1 CS 3870/CS 5870: Note 12 Authentication and Authorization Membership Provider

2 Prog 5 Copy folder Prog4 as Prog5 Modify Prog4MasterPage Name: Prog5MasterPage Text: Prog 5 TreeView: New root node NavigationURL of master page

3 Prog 5 Modify the Content Pages Reset the MasterPageFile (top line of the source file)

4 Prog 5 Modify the Session Variables Prog4_ to Prog5_ File Global Code file

5 Prog 5 Make sure it’s working the same as Prog4 before adding features for Prog5

6 Web.Config Machine.config –Machine level settings –Default settings for all Web applications Application Web.config –Under the application root directory –Apply to the entire application –Overwrite some settings set in Machine.config Local Web.config –A sub-folder can have its own Web.config file –Overwrite some settings set in higher level Web.config –Not every setting can be set in local Web.config AUTHENTICATION must be set in application Web.config AUTHORIZATION can be different for different sub-folders Page Directives –Apply to the page only –Overwrite settings set in Web.config

Machine.config on Xray C:\Windows\Microsoft.NET\Framework\v \Config <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version= , Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="LocalSqlServer" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="true" applicationName="/" requiresUnique ="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" passwordStrengthRegularExpression=""/> 7

Machine.config on Xray C:\Windows\Microsoft.NET\Framework\v \Config <add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf; User Instance=true" providerName="System.Data.SqlClient"/> 8

9 Web.Config Application Configuration File under the main web site <forms name="formsAuth" loginUrl="login.aspx" path="/" requireSSL="false" slidingExpiration="true" protection="All" defaultUrl="~/Prog5/Default.aspx" timeout="1" cookieless="UseDeviceProfile" />

10 Authentication To identify the user Four Modes –Windows: IntraNet –Forms : Internet –Passport: MS –None

11 Forms Based Authentication –name : cookie's name –loginUrl : default is login.aspx –path : the location to save the cookie, default is / –protection: the amount of protection applied to the cookie Encryption Validation All (both, default) None –timeout : minutes (default 30) a durable cookie could be issued

12 Forms Based Authentication –defaultUrl: If the user requests the login.aspx page Otherwise, go to the requested page –requiresSSL : credential be sent over an encrypted wire (SSL) –slidingExpiration : timeout of the cookie is on a sliding scale –cookieless: UseDeviceProfile: default UseCookies: require to use cookies UseUri: force to store credential within Uri AutoDetect: sending a test cookie first

Authentication All pages are still accessible to the public After Authentication is set in config file

Form Login Create form Login under the root folder Add control Login from tab Login All pages are still accessible to the public 14

15 Authorization Web.config file under the main folder

No Page Accessible 16

17 Authorizatio n Web.config file under the main folder

All Pages Are Accessible Except those under folder Prog5 18

Control CreateUserWizard Add a form CreateUser.aspx under the main folder Add control CreateUserWizard Create one user –UserName: jim –Password: –Your –Your choices for others 19

Event ContinueButtonClick In CreateUser.aspx.vb Select CreateUserWizard1 Select event ContinueButtonClick Code Response.Redirect("Login.aspx") 20

21 Authorization <allow users="[comma separated list of users]" roles="[comma separated list of roles]" verbs="[comma separated list of roles]"/> <deny users="[comma separated list of users]" roles="[comma separated list of roles]" verbs="[comma separated list of roles]"/> * : everyone ? : anonymous verbs: POST, GET, HEADER, DEBUG

Other Login Controls ChangePassword LoginName LoginStatus LoginView PasswordRecovery 22

Prog5MasterPage Add LoginName and LoginStatus 23

Prog5MasterPage Partial Class Prog5_MasterPage Protected Sub LoginStatus1_LoggedOut(...) Handles LoginStatus1.LoggedOut Response.Redirect("~/Login.aspx") End Sub End Class 24

New Page Checkout Maintain a shopping bag for each session Add items into the shopping bag when shopping GridView to display all items in the shopping bag on checkout Clear the bag when checkout 25

Shopping Bag Your Choice –DataTable –ArrayList –New class –... Location –SQLDataClass –... 26

Shopping Bag Public Shared Function NewShoppingBag() As Data.DataTable Dim bag As New Data.DataTable bag.Columns.Add("Product ID") bag.Columns.Add("Product Name") bag.Columns.Add("Unit Price") bag.Columns.Add("Quantity") bag.Columns.Add("Cost") Dim PK() As Data.DataColumn = {bag.Columns(0)} bag.PrimaryKey = PK Return bag End Function 27

Global.vb Sub Session_Start(...)... ' For Prog5 Session("Prog5_Bag") = SQLDataClass.NewShoppingBag... End Sub 28

Page Shopping New Button “Add to Shopping Bag” Click Event Dim myBag As Data.DataTable = Session("Prog5_Bag") Dim row As Data.DataRow = myBag.NewRow row(0) = txtID.Text row(1) = txtName.Text row(2) = txtPrice.Text row(3) = txtQuanity.Text row(4) = txtSubTotal.Text Dim r As Data.DataRow = myBag.Rows.Find(row(0)) If Not r Is Nothing Then myBag.Rows.Remove(r) ‘ replace the old item End If myBag.Rows.Add(row) 29

Page Checkout Protected Sub Page_Load(...) Handles Me.Load GridView1.DataSource = Session("Prog5_Bag") GridView1.DataBind() End Sub 30

Page Checkout Protected Sub Button1_Click(...) Handles Button1.Click ‘ End the current session ‘ will clear all session variables Session.Abandon() ' Logout of Membership FormsAuthentication.SignOut() ‘ Go to Login.aspx Response.Redirect(FormsAuthentication.LoginUrl) End Sub 31

Schedule Thursday –Still have class –Do Prog5 and Project –Lab 206 Next Tuesday –Do Prog5 and Project –Lab 206 Lose 10 points if missing class without my permission 32