The Login control, like most of the other ASP.NET login controls, is simple in appearance but robust in functionality. In its simplest terms, the Login control provides users with textboxes for entering a username and a password, as shown in Figure 31.1. A “Remember Me” checkbox is also provided so that users don’t have to log in on each subsequent visit to your Web site.

Figure 31.1. The Login control is simple in appearance, but there’s a lot of functionality under the hood.

The Login control also implements form validation so that users cannot submit a form without supplying both a username and a password.

Figure 31.1 shows the default appearance of the Login control. You can reformat it using CSS styles or by using the AutoFormat option on the Common Login Tasks popup. By choosing one of the six available formatting options, as shown in Figure 31.2, you can quickly change the appearance of the entire control.

Figure 31.2. You can quickly give the Login control a new look using the AutoFormat dialog.

Because the Login control is a single control, you cannot move the elements in the control by default. If you want to rearrange the controls that make up the Login control, you’ll need to convert the control to a template—, which is referred to as a templated control. By converting the control to a template, you will have access to all the constituent controls that make up the Login control. All the functionality remains the same.

To convert the Login control to a template, click the button at the upper right of the control to access the Common Login Tasks popup and click the Convert to Template link. After you do this, the controls within the Login control will immediately become accessible, as shown in Figure 31.3.

Figure 31.3. Converting the Login control to a template allows access to the controls that comprise it. Notice here that the Button control is selected. Accessing the button is impossible before converting the control to a template.

To convert the Login control back to a regular control instead of a template, click the button on the control to access the Common Login Tasks popup and click the Reset option. Any changes you made to the control while it was in a templated state will be reset and the control will take on its default appearance.

Converting a control to a template is more powerful than it may seem at first. As you will see shortly, there are many properties for the Login control that enable several other user interface elements. For example, the control can display links for help text or user registration. By converting the control to a template, you have full control over the placement of all parts of the control.

The built-in functionality of the Login control isn’t limited to the appearance of the control. When the Log In button on the control is clicked, ASP.NET will automatically do a lookup on the user and authenticate him/her. If the user presents incorrect credentials, the control will notify the user. If the credentials are correct, the control will log the user in and redirect him/her to the page specified in the DestinationPageUrl property of the control.

There are many other useful properties of the Login control that can be accessed via the Tag Properties task pane.

As you can see from that rather long list of properties, the Login control is quite a bit more powerful than it seems at first.

The LoginStatus control has two views: one view for when the user is logged in and one for when the user is logged out. As shown in Figure 31.4, the view of the control can be configured using the dropdown available in the Common LoginStatus Tasks popup.

Figure 31.4. ASP.NET will automatically choose the correct view for the LoginStatus control based on whether the user is authenticated, but you can choose the view yourself if you wish.

Some of the useful properties of the LoginStatus control are as follows:

The LoginName control is perhaps the simplest of the login controls. It displays the name of the logged-in user.

By default, the control displays only the username. By altering the FormatString property, you can alter the text that is displayed. For example, if a user named Jim is logged into the Web site and the FormatString property is set to Logged in as {0}, the LoginName control would display the text “Logged in as Jim”.

The ChangePassword control (Figure 31.5) allows a user to change his or her password. In the default configuration, users are required to be logged in to change their password. However, the ChangePassword control can be configured to also prompt for the username. In those situations, a user can change his or her password without logging in. In fact, when the username field is displayed on the control, it is possible for a user to change the password of a different user as long as he or she knows the old password of the user whose password is being changed.

Figure 31.5. The Change-Password control makes it easy for a user to change his or her password. In some configurations, a user can even change someone else’s password.

Similar to the Login control, the Common ChangePassword Tasks popup shown in Figure 31.6 provides you with an AutoFormat link for easy formatting of the control and a link to convert the control to a template for more precision over the layout of the control.

Figure 31.6. The Common ChangePassword Tasks popup offers similar options to the Login control with the addition of a Views dropdown for switching between the two views provided by the control.

The ChangePassword control also includes a Views dropdown that allows you to switch between the Change Password view and the Success view. The Success view is displayed when a user has successfully changed his or her password. Figure 31.6 shows the Change Password view of the control and Figure 31.7 shows the Success view.

Figure 31.7. When a user has successfully changed his or her password, the Success view is displayed.

The ChangePassword control has many properties that allow you to customize the control’s appearance and behavior. Because the list is long, we won’t go over the properties that are similar to corresponding properties of the Login control. Refer back to that section of this chapter to refresh your memory if necessary.

