Using Membership rather than just creating your own class

Question

I'm starting to use the 'Membership' framework (as you may have noticed from my past 5 posts).

In my code I'm inheriting the SqlMembershipProvider class and overriding the functions, because my database doesn't fit the schema required by default.

So the question I wish to ask is:

Why should I use the Membership class, when I can just create my own class with the functions that I wish to use within my application?

The same goes for the Roles framework too.

Can you elaborate on that: _"my database doesn't fit the schema required by default"_ ? You know [`Aspnet_regsql.exe`](http://msdn.microsoft.com/en-us/library/ms229862%28v=vs.80%29.aspx), what's wrong with the default model? — Tim Schmelter, Aug 24 '12 at 12:46
As Rune suggests, parts of it are pretty hard to get right if you don't know exactly what you are doing. We usually use the Membership classes as a base, and like you, override the functionality that we wish to extend (usually just attached metadata). — Grant H., Aug 24 '12 at 12:50

score 3 · Answer 1 · answered Aug 24 '12 at 12:47

3

Short answer: When it comes to security, don't assume you know what you are doing. If you try to do it yourself then you will probably do it wrong!

Security is hard!

Microsoft has spent a lot of resources implementing the Membership and Roles frameworks. As long as they fit your needs then why create your own stuff? Also, by using the standard frameworks, your solution will be compatible with other projects also using the same frameworks. This may or may not be an issue in your case.

answered Aug 24 '12 at 12:47

Rune Grimstad

35,612
10
61
76

+1 for compatibility with other projects. I once added Yet Another Forum to a web application I maintained, and because we used a Membership provider I was able to manage users and and roles from my own app, without requiring any change to YAF. – mclark1129 Aug 24 '12 at 12:51

score 1 · Accepted Answer · answered Aug 24 '12 at 13:43

First of all, if you have your own preexisitng user database you should probabaly not try to coerce the SqlMembershipProvider to use it. SqlMembershipProvider is a complete implementation of the abstract MembershipProvider class and to function correctly it requires a database with the correct schema.

Instead you should create your own implementation of the abstract MemberShipProvider class. To get started, create a class CoultonsMemebshipProvider and have it derive from System.Web.Security.MembershipProvider. Then put the cursor inside MembershipProvider and click Ctrl+. and then select Implement abstract class.... Visual Studio will then add in a lot of code for methods you can implement.

At first after seeing the VS inserted code, the task looks daunting indeed. But remember that you only have to actually implement the parts that your application is going to need. It's OK to leave the default throw new NotImplementedException(); in place for methods and properties you are not going to need.

Now for you question "Why should I use the Membership class...", the answer is simple enough. It's a tried and tested, well thought out abstraction which guides you in the correct direction when building you authentication scheme.

That said, if you strongly feel that you don't actually need a membership provider, you can still use FormsAuthentication and get the benefits it provides. If you want to explore this option, have a look at this tutorial on FormsAuthentication by Scott Mitchell (specifically the Introduction part).

nunespascal · Answer 3 · 2012-08-24T13:06:22.347

Asp.net provides to a lot of hooks into the "Membership" framework.

You can customize it where ever needed. Look at implementing a CustomMembership provider.

This allows you to do that authentication with your tables and yet be part of the framework.

public class MyMembershipProvider : MembershipProvider
{ 
        public override bool ValidateUser(string username, string password)
        {    
            //check user credentials
            return IsUserValid;
        }
}

In web.config:

  <membership defaultProvider="MyMembershipProvider">
      <providers>
        <clear />
        <add name="MyMembershipProvider"
             applicationName="MyApp"
             Description="My Membership Provider"
             passwordFormat="Clear"
             connectionStringName="MyMembershipConnection"
             type="MyApp.MyMembershipProvider" />
      </providers>
    </membership>

Using Membership rather than just creating your own class

3 Answers3