Search code examples
asp.netasp.net-mvcasp.net-membershipasp.net-authentication

What is the minimum ASP.NET provider implementation I need to get a user authenticated and authorized?


By default ASP.NET MVC setups up the AccountController to use the SqlMembershipProvider, SqlProfileProvider and the SqlRoleProvider. I don't really need everything that brings to the table, in fact, it is more of a hassle to shape my data into that model.

What is the minimum I need to implement on the MembershipProvider, RoleProvider and ProfileProvider abstract classes to get authentication and authorization and not break some other dependency that might be there?

For instance, on the ProfileProvider it wants me to override the "FindInactiveProfilesByUserName" method, but I don't really care about this feature. Where is my app going to break when the NotImplementedException fires?

Additionally, on the MembershipProvider for instance, I don't need the FindUsersByEmail method. If I don't implement it will ASP.NET MVC choke at some point? If so, where?


Solution

  • As far as I know, ASP.NET MVC doesn't really do anything for you with regard to authentication. With that in mind, as @chrispr says, you should only need to implement ValidateUser, and the project created by the ASP.NET MVC project template only calls that method during authentication.

    Regarding authorization, I took a look at AuthorizationAttribute in Reflector and found that it calls IPrincipal.IsInRole. Looking at System.Web.Security.RolePrincipal in Reflector, IsInRole calls GetRolesForUser, so you could try implementing only that method to start with.

    I implemented custom providers for similar reasons (I don't like the schema the sql providers use), but I chose not to implement a custom profile provider since it seems to rely on configuration settings for the profile properties, and I didn't want to go that route (see ASP.NET Profile Properties Overview).

    As a side note, I found that looking at the SqlMembershipProvider and SqlRoleProvider in Reflector was helpful when I implemented my own providers, so you might want to do the same.