DisplayUserName Property

The DisplayUserName property controls whether or not a textbox for entry of a username exists on the control. If the DisplayUserName property is true and a user is already logged in, the user will have the ability to change the password of another user assuming he or she knows the other user’s password. The ChangePassword control shown in Figure 31.8 has a DisplayUserName property of true.

Figure 31.8. You can display a textbox for a user’s username by setting the DisplayUserName property to true.

By placing the ChangePassword control on a page that can be browsed without logging into the site (a page that can be browsed anonymously), a user can change his or her password without logging into the site, provided the DisplayUserName property is set to true.

MailDefinition Property

The MailDefinition property provides the ability to send users an e-mail after a successful password change. The MailDefinition property is actually a reference to a special object in the .NET Framework called MailDefinition.

Note

We’re delving into some basic programmatic concepts as we discuss the MailDefinition property. Because this isn’t a programming book, we won’t go into great detail on this property. I’ll explain how it’s used, but if you want the down-and-dirty details, your best resource is the MSDN Web site at http://msdn2.microsoft.com.

The details on the MailDefinition class can be found by browsing to http://msdn2.microsoft.com/en-US/library/system.web.ui.webcontrols.maildefinition(VS.80).aspx.

As shown in Figure 31.9, the MailDefinition property expands into several different fields:

• BodyFileName—. The BodyFileName field allows you to specify a file that will be used for the body of the e-mail sent by the ChangePassword control. Any occurrence of <%UserName%> in this file will automatically be replaced by the username of the user, and any occurrence of <%Password%> will automatically be replaced by that user’s new password.

• CC—. E-mail address(es) that should be copied on the e-mail. If you’d like to enter more than one address, separate the e-mail addresses with commas.

• EmbeddedObjects—. The EmbeddedObjects property is a collection of images or graphics to be embedded into the e-mail. When you click the button next to this property, the EmbeddedMailObject Collection Editor appears, as shown in Figure 31.10. The code to insert these objects into the e-mail is included in the file specified by the BodyFileName property.

Figure 31.9. The Mail-Definition property is actually a collection of many fields that make it easy to define an e-mail to send to users upon a password change.

Figure 31.10. Embedding images in your e-mail is accomplished via the EmbeddedMailObject Collection Editor. In this case, a company logo is being added.

The following code inserts the embedded object shown in Figure 31.10:

<img src="cid:CompanyLogo" alt="Jimco Software" />

• From—. The From property specifies the originating e-mail address for the e-mail.

• IsBodyHtml—. This property specifies whether or not the file specified by the BodyFileName property contains HTML code or plain text. If you have set the EmbeddedObjects property, you should set the IsBodyHtml property to true.

• Priority—. The priority at which the e-mail will be sent. Valid values are Normal, Low, and High.

• Subject—. The subject of the e-mail.

Tip

To send e-mail, the computer on which the Web site resides must have the SMTP service configured on it. You can get information on how to configure SMTP by browsing to http://msdn2.microsoft.com/en-US/library/8b83ac7t(VS.80).aspx.

Caution

When using the MailDefinition property, keep in mind that e-mail can be intercepted fairly easily by someone other than the intended recipient. Use caution.

The PasswordRecovery control is designed to allow a user to gain access to your site even in cases of a forgotten password. The name of the control is a bit misleading. By default, a user cannot recover his or her password. Instead, a new one is assigned and sent in an e-mail. That’s because ASP.NET uses an irreversible hashing algorithm before storing a password by default. It is possible to change this behavior and store passwords encrypted. When a password is encrypted, it can be decrypted and recovered for the user.

As with the other controls we’ve reviewed, the PasswordRecovery control can be auto-formatted for a more pleasing appearance using the AutoFormat dialog shown in Figure 31.11. This dialog is accessible via the Common PasswordRecovery Tasks popup. The PasswordRecovery control is also a templated control, so you can rearrange the layout if you wish.

Figure 31.11. The Password-Recovery control can be formatted for a more pleasing appearance using the AutoFormat dialog.

When a user changes his or her password, the process actually occurs in a series of three steps. In the first step, the user is asked for his or her username. After the Submit button is clicked, the user is asked for the answer to his or her secret question provided when he or she registered for the Web site. Assuming the answer is correct, the user is presented with a message indicating that the password is being e-mailed.

