Value:= userid_textbox_.Text;     insert_profile_comand_.Parameters[1].Value:= l_property_name_string;     insert_profile_comand_.Parameters[2].Value:= l_property_value_string;     insert_profile_comand_.Parameters[3].Value:= '';     insert_profile_comand_.Parameters[4].Value:= DateTime.Now;     insert_profile_comand_.ExecuteNonQuery;     DataStoreConnection1.Close;   end; // add_profile__Click

• for listing all the Profiles we use our generic DataReader procedure
  
• here is a snapshot of the application, with the propertyvaluesstring hilighted in the top TextBox

  
  

5.6 - Using Profiles in our Applications

• we can use the ASPNET_PROFILE Tables, as we did above, but this is not very portable, since the Table format could change. This is the reason why ProfileProviders were introduced. Nevertheless, this still is an option
  
• we can try to somehow access the Profile properties of the current user
  

5.6.1 - Web.Config Profile tag

This configuration, as with Membership and Roles, is automatically created by Delphi.

Here is our own Web.Config which works with our own ProfileProvider:

5.6.2 - The dynamic Profile CLASS

We could write:

This looks very nice. However this works for .CS pages (a file with both C# code and .Aspx template tags, which is supported by Visual Studio uses), but not for Web Applications (separate .ASPX and .PAS files), which is the only kind supported by Delphi.

5.6.3 - Getting ProfileInfo

and information about one user:

All we get are User names.

5.6.4 - Listing the property names, default and actual values

We could not use the "Profile dynamic CLASS", but there are two other ways:

• thru HttpContext.Current.Profile
  
• or by creating an instance of ProfileBase
  

The default values (defined in Web.Config) can be retrieved with:

Finally, the real value of a property can be fetched using the Profile from the HttpContext. The relationship between our Page and HttpContext is the following:

Therefore, to get Profile values, we can

• use Page.Context.Profile
  
• use HttpContext.Current.Profile (HttpContext is a CLASS, and Current returns an instance of this CLASS. We must use Current, since this is a Singleton)
  
• directly create a ProfileBase, using the Create METHOD (it is not a CONSTRUCTOR, hence the "&")
  

5.6.5 - The Application Snapshot

5.7 - Allowing Anonymous Access

However we then will only see the Profile of "anonymous". So, in order to be able to see the Profile of other Users, we must be able to force a Login. This is easily done by adding a LoginStatus control on the Form. And at the same time, we also can add a LoginName control, which displays the User name when he is logged in (empty for anonymous)

Therefore, we created a new project, with a LoginStatus and a LoginName controls.

5.8 - Direct ProfileBase and Profile properties access

5.8.1 - Direct ProfileBase access

is quite cumbersome, and it certainly would be better to be able to simply call Profile.

This can be easily done by creating a PROPERTY whose getter uses those steps to reach the ProfileBase. And instead of putting this PROPERTY inside our tDefault Page, we can create an ancestor Delphi Page and let our tDefault inherit from this one.

Here is how to proceed:

	select "profile_class.dll | Add New | Delphi for .Net | New Files | Unit", and rename the unit U_C_BASE_PAGE_WITH_PROFILE
	write the code which contains the ProfileBase PROPERTY: unit u_c_base_page_with_profile;   interface     uses System.Web.Profile, System.Web.UI;     type c_page_with_profile=              Class(Page)                Public                  function f_c_profile_base: ProfileBase;                Published                  property MyProfile: ProfileBase read f_c_profile_base;              end; // c_page_with_profile   implementation     function c_page_with_profile.f_c_profile_base: ProfileBase;       begin         Result:= Self.Context.Profile;       end; // f_c_profile_base     end. // u_c_base_page_with_profile
	select the Default.Pas, and add our new UNIT to the USES clause replace System.Web.UI.Page by our c_base_page_with_profile The partial header looks like this: unit Default;   interface   uses System.Collections, // -- ...ooo...        , u_c_base_page_with_profile ;   type        // TDefault = class(System.Web.UI.Page)        TDefault = class(c_page_with_profile)          strict private            procedure Page_Load(sender: System.Object;         // -- ...ooo...
	add a new Button which will display some Profile property values: procedure TDefault.my_profile_property_value_Click(sender: System.Object;     e: System.EventArgs);   var l_property_name: String;       l_property_value: String;   begin     l_property_name:= property_name_textbox_.Text;     l_property_value:= MyProfile.GetPropertyValue(l_property_name).ToString;     display(l_property_name+ ' is '+ l_property_value);   end; // my_profile_property_value__Click

Please note

• you can rename MyProfile as "Profile", to mimick the Microsoft behaviour.
  

