The .NET Framework includes three built-in methods of authenticating users—Windows Authentication, Forms Authentication, and .NET Passport Authentication. All three authentication methods follow a similar model. In other words, if you understand how to configure one, you can configure the other two.

Windows Authentication uses Windows accounts and groups. Microsoft .NET Passport Authentication uses Microsoft Passport user accounts (the same user accounts that are used by such Microsoft services as HotMail and MSN).

In this chapter, we’ll concentrate on Forms Authentication because this is the type of authentication that you are most likely to set up for a Web application. Forms Authentication, unlike the other two authentication models, enables you to store usernames and passwords in a custom data store, such as a database table or XML file.

<configuration>
<system.web>
  <authentication mode="Forms" />
</system.web>
</configuration>

<configuration>
<system.web>
  <authorization>
    <deny users="?" />
  </authorization>
  </system.web>
</configuration>

<configuration>
<system.web>
  <authentication mode="Forms">
    <forms loginUrl="mylogin.aspx" />
  </authentication>
</system.web>
</configuration>

<configuration>
<system.web>
  <authorization>
    <allow users="Jane" />
    <deny users="*" />
  </authorization>
  </system.web>
</configuration>

In this section, we’ll walk through each of the steps required to enable Forms Authentication. We’ll password-protect all the pages in a directory named SecretFiles so that only users who log in can view the pages.

The first step is to enable Forms Authentication by modifying the Web.Config file located in the root directory of your application.

This Web.Config file enables Forms Authentication for your entire application. Making these modifications does not password protect any pages. However, it is a necessary step before you can password protect a page.

Next, we need to create the Web Form Page that we want to password protect.

Finally, to password protect the files in the SecretFiles folder, we must add a second Web.Config file to the SecretFiles folder. This second Web.Config file contains an <authentication> section that prevents anonymous users from accessing the folder.

After you complete this last set of steps, all of the files in the SecretFiles folder are password protected. If you right-click the Secret.aspx page in the Solution Explorer window and select Build and Browse, you’ll receive a “404 File Not Found Error” (see Figure 16.1). You have been automatically redirected to a page named Login.aspx that doesn’t exist. We’ll create the Login.aspx page in the next section.

Figure 16.1. Accessing a password-protected page.

Creating a Simple Login Page

If a user attempts to access a password protected page, he or she is automatically redirected to a page named Login.aspx. In this section, you’ll learn how to create a simple forms authentication Login.aspx page (see Figure 16.2).

Figure 16.2. A simple login page.

Our login page will allow a user to log in only when the user enters the username Administrator and the password Secret. Perform the following steps to add the necessary controls to the Login.aspx page:

1. Add a new Web Form Page to the root folder of your project named Login.aspx.

2. Drag a Label control from the Web Forms tab in the Toolbox onto the Designer surface. Clear the Text property of the Label control.

3. Drag a TextBox control from the Web Forms tab onto the Designer surface and assign the following values to its properties:

   Property	Value
   ID	txtUsername

4. Drag a second TextBox control from the Web Forms tab in the Toolbox onto the Designer surface and assign the following values to its properties:

   Property	Value
   ID	txtPassword
   TextMode	Password

5. Drag two HTML labels from the HTML tab onto the Designer surface. Enter the text Username for the first label and the text Password for the second label. Position the labels next to the TextBox controls.

6. Drag a Button control from the Web Forms tab onto the Designer surface.

Next, we need to add the application logic to the page that authenticates the username and password that the user enters into the form.

1. Double-click the Button control. This will switch you to the Code Editor and create a Button1_Click handler.

2. Enter the following code for the Button1_Click handler:

   C#. 

   private void Button1_Click(object sender, System.EventArgs e)
   {
     if (txtUsername.Text == "Administrator" && txtPassword.Text == "Secret")
       System.Web.Security.FormsAuthentication.RedirectFromLoginPage( txtUsername.Text, false );
     else
       Label1.Text = "Invalid Username/Password";
   }
   

   VB.NET. 

   Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs)
    Handles Button1.Click
     If txtUsername.Text = "Administrator" And txtPassword.Text = "Secret" Then
       System.Web.Security.FormsAuthentication.RedirectFromLoginPage( txtUsername.Text, False)
     Else
       Label1.Text = "Invalid Username/Password"
     End If
   End Sub
   

3. Right-click the Secret.aspx page (not the Login.aspx page) in the Solution Explorer window and select Build and Browse.

When you complete the last step, the Secret.aspx page will not appear. Instead, you’ll be automatically redirected to the Login.aspx page. If you enter Administrator and Secret, you will be automatically redirected back to the Secret.aspx page (the username and password are case sensitive).

The Button1_Click handler first checks whether the txtUsername and txtPassword TextBox controls contain the values Administrator and Secret. If the values match, the RedirectFromLoginPage() method is called.

The RedirectFromLoginPage() method does two things. First, it issues an Authentication Ticket to the user’s browser. The Authentication Ticket is an encrypted cookie that identifies the user. It also automatically redirects the user back to the original page that the user requested by secretly calling the Response.Redirect() method.