Each of these steps is accessible in Expression Web using the Views dropdown in the Common PasswordRecovery Tasks popup, as shown in Figure 31.12. Because the control is templated, you can convert one or more of these steps to a template and control the layout and other functionality of each step.

Figure 31.12. The Password-Recovery control consists of three different views to allow a user to retrieve or reset a password. The Question view is shown here.

The properties of the PasswordRecovery control are similar to the properties for the other login controls we’ve covered, so there’s no need to cover the details here.

The CreateUserWizard control (Figure 31.13) is a wizard-based control that makes it easy for new users of your Web site to create an account so they can log in. The CreateUserWizard control is actually a customized ASP.NET Wizard control, so the configuration options available are the same options used for the Wizard control.

Figure 31.13. The CreateUser-Wizard control is a customized wizard control designed to allow users to easily create new accounts for your Web site.

Several properties are unique to the CreateUserWizard control. The following are a few that affect the behavior of the control:

The CreateUserWizard control exposes a MailDefinition object so you can send the new user his or her login information via e-mail if you choose. We discussed the requirements for sending e-mail in the overview of the ChangePassword control earlier in this chapter.

So far, we’ve covered controls that have a single purpose. The LoginView control is a break from that pattern. The LoginView control is a container control for other controls and provides you with, by default, two views: the AnonymousTemplate view and the LoggedInTemplate view.

Controls that you place in the AnonymousTemplate view, as shown in Figure 31.14, will be visible only to users who have not yet logged into the site. In Figure 31.14, I have inserted a Login control into the AnonymousTemplate view so that users can log in if they haven’t done so.

Figure 31.14. The Anonymous-Template view is visible only to users who are browsing anonymously. Once a user logs in, he or she will no longer see the Anonymous-Template view.

On the other hand, Figure 31.15 shows the LoggedInTemplate view, where I have inserted LoginStatus and LoginName controls. I changed the LoginStatus control’s view to the Logged In view so it will provide a link for the user to log out.

Figure 31.15. The LoggedIn-Template is usually visible to users who have logged into the Web site. As you’ll soon see, the user may see a different view instead.

The LoginView control is commonly used on pages where anonymous content is present, but you also want to provide a login interface in one part of the page so that users can log in if desired. A forum page is an excellent example of a page suitable for this kind of control. Users can browse the forums anonymously. If they want to post on the forum, they can log in right on the page they are currently viewing without having to redirect to a login page and lose their place.

As shown in Figures 31.14 and 31.15, the Common LoginView Tasks popup contains a link for editing RoleGroups. This allows you to define a template for different ASP.NET roles to which a user may belong using the RoleGroup Collection Editor shown in Figure 31.16. In Figure 31.16, you can see that I’ve defined a role called Administrators. If the logged-in user is a member of the Administrators role, he or she will see the view associated with that role instead of the LoggedInTemplate view. Figure 31.17 shows the new role selected in the Common LoginView Tasks popup.

Figure 31.16. The RoleGroup Collection Editor allows for the creation of views for specific ASP.NET roles that have been previously created.

Figure 31.17. When a new RoleGroup has been added, you’ll have a new view to choose in the Views dropdown. Users who are in the Administrators role will see the new Administrators view.

In ASP.NET 1.0 and 1.1, configuring Forms authentication required the manual editing of configuration files. ASP.NET 2.0 makes the job significantly easier by providing a Windows interface into the configuration options.

Note

If you don’t see an ASP.NET tab in the Properties dialog for your Web application, see “ASP.NET Tab Is Missing” in the “Troubleshooting” section of this chapter.

Now we need to configure the application so that no one can browse it anonymously. We’ll use ASP.NET’s authorization features to implement this restriction.

You have just configured an ASP.NET Forms authentication Web site and set the authorization of the site so that anonymous users are not allowed.

The ASP.NET Development Server does not have a Windows interface for modifying the configuration of your site, so you’ll need to create a configuration file for that purpose. To make matters even more confusing, Expression Web does not have IntelliSense for ASP.NET configuration files.

To control the configuration of a specific Web application, ASP.NET uses a special configuration file in the root of the Web site called web.config. The web.config file contains XML code that controls many aspects of the Web site.

