|
From 1.x days, the implementation of forms
authentication in ASP.Net is not that much complicated. But the actual drawbacks
are, in those days, ASP.Net itself does not have that many controls that aid in
implementing forms authentication easily. With the introduction of 2.0, we have
a handful of controls that helps in implementing based forms authentication very
easy with the primary support of Providers in ASP.Net 2.0. This article will
explore the implementation forms authentication using ASP.Net 2.0.
Also, We will use some of the login controls to achieve some of the tasks very easily.
Who process the FormsAuthentication?
Forms authentication is processed by a HTTP module
called FormsAuthenticationModule which takes part in regular ASP.net page
processing.
Login Controls and Providers
This section will help us understand on how much suitable
are these Login controls to use in our projects. As I said earlier, ASP.Net 2.0
is packed with a set of new controls called Login controls through which we can
implement forms authentication with very less effort. By default, Login controls
will use the default membership provider and role provider which will have their
own database schema. So, it is not advisable to use this controls as it is
because enterprise applications itself will have its own database schema and
architecture. Solution for this problem is to develop our own custom provider or
our own custom code that solves our application specific requirements. In this
article, I will explain our subject matter with a custom implemented login form
without using any providers. Also, we will have a look on how some of the login
controls can be used effectively when using forms authentication.
Implementation of Login Form
1. Drag 2 textboxes, txtUname and
txtPass. Drag a button and name it as btnLogin.
Login.aspx
<table>
<tr>
<td style="width: 100px">
UserName</td>
<td style="width: 100px">
<asp:TextBox ID="txtUname"
runat="server"></asp:TextBox></td>
</tr>
<tr>
<td style="width: 100px">
Password</td>
<td style="width: 100px">
<asp:TextBox ID="txtPass"
runat="server"></asp:TextBox></td>
</tr>
<tr>
<td style="width: 100px">
</td>
<td style="width: 100px">
<asp:Button ID="btnLogin" runat="server"
OnClick="btnLogin_Click" Text="Login" /></td>
</tr>
<tr>
<td style="width: 100px">
</td>
<td style="width: 100px">
<asp:Label ID="lblMessage"
runat="server"></asp:Label></td>
</tr>
</table>
2. On btnLogin button click,
protected void btnLogin_Click(object sender, EventArgs
e)
{
string pass = CheckUser(txtUname.Text);
if (pass == null | pass == "")
{
lblMessage.Text = "Not a valid user!";
return;
}
if (txtPass.Text == pass)
{
FormsAuthentication.RedirectFromLoginPage(txtUname.Text, false);
}
else
{
lblMessage.Text = "Wrong Password!";
}
}
public string CheckUser(string UserID)
{
string Password = null;
con = new
SqlConnection(ConfigurationManager.ConnectionStrings["SQL Connection
String"].ConnectionString);
con.Open();
com = new SqlCommand(SP_CHECKUSER, con);
com.CommandType = CommandType.StoredProcedure;
com.Parameters.Add("@UserId", DbType.String).Value
= UserID;
dr = com.ExecuteReader();
while (dr.Read())
{
Password =
dr["Password"].ToString();
}
return Password;
}
If the authentication is successful, the user will be
automatically redirected to the page which he is trying to access initially. The
parameter “false” in the method RedirectFromLoginPage(txtUname.Text, false)
indicates the cookie generated will be non-persistent cookie.
3. Configure Forms Authentication
in Web.Config.
<authentication mode="Forms">
<forms loginUrl="Login.aspx"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
If we execute the application, it will automatically
redirect to Login.aspx to authenticate. If we see the above config setting, we
are denying anonymous access; hence, the users trying to access any
resource in the website will be automatically redirected to the Login.aspx page.
Read more about the <authentication> tag by visiting the link given in
Reference section of this article. The drawback of this above approach, it is
not possible to access any page in the website without authenticating. But, if
we see most of the sites they will allow access to certain resources like home
page, etc without authenticating. The next section will help us doing the
same.
|