Custom ValidateUser() in custom .net MembershipProvider

Question

Is there a way to extend the ValidateUser method to receive other parameters than the default?

Default

public override bool ValidateUser(string username, string password)
{
    return db.ValidateUser(username, password);
}

I'd like to implement

public bool ValidateUser(Guid rsid)
{
    return db.ValidateUser(rsid);
}

'db' is a class containing methods to communicate with the database(s). This is not my design any way, it's a customer who wants to be able to sign in with Guid links, safe ey! :)

Thanks

What happens when you add that? It looks perfectly valid to me... — jcolebrand, Apr 28 '11 at 18:15
I cant access the method since it's (i think) not allowed within the System.Web.Security.MembershipProvider class — Eric Herlitz, Apr 28 '11 at 19:18
Ah, I thought you were perhaps writing a wrapper class and that you could provide your own methods perhaps? — jcolebrand, Apr 28 '11 at 20:19

thaBadDawg · Answer 1 · 2011-04-28T18:23:11.293

If you are writing the code behind for the login page then you can directly reference the custom MembershipProvider method and hit whatever overloads you want, but if you are going through the abstract class then you'll have no access to the overload.

As for the Guid sign-in though, make the Guid the username, set the password to null and do something like this:

    public override bool ValidateUser(string username, string password)
    {
        Guid parsedUsername;
        if (String.IsNullOrWhiteSpace(password) && Guid.TryParse(username, out parsedUsername))
        {
            return ValidateUser(parsedUsername);
        }
        else
        {
            return db.ValidateUser(username, password);
        }
    }

It ends up being a complete hack, but accomplishes the goal your customer has. Might want to remind them that there is ZERO security in guid links.

score 1 · Accepted Answer · answered Apr 28 '11 at 18:17

1

How about just passing a string representation of a Guid in and converting?

public override bool ValidateUser(string username, string password)
{
    Guid rsid;

    if (Guid.TryParse(username, out rsid))
    {
        return db.ValidateUser(rsid);
    }
    else
    {
        return false;
    }
}

answered Apr 28 '11 at 18:17

BrandonZeider

8,014
2
23
20

I figured about something like that. I'll give it a go – Eric Herlitz Apr 28 '11 at 19:18
It works, but not a very nice solution to abuse a datatype for something else. – MeanGreen Oct 08 '14 at 10:36

score 0 · Answer 3 · answered Oct 08 '14 at 10:45

Another way around is to add a new method in the MembershipProvider (outside the defined interface), for example:

public class CustomMembershipProvider : MembershipProvider {

    private LoginValidationType ValidationType;

    // new method
    public bool ValidateUser(string username, string password, LoginValidationType validationType = LoginValidationType.WebsiteSpecific) {
        ValidationType = validationType;
        return ValidateUser(username, password);
    }

    // the original method
    public override bool ValidateUser(string username, string password) {
        // do stuff with username, password and this.ValidationType
    }

In your calling code you can now do:

        CustomMembershipProvider provider = new CustomMembershipProvider();
        // original method
        provider.ValidateUser("un", "pass"); 
        // or call our new overload
        provider.ValidateUser("un", "pass", LoginValidationType.WebsiteSpecific);

Instead of:

        Membership.ValidateUser("un", "pass");

But it still feels hacky. Just adding the new public method does not result in the default Membership class showing the method, and I don't know if it can be changed to do this anyway.

At least you don't have to abuse datatypes this way and have methods for specific situations.

Custom ValidateUser() in custom .net MembershipProvider

3 Answers3