Concatenate columns value returns by datareader

[beemomo]

I manage to store the additional use data (username, fullname, rolecode) in FormAuthenticationTicket. However ,
the user has more than one role , he can be admin, poweruser , executive ,etc... can anyone please tell me how can i concatenate the rodecode return by datareader if it returns more than 1 value? so that i can put it as a string in userdatastring of the authentication ticket?

eg:
If datareader returns:

UserName FullName RoleCode
amy33 amy watson ADMIN
amy33 amy watson POWERUSER
amy33 amy watson EXEC

how can i can i store all this 3 RoleCode in userdatastring?
Thank you !

drDataReader = cmd.ExecuteReader()
While drDataReader.Read()
 
strFullName = drDataReader("FullName").ToString
strUserName = drDataReader("UserName").ToString
strRoleCode = drDataReader("RoleCode").ToString
 userDataString = String.Concat(strFullName, "|", strUserName, "|", strRoleCode)
 
Dim authCookie As HttpCookie = FormsAuthentication.GetAuthCookie(txtUserName.Text, chkPersistCookie.Checked)
 
Dim ticket As FormsAuthenticationTicket = FormsAuthentication.Decrypt(authCookie.Value)
 
Dim newTicket As FormsAuthenticationTicket = New FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, userDataString)
 

[Frinavale]

You shouldn't be storing the user's roles in the Forms Authentication ticket.

When the request to the server is made for your website, the ASP.NET Forms Authentication feature will check if there is a valid Forms Authentication cookie (ticket). If so, the authentication feature creates a Token that represents the user. This token is created based on information retrieved from your database. The token is then set in the HttpContext.User property which is accessible through out your application.

You should be using the User property to check for roles etc.
You should Not be storing this information in the cookie.

-Frinny

[beemomo]

Thanks for your reply , Frinny.

This is the first time I create the login page using form authentication. Sorry for my noobness.

I've been struggling for several to find the answer on how can i store the user's additional data. Thanks for your advise , but that would be great if you can explain how can I store user data using HttpContext.User

Public Property User As IPrincipal
Get
Set

Hmm, i have a bunch of questions here:
What should i put in the Get and Set section so that it knows which user i refer to? Do need to do any query to refer to that user with the ticket? Hope that u can explain by providing some codes example or information? Many thanks again, Frinny.

[Frinavale]

It sounds like you're interested in implementing your own Principal and Identity Objects.

Essentially the Principal object contains all of the security information...like the user's permissions, roles etc.

The Principal object has an Identity property.
The Identity class contains the user's personal information...like the user's name, birth date(if you want)... etc

Here is a walkthrough about implementing custom Authentication and Authorization that I think you'll find really helpful :)

-Frinny

Edit: PS if you still have problems after working through the walk through I'll do my best to help you solve them

[beemomo]

Thanks again Frinavale for your reply. Sorry for my late reply because I have been away from my workstation since last weekend.

I have tried the walk through, and will try to implement this into my project.

I really appreciate your advise and reply. This is a new and very useful peace of knowledge for me to learn and explore.

Cheers,
beemomo