The RedirectFromLoginPage() method accepts two parameters. The first parameter represents a username. The username can be any string, including an email address. The second parameter indicates whether a persistent cookie should be created. When the second parameter has the value true, the user does not have to log in the next time the user visits the Web site. The Authentication cookie is saved persistently on the user’s browser.

Note

The RedirectFromLoginPage() method redirects the user to the original page the user requested. There is a special situation, however, when the user requests the Login.aspx page directly. In that situation, there is no page to which the user can be redirected, so the user is redirected to the Default.aspx page.

In the Login.aspx page that we built in the previous section, we checked whether the user entered the username Administrator and the password Secret. Our application isn’t particularly useful because only one person can ever log in. In this section, you’ll learn how you can store a list of usernames and passwords in the Web.Config file.

Storing usernames and passwords in the Web.Config file is valuable when you need to maintain a limited number of usernames and passwords. For example, if your Web application contains a private section for administrators of the application, you can password protect the section and store a list of valid administrators in the Web.Config file.

Perform the following steps to modify the pages that we created in the previous section:

After you complete these steps, you can view the Secret.aspx page only if you enter one of the username and password combinations contained in the application Web.Config file. We modified the Login.aspx page to use the Authenticate() method to check usernames and passwords. The Authenticate() method simply performs a match against usernames and passwords in the Web.Config file.

If you need to maintain a large number of usernames and passwords, storing them in the Web.Config file quickly becomes unmanageable. A better choice is to store user credentials in a database table.

In this section, we’ll configure our application to use Forms Authentication with a database table. We will start over from scratch by creating the necessary database objects, a registration page, and a new login page.

Let’s start by creating the database objects. Perform the following steps to create the database table that will contain the usernames and passwords:

Next, we need to create a stored procedure that verifies username and passwords against the UserList table. We’ll name our stored procedure CheckPassword. It will return one of three possible values:

0—Username and password are valid

1—Password is invalid

2—Username is invalid

Do the following to create the stored procedure:

Next, we need to create the Web Form Page that we want to password protect.

Next, we need to add the necessary Web.Config files to enable Forms Authentication and to password protect the Confidential folder.

Finally, we need to create the Login.aspx page. (If a Login.aspx page already exists in your project, you can modify it.)

Next, you need to add the CheckPassword stored procedure to the Login.aspx page and create the Button_Click handler that calls the stored procedure:

The Login.aspx page calls the CheckPassword stored procedure to verify the username and password entered into the form. If the username and password combination is valid, the user is redirected to the original page requested; otherwise, an appropriate error message is displayed in a Label control.

You can test the Login.aspx page by entering one or more usernames and passwords into the UserList table. Double-click the UserList table in the Server Explorer window and enter the usernames and passwords directly into the grid. Alternatively, you can add the Register.aspx page to your project as discussed in the next section to your project.

Adding a Registration Page

One of the primary advantages of using Forms Authentication with a database table is that it makes it easy to create a registration form. To enable users to register at your Web site, they only need to complete a form that adds their usernames and passwords to the appropriate database table.

In this section, we’ll extend the database application that we created in the previous section with a registration form (see Figure 16.3).

Figure 16.3. The registration form.

First, we need to create the stored procedure that adds a new user to the UserList table.

1. Right-click the Stored Procedures folder under the Northwind Data Connection in the Server Explorer window and select New Stored Procedure.

2. Enter the following code for the new stored procedure:

   CREATE PROCEDURE dbo.AddUser
   (
     @Username Varchar( 20 ),
     @Password Varchar( 20 )
   )
   AS
   If Exists
   (
     Select User_ID From UserList
     Where User_Username = @Username
   )
   Return 1
   
   Insert UserList
   (
     User_Username,
     User_Password
   )
   Values
   (
     @Username,
     @Password
   )
   

3. Click Save.

Next, we need to add a link to the Login.aspx page to the Register.aspx page.

1. Open the Login.aspx page by double-clicking the page in the Solution Explorer window.

2. Add a HyperLink control to the page by dragging the control from under the Web Forms tab in the Toolbox onto the Designer surface.

3. Assign the value New users click here to register! to the HyperLink control’s Text property.

4. Double-click the Designer surface to switch to the Code Editor.

5. Enter the following Page_Load handler:

   C#. 

   private void Page_Load(object sender, System.EventArgs e)
   {
   if (!Page.IsPostBack)
     HyperLink1.NavigateUrl =
       String.Format(
         "Register.aspx?ReturnURL={0}",
         Server.UrlEncode( Request.QueryString[ "ReturnURL" ] ) );
   }
   

   VB.NET. 

   Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles
    MyBase.Load
     If Not Page.IsPostBack Then
       HyperLink1.NavigateUrl = String.Format("Register.aspx?ReturnURL={0}",  Server
   .UrlEncode(Request.QueryString("ReturnURL")))
     End If
   End Sub
   

Perform the following steps to create the Register.aspx page and add the necessary controls to the page:

1. Add a new Web Form Page to your project named Register.aspx.

2. Add a TextBox control to the Web Form Page and assign the following values to its properties:

   Property	Value
   ID	txtUsername

3. Add a second TextBox control to the Web Form Page and assign the following values to its properties:

   Property	Value
   ID	txtPassword
   TextMode	Password

4. Add a third TextBox control to the Web Form Page and assign the following values to its properties:

   Property	Value
   ID	txtPassword2
   TextMode	Password

5. Add three HTML Label elements to the Web Form Page. Enter the text Username, Password, and Password Again into the labels and position them appropriately on the page.

6. Add a RequiredFieldValidator control to the page. Assign the following values to the control’s properties:

   Property	Value
   ControlToValidate	txtUsername
   Text	Required!

7. Add a second RequiredFieldValidator control to the page. Assign the following values to the control’s properties:

   Property	Value
   ControlToValidate	txtPassword
   Text	Required!

8. Add a CompareValidator control to the page. Assign the following values to the control’s properties:

   Property	Value
   ControlToValidate	txtPassword
   ControlToCompare	txtPassword2
   Text	Passwords must match!

9. Add a Label control to the Designer surface.

10. Add a Button control to the Designer surface.

Next, you need to add the application logic to the page that adds the new username and password to the database table.

1. Drag the AddUser stored procedure from the Server Explorer window onto the Register.aspx page.

2. Double-click the Button control. This will switch you to the Code Editor and add a Button1_Click handler.

3. Enter the following code for the Button1_Click handler:

   C#. 

   private void Button1_Click(object sender, System.EventArgs e)
   {
     int intResult = 0;
   
     sqlCommand1.Parameters[ "@Username" ].Value = txtUsername.Text;
     sqlCommand1.Parameters[ "@Password" ].Value = txtPassword.Text;
     sqlConnection1.Open();
     sqlCommand1.ExecuteNonQuery();
     intResult = (int)sqlCommand1.Parameters[ "@RETURN_VALUE" ].Value;
     sqlConnection1.Close();
   
     if (intResult == 0)
       System.Web.Security.FormsAuthentication.RedirectFromLoginPage(
         txtUsername.Text, false );
     else
       Label1.Text = "Username already taken!";
   }
   

   VB.NET. 

   Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs)
    Handles Button1.Click
     Dim intResult As Integer
   
     SqlCommand1.Parameters("@Username").Value = txtUsername.Text
     SqlCommand1.Parameters("@Password").Value = txtPassword.Text
     SqlConnection1.Open()
     SqlCommand1.ExecuteNonQuery()
     intResult = SqlCommand1.Parameters("@RETURN_VALUE").Value
     SqlConnection1.Close()
   
     If intResult = 0 Then
       System.Web.Security.FormsAuthentication.RedirectFromLoginPage( txtUsername.Text, False)
     Else
       Label1.Text = "Username already taken!"
     End If
   End Sub
   

4. Right-click the TopSecret.aspx page in the Solution Explorer window and select Build and Browse.

When you build and browse the TopSecret.aspx page, you’ll be redirected to the Login.aspx page. If you click the New Users Click Here to Register! link, the Register.aspx page opens.

The Register.aspx page prevents you from entering a username that already exists in the UserList table. If you enter a new username and password, the username and password will be added to the database, and you will be automatically redirected to the TopSecret.aspx page.

Custom roles enable you to apply security settings to groups of users. For example, instead of explicitly denying access to a page to Jane and Bob, you can add Jane and Bob to a custom role named Guests and deny access to all members of that role.

You can create custom roles when configuring Forms Authentication such as Administrators, Supervisors, and Moderators roles. The roles do not need to correspond to Windows groups. You can make up any set of roles that you want.

After you create the custom roles, you can refer to them in the Web.Config file to control access to pages in a folder. For example, you can specify that only Administrators have the right to access the pages in a particular folder.

In this section, we’ll modify the application that we created in the previous section to associate different roles with different users.

First, we need to add an additional column to the UserList database table that we’ll use to represent the roles associated with a user:

Next, we need to create a new stored procedure to retrieve the roles for a user:

Next, we need to modify the Global.asax file to associate the proper roles with a user.

Finally, we need to modify the authorization Web.Config file to allow only users in the Administrators role access to pages. Modify the Web.Config file in the Confidential folder as follows:

<configuration>
<system.web>
  <authorization>
      <allow roles="Administrators" />
     <deny users="*" />
  </authorization>
</system.web>
</configuration>

This Web.Config file allows members of the Administrators role access to pages but denies access to everyone else.

You can test the custom roles by assigning a comma-delimited list of roles to the User_Roles column in the UserList table. For example, if you assign the string Administrators,Operators to the User_Roles column, that user will be associated with both the Administrators and Operators roles.

In this chapter, you learned how to password protect pages in your application by taking advantage of Forms Authentication. You learned how to configure both authentication and authorization for Forms Authentication by using the Web.Config file.

You discovered how to store usernames and passwords in two places—the Web.Config file and a database table. Finally, you tackled an advanced feature of Forms Authentication; You created an application that makes use of custom user roles.