Developing Custom ASP.NET Providers For Membership And Role Manager

1. Developing Custom ASP.NET Providers For Membership And Role Manager Stefan Schackow PRS404 Program Manager – Web Platform and Tools Microsoft Corporation

2. Agenda • Provider Model • Extensibility scenarios with code demos • Projecting Membership via web services • Role caching with SQL Server 2005 • Virtualizing applications • Integrating Membership with custom data

3. Provider Model • Enable new functionality in a transparent fashion • Enable extensibility for • Web services • Browser based “Atlas” clients • Smart clients • Application services as pluggable building blocks • Decoupled via configuration • Use structural classes for your own features

4. Static feature class Feature config. Provider instances Provider ModelFeature Lifecycle

5. Provider ModelFeature Configuration public class QuotationsConfiguration : ConfigurationSection { [ConfigurationProperty("providers")] public ProviderSettingsCollection Providers { get; } [ConfigurationProperty("defaultProvider", DefaultValue = "StaticQuotationProvider")] public string DefaultProvider { get; set; } }

6. Provider ModelCreating Provider Instances //Start with empty provider collection providerCollection = new QuotationsProviderCollection(); //Helper class converts configuration information into //concrete providers ProvidersHelper.InstantiateProviders( qc.Providers, //a ProviderSettingsCollection providerCollection, typeof(QuotationsProvider)); //Lock the provider collection providerCollection.SetReadOnly();

7. Writing A Provider-Based Feature

8. Projecting Membership • Physical 3-tier deployments • May not allow web server to connect directly to Sql tier • “Atlas” and smart clients • Clients can only communicate over Http • Need app services to work across the Internet

9. Projecting MembershipDesign Issues • Authenticating to the web service • Not all methods should be public • Serialization of MembershipUser • Read-only properties don’t serialize • WebMethod parameter constraints • Collection types and [out] parameters • Selecting from multiple providers • Choosing a non-default provider

10. Projecting Membership3-Tier Flow Webservice server Web server .asmx Membership wrapper Application code Webservice provider SQL provider

11. Internet client “login” Application Returns forms ticket pass ticket w/ each request Projecting MembershipAuthenticated Flow Webservice server .asmx Formsuth wrapper .asmx Membership wrapper Validate ticket and roles SQL provider

12. Projecting Membership With Web Services

13. Caching Role Data • Role Manager can cache user roles: • Cookie caching (not enabled by default) • Per-request in RolePrincipal • RolePrincipal caching • Results in at least one call to GetRolesForUser • Stored internally with HybridDictionary • Cookie caching limited to 4K of data • Option for persistent cookie

14. Caching Role Data • Cache role data using SQL Server 2005 query notifications • Data is cached until SQL notifies you • Good for clients that cannot use cookies • Can handle apps with hundreds of roles

15. Caching Role DataQuery Notification Specifics • Need to change “SET QUOTED IDENTIFIER” in ASP.NET SQL scripts to “ON” • Then recompile stored procedures • Custom provider must query ASP.NET tables directly • Cannot create notifications against SQL views

16. Role Caching With SQL Server 2005

17. Virtualized Applications • One physical ASP.NET application • Multiple “virtual” applications • Portal style applications • DotNetNuke portal provisioning • Self-registered forums and portals • Sharepoint • However providers are • “Application-centric” • Statically defined in configuration

18. Virtualized Applications • Override ApplicationName property • Determine virtual application context dynamically (e.g. IHttpModule) • Retrieve it in the override • Cautionary Notes! • Prevent auth ticket re-use across apps • Don’t accidentally map roles in one virtual app to a user in a different virtual app • Turn off cookie caching for roles

19. Setting Application Context Dynamically

20. Integrating Custom Data • Need to integrate existing data • Don’t want to write a provider from scratch • May need to link to your own data • What can “safely” be referenced? • How do you handle transactions? • How do you pass extra data along?

21. Integrating Custom DataCustom Provider Design Issues • Referential Integrity • Foreign key to aspnet_Users table • Use SQL views to lookup UserID • Transactional Integrity • Use the new ADO.NET 2.0 TransactionScope • Custom Data • Pass via HttpContext to CreateUser • Extend MembershipUser for other cases

22. Integrating Membership w/ Custom Data

23. Summary • Rewrite or enhance features • Plug-in rich functionality independently from the presentation tier • Project current features onto other platforms via web services • Use the provider infrastructure for your own features

24. Community Resources • “Atlas” application development • PRS312: ASP.NET: Future Directions for Developing Rich Web Applications with Atlas (Part 1) (Wed 5pm) • PRS420: ASP.NET: Future Directions for Developing Rich Web Applications with Atlas (Part 2) (Thursday 11:30AM) • Ask The Experts Thursday night • Drop by the PRS track lounge!

25. Community ResourcesProvider Links on the Web • Access providers from Beta 1 • Installs as a Visual Studio 2005 VSI template • Includes full source for Membership, Role Manager, Profile and Web Parts Personalization providers • Provider Toolkit • Extensive 120 page whitepaper • Sample providers for all provider based features • Both will be available at http://msdn.microsoft.com/asp.net/beta2/providers/default.aspx

26. © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

27. Provider Model AppendixPatterns • Strategy • Provider base classes • Factory Method • System.Web.Configuration.ProvidersHelper • Singleton Pattern • Only one provider instance is instantiated • Façade • Feature classes like Membership, Roles, etc…

28. Provider Model Appendix • Provider Class Definition • What is the pluggable aspect for the feature? • Configuration • Feature configuration • Provider-specific configuration • Common entry point class • Triggers feature initialization