To configure our Web site for ASP.NET membership, we’ll need to do the following:

Begin by selecting File, New, Page and selecting XML from the list of file types. Place your cursor after the XML code that Expression Web adds by default and enter the following code:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
    <system.web>
        <authentication mode="Forms" />
        <authorization>
            <deny users="?" />
        </authorization>
        <identity impersonate="true" />
    </system.web>
</configuration>

Now save the file as web.config. Make sure to select All Files (*.*) from the Save as type dropdown. Otherwise, Expression Web will automatically add an .xml file extension to your file.

Note that the outermost element in the web.config file is the <configuration> section. Within that section is a <system.web> section. This is where you make changes to ASP.NET configuration.

In this case, the first element inside the <system.web> section is the <authentication> element. We have enabled ASP.NET Forms authentication by setting the mode of the <authentication> element to Forms.

The next element defines the <authorization> section. The <authorization> section allows you to control who has access to the Web site. In this case, we want to disallow anyone from browsing the site unless they have been authenticated. The <deny> tag allows us to do that. By specifying a users attribute with a value of ?, we are telling ASP.NET that any user who is not authenticated should be denied access.

The next element is the <identity> element. We use this element to turn on ASP.NET Impersonation. The ASP.NET application would normally execute under the identity of the process in which it runs. By enabling ASP.NET Impersonation, we’re forcing our page to run under the identity of the user who is authenticated to our application.

Our membership site will only require two pages: the login page and a content page. In a real application, you’d probably want to have a separate login page and new user page, but in this sample, we’ll use one page for both functions.

Your default.aspx page should now look like Figure 31.22. When a user logs in and sees this content, the controls will allow him/her to log out easily.

Figure 31.22. The content page will use ASP.NET login controls to allow a user to easily log out.

Now you’re ready to try out the Web site. Try browsing to the default.aspx page. You should be redirected automatically to the login.aspx page because you have not yet logged in.

Note

If you get an error saying “Failed to access IIS metabase” when browsing the ASP.NET page, see “Metabase Access Fails Browsing ASP.NET Page” in the “Troubleshooting” section of this chapter.

Note

If you get an error saying “Failed to start monitoring file changes” or “Failed to start monitoring directory changes” when browsing the ASP.NET page, see “Failed to Start Monitoring Changes Error” in the “Troubleshooting” section of this chapter.

Fill out the form to sign up for a new account, as shown in Figure 31.23, and click the Create User button to create your account. You’ll be presented with a message letting you know that the account has been successfully created, as shown in Figure 31.24.

Figure 31.23. The CreateUser-Wizard control will not only collect all the information for a new user, but it will also create the user database when the first user is created.

Figure 31.24. Your new user account has been created and you can now log in using your new user credentials.

Note

If you get an error that says “Access denied creating App_Data subdirectory”, see “Access Denied Error” in the “Troubleshooting” section of this chapter.

When you create the first user in an ASP.NET membership application, the SQL Server 2005 Express Edition database will be created for you automatically.

As you’ve seen in this chapter, creating a powerful membership system in ASP.NET 2.0 and Expression Web is as simple as just dropping the controls on the page. We created an entire application without writing a single line of code.

I’ve opened the properties for my Web site, but there isn’t an ASP.NET tab.

There are many reasons for this, but the most common is missing Registry information. Open a command prompt and run the following command:

Regsvr32.exe %windir%microsoft.netframeworkv2.0.50727mmcaspext.dll

This will add the Registry information for the file that creates the tab and will hopefully correct the problem. If that doesn’t correct your problem, open a command prompt and run the following commands:

cd %windir%microsoft.netframeworkv2.0.50727
aspnet_regiis –i

I’m browsing my ASP.NET page and I see an error that says “Failed to access IIS metabase.” What does this mean?

This is a permissions issue. The account that is used to run ASP.NET needs access to a special database IIS uses to keep track of its settings.

To correct this problem, open a command prompt and switch to the following directory:

%windir%microsoft.netframeworkv2.0.50727

At the command line, run the following command if using Windows 2000 or Windows XP:

aspnet_regiis –ga ASPNET

If you’re using Windows 2003, run the following command:

aspnet_regiis –ga IISWPG

When browsing my ASP.NET page, I get an error that says “Failed to start monitoring file changes” or “Failed to start monitoring directory changes.”

This error means that the ASP.NET process account does not have permission to access the Web site’s content. Here’s how to fix it.

When browsing my membership site, I get an error that says “Access denied creating App_Data subdirectory.” How do I fix this?

The steps to resolve this are the same as the steps to resolve the “Failed to Start Monitoring Changes Error” in the previous troubleshooting note.