Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

ASP.NET MVC, forms auth or custom when using EF 4?

I'm new to the ASP.NET world. Since I want to use the ORM it seems I would want an Entity to represent the User or Member or whatever, not some data tucked away by the forms authentication api. In fact I don't see how I can live without one.

How do people deal with this? Roll your own authentication? Or is there a best practice for incorporating forms authentication with the Entity Framework?

In short, since I need a User and Role Entity for queries anyway, should I skip the forms auth or find a way to use it?

Thanks

like image 802
Keith Myers Avatar asked Sep 03 '10 21:09

Keith Myers


People also ask

Is form authentication deprecated?

Microsoft will deprecate Basic Authentication effective October 1, 2022.

Why do we need forms authentication in MVC?

It will generate the respective view with the controller - create, edit, update, and delete code and views. The Authorize Attribute is the built-in attribute provided by MVC which is basically used to authenticate a user.

What is the difference between authentication and authorization how you have implemented it in the MVC application?

Authentication is done before the authorization process, whereas the authorization process is done after the authentication process. In the authentication process, the identity of users are checked for providing the access to the system.

How will you implement custom forms authentication and authorization in MVC?

Right click on the controllers folder> > Add >> Controller>> selecting MVC 5 Controller - Empty>> click Add. In the next dialog name the controller AccountController and then click Add.


2 Answers

EF and Forms Auth are really two different areas. You can use Forms Auth without ASP.NET Membership very easily and roll your own provider with very little effort.

This tutorial will show you how:

http://msdn.microsoft.com/en-us/library/ms172766(VS.80).aspx

With ASP.NET MVC you should really use standard Auth since you can manage access to controllers using attributes for Roles very easily.

like image 113
Keith Adler Avatar answered Sep 28 '22 06:09

Keith Adler


FormsAuthentication on its own does not care about the identity store and can validate only credentials stored in the web.config <credentials> section, through the Authenticate method. Standard implementations of the login page use the static Membership class to manage the identities and credentials in the MembershipProvider specified in the config file (usually SqlProfileProvider).

However, you don't have to use the membership provider functionality of ASP.NET to maintain your identities and you can still use FormsAuthentication just fine. The forms authentication control flow shows that forms authentication deals primarily with creating and maintaining the auth ticket for the user in a cookie. It does not deal with the user identity or profile itself, as it does not care about those.

Thus, you can safely use EF to maintain your user profiles, including credentials and do authentication of the provided credentials in your login page, while still using FormsAuthnetication.

like image 23
Franci Penov Avatar answered Sep 28 '22 06:09

Franci Penov