am working on an asp.net application with membership controls and the SQL Server database. I have this put together, however it appears that adjustments need to be made to enhance security. Many websites have membership features, so I was wondering if there are some blog posts that describe the steps that need to be made to enhance security.
View 3 RepliesI would like to use the Role Membership and User Security database as my application database too. That is, just add the tables and relationships required by my application's data access layer to the Membership and Roles Database to save on hosting fees, (I have to pay extra for having two databases instead of one). Of course, the connection string would have to be adjusted, but I don't see a downside considering the application's database is actually an Access database. What can I say, it was a requirement at the time.
Basically, I would like to do the opposite of this:
http://forums.asp.net/p/1162485/1925262.aspx#1925262
I installed sql server express 2008 R2, no problems.
I created a database and added a table, no problems.
I'm using the entity framework, I created and am using the .edmx file, no problems.
I created a form that reads from and submits to the table, no problems.
I added the membership tables to the database, now I have problems.
I can still read from and update my table fine, so clearly the connection string in my web.config still works. But I can't add a new user or do anything with the website administration tool. It can't find any providers, and under security, it tells me it can't login into the database. When I try to register a new user, I get a failed login error, again for my database user. Yet I can login fine through Server Management Studio with the same credentials.
This code is OK: [URL]
I wonder how to incorporate the view of my table?
Example:
I have a table:
- Products
- Customers
I have multiple users, each one to see what Products and the parties if the request with your username and password.
How does this connect to the Membership table?
Is it possible to use the Membership API with an already exisiting database? I have a database that is built around my own fields for the User and breaks down users into half a dozen different groups that determine their access to different parts of the site and exactly what they can do and see on different pages.
View 8 RepliesASPNETDB Problem - Unable to connect to SQL Server database
now, after some real soul searching, i managed to get it working, however i want to do the following:
I have a table in a database I created called "Students". Now, I have a studentId and a password in that table. What I want to do is allow users to login using their accounts.
However, I am having real trouble doing this. I want to create a custom membership provider, etc.
I have been crawling through the net looking for ways to do it but some of the sites I visited had too much complicated code.
What is the best and easiest way to do this?
I am facing a very unique situation and need help. My problem is as follows:1. I have a basic ASP.NET website (3.5 is it helps on IIS 7) where I have implemented Membership for Authentication.2. The site caters to multiple companies (Say Company A, Company B etc.).3. For each company I need to have different database (SQL 2008). This is mandatory as i can use multiple Application in there.Now as far as the flow is concern its pretty simple:1. The user comes to this site with a QueryString like cid=123 (in actual there is a HttpModule for this, cid=123 is just for this forum purpose).2. The site using the cid=123 gets to know this user is for Company A (i have a WCF service for this, how it works is not a problem.), along with that I also get the connectionstring for the database this user should use.3. For Business implementation i have handled this nicely in my DAL Layer.4. The problem comes with Membership.5. In Membership I have writtent a custom provider, that assigns the connection on teh fly.6. But this happens only once for the application. i.e. the connectio string gets cached at application level.7. The connection string does not change untill I reset my IISwhere i can have a single WebSite, catering to different companies, using seperated databases and using Membership for Authorization.
public class CustomMembershipProvider : SqlMembershipProvider
{
public override void Initialize(string name, System.Collections.Specialized.NameValueCollection config)
[code]...
I am using aspnet_regsql.exe to add membership tables to my database.
when I click the exe file it just opens up an XML file in visual web developer and does not start the wizard to merge the databases.
the run command where file is located is below
C:WINDOWSMicrosoft.NETFrameworkv2.0.50727
I just get the file below opening instead
[Code]...
I am attempting to add a database to the AppData folder. It seems to only want to use SQL Express, which I have read is not a good idea for a live website for the purposes of memberships. How do I change the default Express to SQL2008.
View 6 RepliesI've just finished my database design and now i'm going to start implementing it in SQL Server 2008. Since i'm creating an ASP.NET Web Application i would like to use Membership Provider to manage user access to the application. In other projects (more simpler) i used Membership but always with its default parameters.
In this recent application i need to use custom user data for it to work properly.
So, what i would like to know is, how can i use my 'Users' table in my DB with .NET Membership Provider?
I would like to collect all the emails from all users in a certain role. How would I do this ?
View 1 RepliesI am new to using the membership provider. I have been working in a small shop that has very focused programming and we are starting to venture out as our needs have grown. My question is the following:
Once I have created the asp schema and I set up users. How do I perform database access using those user accounts? I know how to perform access using a database account (schema), but do not understand how to use a user that only exists in a user table to access data tables.
Do I use an anonymous account and control access on the front end?
How to I track audit fields?
I am in the initial stage of implementing a new webstie, which will use only twitter and facebook to login and use. So my approach is not use any Default memberhip database, just simple store the user data in my created "membership" database. I will set cookies and use sessions to restrict and grant access to various parts of the sites. So for example, the user creates an account and I set a cookie allowing him or her to traverse the site. And on each page request from the client browser check to see if my website cookie is there in the browser and if it has expired or not.