5.8.2 - Direct ProfileBase properties access

is not very easy, and we would prefer:

This can be done by using CLASS HELPERS:

	select "profile_class.dll | Add New | Delphi for .Net | New Files | Unit", and rename the unit U_C_PERSON_PROFILE_HELPER
	write the code which will add Delphi PROPERTYes corresponding to our Profile properties (Ed: only two properties implemented in the display) unit u_c_person_profile_helper;   interface     uses System.Web.Profile ;     Type c_person_profile_helper=              Class helper for ProfileBase                Public                  function GetMyProfile(p_user_name: String): ProfileBase;                  function get_first_name: String;                  procedure set_first_name(p_first_name: String);                  function get_street: String;                  procedure set_street(p_street: String);                Published                  property FirstName: String read get_first_name write set_first_name;                  property Street: String read get_street write set_street;                  // -- ...ooo...              end; // c_person_profile_helper   implementation     function c_person_profile_helper.GetMyProfile(p_user_name: String): ProfileBase;       begin         Result:= ProfileBase.&Create(p_user_name);       end; // GetMyProfile     // -- getters and setters     function c_person_profile_helper.get_first_name: String;       begin         Result:= GetPropertyValue('FirstName').ToString;       end; // get_first_name     procedure c_person_profile_helper.set_first_name(p_first_name: String);       begin         SetPropertyValue('FirstName', p_first_name);       end; // set_first_name     function c_person_profile_helper.get_street: String;       begin         Result:= GetPropertyValue('Street').ToString;       end; // get_street     procedure c_person_profile_helper.set_street(p_street: String);       begin         SetPropertyValue('Street', p_street);       end; // set_street     function c_person_profile_helper.get_city: String;       begin         Result:= GetPropertyValue('City').ToString;       end; // get_city     // -- ...ooo...   end. // u_c_person_profile_helper
	select the Default.Pas file, and just after the IMPLEMENTATION, add a USES clause which import our U_C_PERSON_PROFILE_HELPER UNIT
	Add a couple of Buttons and TextBoxes which use the direct access to our Profile properties: unit Default;   interface     // -- ...ooo...   implementation     uses u_c_person_profile_helper;     // -- ...ooo...     procedure TDefault.profile_firstname__Click(sender: System.Object;         e: System.EventArgs);       var l_user_name: String;       begin         l_user_name:= MyProfile.UserName;         if l_user_name= ''           then l_user_name:= 'empty_user= anonymous';         display(l_user_name+ '.FirstName is '+ MyProfile.FirstName.ToString);         display(l_user_name+ '.Street is '+ MyProfile.Street.ToString);       end; // profile_firstname__Click     // -- TextBox display and update     procedure TDefault.get_profile;       begin         name_textbox_.Text:= MyProfile.FirstName.ToString;         street_textbox_.Text:= MyProfile.Street.ToString;         // -- ...ooo...       end; // get_profile     procedure TDefault.update_profile;       begin         MyProfile.FirstName:= name_textbox_.Text;       end; // update_profile   end. // Default
	compile, run
	select "Login", and enter "user_2" and "pass_2" (or any User you created)
	then click the Buttons
	here is the result

Please note

• we used CLASS HELPERS since the .Net Framework expects a ProfileBase CLASS, and we cannot coax him to use our own ProfileBase descendent. CLASS HELPERS are a Delphi "feature" allowing us to piggyback our additions to an existing CLASS.
  

5.9 - Profile Improvements

• we used CLASS HELPERS since the .Net Framework expects a ProfileBase CLASS, and we cannot coax him to use our own ProfileBase descendent. CLASS HELPERS are a Delphi "feature" allowing us to piggyback our additions to an existing CLASS.
  
• the Profile is handled somehow differently from the Users or Roles:
  
  • first of all it has a separate Assembly
    
  • in order to keep the property list open, its the coding as value bundles is quite special.
    
• there is a possibility to create a CLASS which represents the properties defined in Web.Config.
  
• given the effort required to extract the Profile and its PROPERTY values from the Profile service, and since the information is persisted in a database anyway, we would have saved an considerable amount of time by storing this information in an ASPNET_PERSON Table, using traditional database techniques and strongly typed DataSets.
  
• we could also group PROPERTYes in groups, like this:

  <configuration>    <system.web>      <profile enabled="true" defaultProvider="my_profile">        <providers>          <remove name="my_profile"/>          <add name="my_profile"              type="u_c_profile_provider.c_profile_provider"              connectionStringName="my_connection"              applicationName="/"/>        </providers>        <properties>          <add name="FirstName" defaultValue="DOE"/>          <add name="Street" defaultValue="1, Main Street"/>          <add name="City"/>          <add name="Zip"/>          <add name="State"/>            <group name="Employee" />            <add name="Department" />            <add name="Position" />          </group>          </properties>      </profile>    </system.web>  </configuration>

  We then could use the ProfileBase.GetProfileGroup() to get the group, and could even create a PROPERTY in the base page, and create another CLASS HELPER to access the group properties using a double dot notation : MyProfile.Person.Department.
  

6 - Comments

6.1 - Asp.Net 2.0 Security

However mastering security is the key to any commercial site.

6.2 - The Rad Studio 2007

6.2.1 - Beta Test warning

We could not make the Security work out of the box. More accurately, the Asp.Net Configuration utility did not recognize the Delphi security providers. Reinstalling twice would not help. And still some other developers seem to have no problem.

