When I started a new ASP project I was eager to use the login facilities
offered in Framework 2.0/VS 2005.
I wanted:
- A custom principal that could hold my integer UserID from the database
- An easy way to classify different pages as either Admin, Member or Public,
where login is necessary for Admin and Member but not for Public. My idea was
to put the pages in different directories to easily keep my order.
- An easy menu system that would show only accesible pages
I carefully read the newsgroups and put together what I thought was a good
mix of working ideas. I think I am quite close but I don't really make it all
through.
Hopefully someone can give me a hint by scanning through my code sample:
=============== =============== =============== ==
web.config content:
<authenticati on mode="Forms">
<forms loginUrl="Publi c/Login.aspx" defaultUrl="/Default.aspx"
name=".ASPXFORM SAUTH" path="\">
</forms>
</authentication>
<authorizatio n>
<deny users="?"/>
<allow users="*"/>
</authorization>
Global.asax content:
<script runat="server">
Protected Sub Application_Aut henticateReques t(ByVal sender As Object,
ByVal e As System.EventArg s)
Dim app As HttpApplication
Dim authTicket As FormsAuthentica tionTicket
Dim authCookie As String = ""
Dim cookieName As String = FormsAuthentica tion.FormsCooki eName
Dim userIdentity As FormsIdentity
Dim userData As String
Dim userDataGroups As String()
Dim PersonID As Integer
Dim roles As String()
Dim userPrincipal As CustomPrincipal
Dim AllowAccess as Boolean
app = DirectCast(send er, HttpApplication )
If app.Request.IsA uthenticated AndAlso
app.User.Identi ty.Authenticati onType = "Forms" Then
Try
'Get authentication cookie
authCookie = app.Request.Coo kies(cookieName ).Value
Catch ex As Exception
'Cookie not found generates exception: Redirect to loginpage
Response.Redire ct("Login.aspx" )
End Try
'Decrypt the authentication ticket
authTicket = FormsAuthentica tion.Decrypt(au thCookie)
'Create an Identity from the ticket
userIdentity = New FormsIdentity(a uthTicket)
'Retrieve the user data from the ticket
userData = authTicket.User Data
'Split user data in main sections
userDataGroups =
userData.Split( CustomPrincipal .DELIMITER_SECT IONS)
'Read out ID and roles
PersonID = CType(userDataG roups(0), Integer)
roles = userDataGroups( 1).Split(Custom Principal.DELIM ITER_ROLES)
'Rebuild the custom principal
userPrincipal = New CustomPrincipal (userIdentity, PersonID, roles)
'Set the principal as the current user identity
app.Context.Use r = userPrincipal
End If
'If we already are heading for Login page then we don't need to
check anything more
If Request.Url.Abs olutePath.ToLow er =
FormsAuthentica tion.LoginUrl.T oLower Then
Exit Sub
End If
'Evaluate if access is allowed
Select Case BaseDirectory(R equest.Url)
Case "Member", "Admin"
'For all restricted pages we need to check user validity
If IsNothing(app.C ontext.User) Then
'User is not authenticated
AllowAccess = False
ElseIf IsNothing(SiteM ap.CurrentNode) OrElse
(SiteMap.Curren tNode.Roles.Cou nt = 0) Then
'Missing SiteMap means access is implicitly allowed
AllowAccess = True
Else
AllowAccess = False
'Loop through each role and check to see if user is in
one of them
For Each Role As String In SiteMap.Current Node.Roles
If app.Context.Use r.IsInRole(Role ) Then
AllowAccess = True
Exit For
End If
Next
End If
Case Else
'Public folders are always OK
AllowAccess = True
End Select
If Not AllowAccess Then
Response.Redire ct(FormsAuthent ication.LoginUr l)
End If
End Sub
Protected Function BaseDirectory(B yVal u As System.Uri) As String