View 1 RepliesI have a custom SQL membership provider (NOT using aspdb files but our own 'People' table) that was working fine under development but doesn't even connect when it is deployed on web server. DB connection string has been changed to point to db server (checked against another web site & is fine there). The membership code (in VB) is in App_code directory so am I correct in thinking I don't need a separate DLL ? No error messages nothing just reports failed to login when I type some user credentials.
Web config file as follows
[Code]....
I am trying to build a security webservice that gets credentials from client application login Pages/forms and returns authorization and token(to manage session) information after authenticating using Membership provider. I am having a problem in Securing my webservice and using LDAP and Database together as an identity store distinguished based on a flag provided by clint applications.
View 4 RepliesI am running windows 7 and NET Framework 4.
Problem is I dont know how to locate the asp.reg.sql tool that will do this using windows 7.
how to do this?
I tried creating a login page as ASP.NET web application. Then as we have to configure the page to connect to the database to retrieve user details, i clicked on the ASP.NET configuration under Website control.. I was taken to the configuration page with three tabs.. Security was the tab that i was supposed to configure.. But i am not able to go through to the security tab. I get the following error message.
"There is a problem with your selected data store. This can be caused by an invalid server name or credentials, or by insufficient permission. It can also be caused by the role manager feature not being enabled. Click the button below to be redirected to a page where you can choose a new data store.
The following message may help in diagnosing the problem: Unable to connect to SQL Server database."
I have more of the same applications.All tables are identical.Each application has a new user.These different applications are located in different domains such as.: domena1.com, domena2.com, domena3.com.Each domain has different users.
For each domain in the web.config change the "ApplicationName", eg.:
ApplicationName = domain1, ApplicationName = DOMAIN2, ApplicationName = domain3 ...
Membership.DeleteUser not removing user from database
//Roles.RemoveUserFromRole("markwheeler1963@hotmail.com", "customer");
while creating users/groups using web site administration tool, is there a way to configure it to store to a specific database rather than store to a Microsoft SQL 2005 Server Express Edition by default in the App_Data folder?
View 2 RepliesI have an existing ASPNET role/membership database created on SQLExpress 2005 (WIndows 2003 Server). I created it under the .NET 3 framework many years ago using the aspnet_regsql.exe application in full GUI mode.
I am setting up a new Windows 2008R2 server with .Net Framework 4 and SQL Server 2008R2. I don't want users to have to recreate accounts or create roles, etc.
So...
1. Should I backup the current database and import it into the new system, and if so do I even need to use the aspnet_regsql.exe application. (If so which version do I use, different aspnet_regsql.exe files exist in different directories (i.e., FrameWork, FrameWork64)
2. Should I just run aspnet_regsql.exe on its own and then somehow try to import the current data into those tables.
I am concerned that if I just import somehow the roles within SQL server will not be created properly.
I am using C# Visual Studio 2008 and SQL Express 2005.
When I create a Website in VS2008 (File->New->Website...), then I add membership via the Web Site Administration Tool by creating a couple of roles and users; a database is then created physically in the App_Data folder and in the Solution Explorer, I see a plus sign after refreshing it and the database is shown.
And this is now my problem: when I create a new ASP.Net Web Application (which is what I want, File->New->Project...->ASP.Net Web Application) and then I add the membership, the physical database is created, but I do not see it in the App_Data folder of my Solution Explorer, and manually adding it by right-click->add existing item, then pointing to the existing aspnetdb.mdf file in the App_Data folder doesn't work, because it gets added with an yellow exclamation warning, and I cannot access the DB.
how to add membership to a VS2008 Asp.Net Web Application correctly, where I can add the aspnetdb.mdf to the App_Data folder in the Solution Explorer
The following code is used to add the asp membership tables to an already existing database instead of creating a seperate database for membership and having two databases in the application.
aspnet_regsql.exe -S .SQLEXPRESS -U username -P password -d databsename -A all
It works fine by adding the membership tables to the existing database that is located in the c drive, program files sqlserver folder.
But my database however is not in the c drive but located in my asp website app_data folder, so the above code does not give any error and the tables are not added after I run it. how can I now add the membership tables using the above code when my database is located in the website app_data folder,
I have done the following: Added additional data to the profile table. However, the information is in a string. I am not sure how to extract the information using SQL so that I have the additional data separated. Additionally, I am not too sure how to call this information back into the webpage, once the customer log ins.
View 2 RepliesI want to create a site where users can create a very basic profile, with fields like full name, City, Age and Gender, and I want the data for every new member that signs up to go into a simple Table in my sql data base. reason being I want members to be able to view other members info in a table. I am familiar with the "CreateUserWizard", but that only allows me to work with certain predefined info (email, user id, etc). If I just anually add new columns to the table in which user ID and such is saved to, and customize the CreateUserWizard controller to have text boxes for the additional data that I want (i.e. city), will the CreateUserWizard know to save that additional data in the table?
Also, I know I can add fields to the <profile> tag in the web.config files, but I dont know where that gets stored. I want all the info for the user to be stored in one table in a sql data base so that I can easily access it with a quary. I dont see where the profile properties get stored, and how it can be linked to a User ID. by the way I noticed in other posts, there was a mention of a membership provider. I noticed that although I've added some "Login" controlls (i.e. login and CreateUserWizard), no membership provider has been added to my web.config file. Do I need to do this manually? or is there a menu item that adds it for me?