SlideShare a Scribd company logo

Authentication & Authorization in ASPdotNet MVC

•Download as ODP, PDF•
•
Mindfire Solutions
Mindfire Solutions

This document discusses authentication and authorization in ASP.NET MVC 4. It begins by explaining why security is important and describes different authentication and authorization techniques. It then explains what providers and membership providers are in ASP.NET and some problems with the default ASP.NET membership provider. The document introduces SimpleMembership as a better alternative and shows how to implement a SimpleMembership provider in an MVC 4 application.

Related slideshows

Sessions and cookies
Sessions and cookiesSessions and cookies
Sessions and cookies
 
OpenID Connect Explained
OpenID Connect ExplainedOpenID Connect Explained
OpenID Connect Explained
 
OAuth 2.0
OAuth 2.0OAuth 2.0
OAuth 2.0
 
1 of 14
Authentication and Authorization in ASP.NET MVC 4 Presenter – Raj Kumar Bhagat, Mindfire Solutions
Myself Certifications:- MCTS 70-515 Microsoft .Net 4.0 Web App Development MCP 70-486 Developing ASP.NET MVC 4.0 Web App Skills:- ASP.NET, MVC, C#, SQL Server, MySQL, Jquery, EntityFramework, LINQ Contact:- Email – rajb@mindfiresolutions.com Skype - mfsi_rajb
Contents ● Introduction - Why security is important? - Different ways to secure our application ● What is authentication and authorization? ● What are providers in ASP.NET? ● What is membership provider in ASP.NET? ● Problems with ASP.NET Membership ● SimpleMembership as a better Membership system ● Implementation of SimpleMembership provider in MVC 4 application
Introduction – Why Security? Security is one of the most important part of any Website or a Web Application. There are various ways to exploit a website/ web application: - ● Brute Force ● Sniffers ● Spoofing ● Social Engineering ● SQL Injection
How? ● Design application in good way ● Encrypt sensitive data while storing ● Validate input data before processing ● Force users to give strong password ● Implement Authentication and Authorization technique
Authentication and Authorization Authentication is a process where a user's credential is checked. e.g. - gmail, facebook etc. Authorization is a process where a user access the resource based on his/her role. Authentication always precedes Authorization.
What is a Provider in Asp.Net? ProviderBase class is an "Abstract Class" which follows the "Provider Model". This class is very simple and contains very few methods which is inherited from the "Object" Class.This class is a part of the System.Configuration.Provider namespace. This ProviderBase class implements a 2 step process. ● Feature-specific Providers (Membership/ Role/ Profile Providers) ● Implementation-specific Providers (SqlMembership Provider)
MembershipProvider in ASP.NET ● ASP.NET membership gives us a built-in way to validate and store user credentials. ASP.NET membership therefore helps us manage user authentication in web sites. ● ASP.NET Membership provides two types of Membership providers:- - SQLMembershipProvider - ActiveDirectoryMembershipProvider ● ASP.NET provides us to configure our own Custom Membership Provider. (Oracle Data Source, Other data source) ● This class inherits from the abstract ProviderBase class and contains various methods and properties to Create, Delete, Update, Validate, Get User information, Change Password
Problems with ASP.NET Membership ● Requires full SQL server for default cases ● Custom Membership Providers have to work with a SQL-Server- Centric API ● Designed around a specific view of users, roles, profiles ● Requires specific schema, overflow in blob columns
SimpleMembership ● Works with our schema ● Broaden database support to the whole SQL server family ● Easy to use with Entity Framework Code First
SimpleMembership integrates with ASP.NET Membership
Demo Implementation of SimpleMembership provider in MVC 4 application
References ● http://www.codeproject.com/Articles/637428/SimpleMembershipProvider-vs- MembershipProvider ● http://mvc-model.blogspot.in/2013/06/mvc-4-custom-simple-membership-provider. html ● http://blog.osbornm.com/2010/07/21/using-simplemembership-with-asp-net-webpages/
Thank You!!!

More Related Content

Authentication & Authorization in ASPdotNet MVC

  • 1. Authentication and Authorization in ASP.NET MVC 4 Presenter – Raj Kumar Bhagat, Mindfire Solutions
  • 2. Myself Certifications:- MCTS 70-515 Microsoft .Net 4.0 Web App Development MCP 70-486 Developing ASP.NET MVC 4.0 Web App Skills:- ASP.NET, MVC, C#, SQL Server, MySQL, Jquery, EntityFramework, LINQ Contact:- Email – rajb@mindfiresolutions.com Skype - mfsi_rajb
  • 3. Contents ● Introduction - Why security is important? - Different ways to secure our application ● What is authentication and authorization? ● What are providers in ASP.NET? ● What is membership provider in ASP.NET? ● Problems with ASP.NET Membership ● SimpleMembership as a better Membership system ● Implementation of SimpleMembership provider in MVC 4 application
  • 4. Introduction – Why Security? Security is one of the most important part of any Website or a Web Application. There are various ways to exploit a website/ web application: - ● Brute Force ● Sniffers ● Spoofing ● Social Engineering ● SQL Injection
  • 5. How? ● Design application in good way ● Encrypt sensitive data while storing ● Validate input data before processing ● Force users to give strong password ● Implement Authentication and Authorization technique
  • 6. Authentication and Authorization Authentication is a process where a user's credential is checked. e.g. - gmail, facebook etc. Authorization is a process where a user access the resource based on his/her role. Authentication always precedes Authorization.
  • 7. What is a Provider in Asp.Net? ProviderBase class is an "Abstract Class" which follows the "Provider Model". This class is very simple and contains very few methods which is inherited from the "Object" Class.This class is a part of the System.Configuration.Provider namespace. This ProviderBase class implements a 2 step process. ● Feature-specific Providers (Membership/ Role/ Profile Providers) ● Implementation-specific Providers (SqlMembership Provider)
  • 8. MembershipProvider in ASP.NET ● ASP.NET membership gives us a built-in way to validate and store user credentials. ASP.NET membership therefore helps us manage user authentication in web sites. ● ASP.NET Membership provides two types of Membership providers:- - SQLMembershipProvider - ActiveDirectoryMembershipProvider ● ASP.NET provides us to configure our own Custom Membership Provider. (Oracle Data Source, Other data source) ● This class inherits from the abstract ProviderBase class and contains various methods and properties to Create, Delete, Update, Validate, Get User information, Change Password
  • 9. Problems with ASP.NET Membership ● Requires full SQL server for default cases ● Custom Membership Providers have to work with a SQL-Server- Centric API ● Designed around a specific view of users, roles, profiles ● Requires specific schema, overflow in blob columns
  • 10. SimpleMembership ● Works with our schema ● Broaden database support to the whole SQL server family ● Easy to use with Entity Framework Code First
  • 11. SimpleMembership integrates with ASP.NET Membership
  • 12. Demo Implementation of SimpleMembership provider in MVC 4 application
  • 13. References ● http://www.codeproject.com/Articles/637428/SimpleMembershipProvider-vs- MembershipProvider ● http://mvc-model.blogspot.in/2013/06/mvc-4-custom-simple-membership-provider. html ● http://blog.osbornm.com/2010/07/21/using-simplemembership-with-asp-net-webpages/