Asp. NET role-based form security authentication mechanism

Brief introduction:

Form authentication in asp.net is a very powerful feature that requires very little code to implement a simple platform-independent security authentication system.

However, if you need a more complex and effective authentication mechanism, then you have to divide many users into user groups to take advantage of its flexibility. Windows Integrated authentication provides this authentication mechanism, but it uses NTLM, the Windows NT LAN Manager, so it is not cross-platform. Now more and more people use Linux system, and Mozilla Forefox browser users are more and more, we certainly can not shut these people out, so we seek another authentication mechanism. There are two choices: one is to divide multiple areas for the site, to provide multiple login pages, forcing users to register and log in one by one; the second is to group users and limit the permissions that a particular group of users has to access to a page or a region. The latter is of course a better choice. By assigning roles to individual users, we can implement this functionality.

Microsoft is. NET platform leaves a role-based authentication mechanism in form authentication, but we have to implement it ourselves. This article aims to cover some basic things of role-based authentication in form authentication, such as its concept, its implementation, how to apply it in Web applications, and so on.

Necessary Preparation:

We'll start with a database, a Web application project, a few classified directories with different security levels, and several asp.net pages. Of course, you can also add these to your existing Web application project.

1. Create a database

First select the database management system DBMS you want to use. This article uses SQL Server 2000.

In the actual application project database, there will be user data table users, it may include user unique tags: UserID, user name: UserName, Password: Password, user's email address: email, user's city: cities, user login times Logincount and so on. You can assign roles to users by creating a Userinroles datasheet (which can typically include two fields, user name: UserName, User role: Userroles).

For simplicity, I only create a users datasheet that has 3 fields, username UserName, password Password, user role userroles. Before creating a table, you want to select a database, or create a new database. To create a new database named Websolution, you need only a simple SQL statement:

Program code

Create DATABASE websolution

Go

To select a database called msdb, you can use the SQL statement:

Program code

Use msdb

Go

Next, we create the Users datasheet that we just mentioned, and the SQL script is as follows:

Program code

Create TABLE Users
(
UserName nvarchar(100) CONSTRAINT PK_UserName PRIMARY KEY,
Password nvarchar(150),
UserRoles nvarchar(100)
)

You can create an index CREDENTIALS,SQL statement for this table as follows:

Program code

Create INDEX Credentials ON Users
(
UserName,
Password
)