1. Slide 1 ASP Authentication There are basically three authentication modes Windows Passport Forms There are others through WCF You choose an authentication mechanism in the web.config file

2. Slide 2 Windows Authentication Here you are relying on the internal Windows authentication services IIS displays an authentication dialog box IIS validates the user Page access is granted based on Access Control Lists Clients must be Windows machines Works well on intranets and corporate network applications We don’t use these in real-world Internet applications

3. Slide 3 Forms Authentication Introduction This is how we do authentication in the ‘real- world’ Your application is charge of the authentication process It’s the only real ASP.NET choice for authentication Forms authentication is just the ASP.NET built-in infrastructure to implement logins

4. Slide 4 The Provider Model (1) The ASP.NET infrastructure expects a well- defined structure for authenticating users These are classes derived from MembershipProvider (implemented as an abstract class rather than an interface Microsoft supplies providers for SQL server and for Active Directory

5. Slide 5 The Provider Model (2) There are many providers

6. Slide 6 MembershipProvider Use to create users and passwords and manage passwords Use to authenticate users To customize, we implement the MembershipProvider

7. Slide 7 MembershipProvider We connect the provider through the web.config file

8. Slide 8 RoleProvider The RoleProvider works much the same way We implement the RoleProvider

9. Slide 9 RoleProvider We connect the provider through the web.config file

10. Slide 10 Configuring Forms Authentication (1) It’s configured in the section of the Web.config file Set the mode attribute to “forms” Set the Forms key to the login URL

11. Slide 11 Web.config for Forms Authentication

12. Slide 12 Implementing Forms Authentication It’s up to you to create the form and it’s control instances It’s up to user to write the authentication code

13. Slide 13 Implementing Forms Authentication (Steps) Enable membership for the application and specify the membership provider This is done in the section of the web.config file All of this is part if the ASP infrastructure

14. Slide 14 Implementing Forms Authentication (Steps) <membership defaultProvider="SqlProvider" userIsOnlineTimeWindow="15"> <add name="SqlProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="MySqlConnection" applicationName="MyApplication" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="true" requiresUniqueEmail="true" passwordFormat="Hashed" />

15. Slide 15 Implementing Forms Authentication (Steps) Call Membership.ValidateUser Call FormsAuthentication.RedirectFromLoginPage

16. Slide 16 The Web Site Administration Tool Use the ASP.NET Web Site Administration tool to Create and manage users Create and manage roles By default, the data is stored in an SQL Server Express database

17. Slide 17 Web Site Admin Tool (Example)