The document discusses the Membership API in .NET, which provides functionality for user authentication and authorization. It notes that Membership has been part of ASP.NET since the beginning and is provider-based so it can be configured to work with different data stores. It also discusses how Membership can be used not only in web applications but also in desktop applications, web services, and AJAX applications with some additional configuration.

1. Daniel Fisher
daniel.fisher@devcoach.com

4.  In the .NET Framework since the beginning
 Part of ASP.NET
• But who cares 

5. Membership.ValidateUser(userName, password);
Var user = Membership.GetUser(1);
user.Email = "info@lennybacon.com";
Membership.UpdateUser(user);

6. const string adminRole = "Administrator";
if(!Roles.Role.Exists(adminRole))
{
Role.CreateRole(adminRole);
}
IPrinciple user = HttpContext.Current.User;
User.IsInRole(adminRole);

7.  An essential part of the .NET Framework
• System.Threading
• System.Environment
• ...

9.  Membership API is provider based
Membership API
Configuration
Membership ProviderMembership ProviderMembership ProviderMembership Provider
Membership Provider

10. <configuration>
<system.Web>
<membership defaultProvider="SqlProvider">
<providers>
<add
name="SqlProvider"
...
/>
<providers>
</membership>
</system.Web>
</configuration>

11. protected MembershipProvider();
public abstract bool ChangePassword();
public abstract bool ChangePasswordQuestionAndAnswer();
public abstract MembershipUser CreateUser();
protected virtual byte[] DecryptPassword();
public abstract bool DeleteUser();
internal string EncodePassword();
protected virtual byte[] EncryptPassword();
public abstract MembershipUserCollection FindUsersByEmail();
public abstract MembershipUserCollection FindUsersByName();
internal string GenerateSalt();
public abstract MembershipUserCollection GetAllUsers();
public abstract int GetNumberOfUsersOnline();
public abstract string GetPassword(string username, string answer);
public abstract MembershipUser GetUser();
public abstract MembershipUser GetUser();
internal MembershipUser GetUser();
public abstract string GetUserNameByEmail();
protected virtual void OnValidatingPassword();
public abstract string ResetPassword();
internal string UnEncodePassword();
public abstract bool UnlockUser();
public abstract void UpdateUser();
public abstract bool ValidateUser();

12. public abstract string ApplicationName { get; set; }
public abstract bool EnablePasswordReset { get; }
public abstract bool EnablePasswordRetrieval { get; }
public abstract int MaxInvalidPasswordAttempts { get; }
public abstract int MinRequiredNonAlphanumericCharacters { get; }
public abstract int MinRequiredPasswordLength { get; }
public abstract int PasswordAttemptWindow { get; }
public abstract MembershipPasswordFormat PasswordFormat { get; }
public abstract string PasswordStrengthRegularExpression { get; }
public abstract bool RequiresQuestionAndAnswer { get; }
public abstract bool RequiresUniqueEmail { get; }

15.  There are not only ASP.NET Web
Applications
• AJAX
• Desktop
• Web Services
• Rich Internet Applications

16.  ASP.NET AJAX supports Membership
authentication out of the box.
 Just enable it in the config

17. <configuration>
<system.web.extensions>
<scripting>
<webServices>
<authenticationService enabled="true" />
</webServices>
</scripting>
</system.web.extensions>
</configuration>

19.  Visual Studio 2008 offers desktop
applications to enable Membership features
with "one click".

21.  Microsoft ships a provider for
• ASP.NET Database schema
• Windows Accounts
• Active directory
 The API offers full administration of your
authorization store
• BUT...
• The providers running against SAM/AD do not
support a few things...
• Like editing other user accounts 

22.  Windows Communications Foundation is
one of the most pluggable and configurable
thing the world has seen.
 Of course this is also true for its security
features.

23.  Derive from the base class
UserNamePasswordValidator.
Override the method Validate.
 Configure the class in the service behavior
section as service credentials to use.

24. <configuration>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="MyBahavior">
<serviceCredentials>
<userNameAuthentication
customUserNamePasswordValidatorType="..."
userNamePasswordValidationMode="Custom"
/>
</serviceCredentials>
</behavior>
</serviceBehaviors>
</system.serviceModel>
</configuration>

25.  Implement the interface
IAuthorizationPolicy.
 Configure the extension in the service
behavior section as service authorization to
use.

26. <configuration>
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="MyBahavior">
<serviceAuthorization
principalPermissionMode="Custom">
<authorizationPolicies>
<add policyType="..."/>
</authorizationPolicies>
</serviceAuthorization>
</behavior>
</serviceBehaviors>
</system.serviceModel>
</configuration>

28.  There is no Membership in Silverlight
• But we can use the AJAX API...
 So the limiting factor is the network
connectivity...

32. devcoach®SOFTWARE://DEVELOPMENT+ARCHITECTURE+CONSULTING