So we must have goofed somewhere during the installation.

6.2.2 - Custom Security Providers work around

This explains the structure of our examples:

• the first examples (21_membership, 31_roles, 41_profiles) created the ASPNET_xxx Tables
  
• the second examples (22_ 32_, 42_) directly accessed those Tables to fill them with some values (and, to some extent, were used to write some of our provider methods)
  
• the third examples (23_, 33_, 43_) used our providers to present the security features using the Asp.Net 2.0 Security services. Those are the ones we would normally use in a commercial Asp.Net 2.0 application
  

• you can naturally run the first and second examples, but they directly manipulate the database Tables, which is not recommended
  
• the third set of examples contain
  
  • in the BIN, our provider .DLLs
    
  • in the main folder, the Web.Config tailored to use our providers and database
    

We would advise you

• to get the commercial version of Rad Studio 2007, with the working Delphi
  providers
  
• in all 3 examples using the Security Services (23_, 33_, 43_)
  
  • remove all the .DLLs from the BIN (if they are still there, Asp.Net may complain about duplicate functions)
    
  • keep the default Web.Config (generated when you run an Asp.Net project once)
    

6.2.3 - Our experience of Rad Studio 2007

• we did not like the .XML (Web.Config) editor too much. Numerous tabs, which are reintroduced even if you pretty print the text, some blank lines etc.

  This presentation at times obscured the content, and the typing mistakes we made (on one occasion an example would not work with a modified Web.Config. Copying a previous version and modifying it solved the problem)

• the same goes for the .ASPX editor, but to a lesser degree
  
• sometimes the editor typing slows down. Reloading Delphi solves the problem.
  

• since naming many controls is sometimes slow, we usually copied the previous project in a new folder, renamed the files using the Project Manager, and started modifying this one. But the new BIN now contains two .DLLs, we had duplicate methods. Therefore NEVER copy the BIN
  

7 - Download The Security Source Code

• 01_authentication.zip basic Asp.Net authentication (9 K)
  
• 02_authorization.zip basic Asp.Net authorization (11 K)

• asp_net_security_database.zip the security database used in the subsequent examples (29 K)

• 21_membership_admin.zip create membership Tables, and the .BAT to fill the default database (105 K)
  
• 22_enter_user.zip read / write membership Tables (15 K)
  
• 23_membership_login.zip use the membership services(72 K)

• 31_role_admin.zip create the Roles Table (13 K)
  
• 32_enter_role.zip read / write Roles Table (14 K)
  
• 33_use_roles.zip using the Roles services (46 K)

• 41_profile_admin.zip create the Profile Table (13 K)
  
• 42_enter_profile.zip read / write Profile Table (14 K)
  
• 43_use_profiles.zip use the Profile services (31 K)
  
• 44_profile_class.zip create Profile CLASS and PROPERTY CLASS HELPERS (32 K)
  

• please read the warning about the current version of those examples
  
• the examples which requires a username / password can use the "a" user and "a" password. This works if you use our database. Of course if you fill your own database, you can initialize any username / password.
  

• the main program (.DPROJ, .DPR, .RES), the main form (.PAS, .ASPX .CONFIG), and any other auxiliary form or files
  
• any .TXT for parameters, samples, test data
  
• all units (.PAS .ASPX and other) for units
  

• are self-contained: you will not need any other product
  
• will not modify your PC in any way beyond the path where you placed the .ZIP (no registry changes, no path outside from the container path creation etc).
  

To use the .ZIP:

• create or select a folder
  
• unzip the downloaded file
  
• using Delphi, compile and execute
  

The Pascal code uses the Alsacian notation, which prefixes identifier by program area: K_onstant, T_ype, G_lobal, L_ocal, P_arametre, F_unction, C_lass etc. This notation is presented in the Alsacian Notation paper.

As usual:

• please tell us at fcolibri@felix-colibri.com if you found some errors, mistakes, bugs, broken links or had some problem downloading the file. Resulting corrections will be helpful for other readers
  
• we welcome any comment, criticism, enhancement, other sources or reference suggestion. Just send an e-mail to fcolibri@felix-colibri.com.
  
• or more simply, enter your (anonymous or with your e-mail if you want an answer) comments below and clic the "send" button

  Name :
  E-mail :
  Comments * :

• and if you liked this article, talk about this site to your fellow developpers, add a link to your links page ou mention our articles in your blog or newsgroup posts when relevant. That's the way we operate: the more traffic and Google references we get, the more articles we will write.
  

8 - References

• the Asp.Net 2.0 help
  
• the Microsoft MSDN site
  
• Google to solve some problems not explained in the Help
  

• for database access
  
  • The Ado.Net 2.0 access layer for an Asp.Net 2.0 application
    
  • The Blackfish Sql sql engine, which was used in this presentation
    
  • Delphi Dbx4 Programming for entering new connection strings
    
• for monitoring the data exchange when security is in place:
  
  • Cassini Spy
    

9 - The author