Select Case u.Segments.Leng th
Case Is < 3
Throw New Exception("Base Directory expecting at least one
level of directories")
Case 3
Return ""
Case Else
Return u.Segments(2).R eplace("/", "")
End Select
End Function
</script>
Public Class CustomPrincipal
Inherits System.Security .Principal.Gene ricPrincipal
Private _PersonID As Integer
Public Const DELIMITER_SECTI ONS As String = ";"
Public Const DELIMITER_ROLES As String = ","
Public Enum Roles
Member = 1
Editor = 2
Admin = 3
End Enum
Public Sub New(ByVal identity As System.Security .Principal.IIde ntity,
ByVal PersonID As Integer, ByVal roles As String())
MyBase.New(iden tity, roles)
_PersonID = PersonID
End Sub
Public ReadOnly Property UserName() As String
Get
Return MyBase.Identity .Name
End Get
End Property
Public ReadOnly Property PersonID() As Integer
Get
Return _PersonID
End Get
End Property
Public Shadows ReadOnly Property IsInRole(ByVal role As Roles) As Boolean
Get
Return MyBase.IsInRole (role)
End Get
End Property
End Class
Partial Class Login
Inherits System.Web.UI.P age
Protected Sub cmdLogin_Click( ByVal sender As Object, ByVal e As
System.EventArg s) Handles cmdLogin.Click
Dim p As Person
Dim RedirectUrl As String
Try
p = New Person
p.Load(txtUserI D.Text, txtPassword.Tex t)
If p.IsEmpty Then
Throw New Exception("Logi n failed. Please check your
username and password and try again.")
End If
'Create a ticket with validated user
CreateAuthentic ationTicket(p, chkPersist.Chec ked)
'Redirect to requested page
RedirectUrl = GetReturnUrl
Response.Redire ct(RedirectUrl)
Catch ex As Exception
lblFailure.Text = ex.Message
End Try
End Sub
Public ReadOnly Property GetReturnUrl() As String
Get
If IsNothing(Reque st.QueryString( "ReturnUrl" )) Then
'Default page
Return FormsAuthentica tion.DefaultUrl
Else
'Requested page if present
Return Request.QuerySt ring("ReturnUrl ")
End If
End Get
End Property
Public Sub CreateAuthentic ationTicket(ByV al p As Person, ByVal
Persistant As Boolean)
Dim authTicket As FormsAuthentica tionTicket
Dim encTicket As String
Dim cookie As HttpCookie
Try
'Create a ticket
authTicket = New FormsAuthentica tionTicket(1, p.Name, _
DateTime.Now,
DateTime.Now.Ad dMonths(1), _
Persistant, p.UserData)
'Encrypt the ticket into a string
encTicket = FormsAuthentica tion.Encrypt(au thTicket)
'Create the cookie
cookie = New HttpCookie(Form sAuthentication .FormsCookieNam e,
encTicket)
If Persistant Then
'Specify expiration date
cookie.Expires = Now.AddMonths(1 )
End If
'Save the cookie
Response.Cookie s.Add(cookie)
Catch ex As Exception
Throw New Exception("Crea teAuthenticatio nTicket: " & ex.Message)
End Try
End Sub
End Class
Sitemap content:
<siteMapNode title="Start" url="default.as px" description="Re turn to start
page" roles="*">
<siteMapNode title="Activiti es">
<siteMapNode title="Calender " url="Public/Calendar.aspx" roles="*" />
<siteMapNode title="My Responsibility"
url="Member/MyResponsibilit y.aspx" roles="*" />
<siteMapNode title="Edit Activity" url="Member/ActivityEdit.as px"
roles="1" />
<siteMapNode title="Add Activity" url="Member/ActivityAdd.asp x"
roles="2" />
</siteMapNode>
.....
=============== =============== =============== ===
Problems found with this code:
Problems:
1) You need to click Logout twice to get out
2) You don't reach pages in the Public folder without logging in
3) After login some redirection doesn't work.
If the Login page itself is placed in a subdirectory, then it will not find
the defaultURL.
4) The TreeView control based on a sitemap always show all menus even if
they are mapped to different roles.
