Brennan’s Blog

If you have deployed an ASP.NET 2.0 website with the Membership and Role providers you have had to find a way to manage the users. For a small site you want something which is a simple drag and drop approach. Unfortunately the website adminstration feature you get with Visual Studio will not remotely run on ASP.NET websites hosted on IIS, so you will want some controls to do that. The Login Controls as a part of ASP.NET 2.0 provide for commonly used activities you need on the public side of the website, but nothing has been provided by Microsoft to manager users and roles. I have packaged up a few simple User Controls to do just that.

Below are the instructions to get started, from configuring the providers to testing out the controls.

Configuration

First I will assume you already have your providers configured. Your Web.config would look like this...

<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings>
        <add name="ConnectionString1"
        connectionString="Data Source=(local);Initial Catalog=ManagedWebsite;Integrated Security=True"
            providerName="System.Data.SqlClient" />
    </connectionStrings>
    <system.web>
        <compilation debug="true" />
      <authentication mode="Forms">
        <forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH"/>
      </authentication>
      <authorization>
        <deny users="?"/>
      </authorization>

      <roleManager defaultProvider="AspNetRoleProvider" enabled="true">
        <providers>
          <clear />
          <add name="AspNetRoleProvider"
              applicationName="app1"
              connectionStringName="ConnectionString1"
              type="System.Web.Security.SqlRoleProvider" />
        </providers>
      </roleManager>

      <membership defaultProvider="AspNetSqlMembershipProvider">
        <providers>
          <clear/>
          <add name="AspNetSqlMembershipProvider"
              applicationName="app1"
              connectionStringName="ConnectionString1"
              enablePasswordRetrieval="false"
              enablePasswordReset="true"
              requiresUniqueEmail="true"
              passwordFormat="Clear"
              passwordStrengthRegularExpression=""
              minRequiredPasswordLength="1"
              minRequiredNonalphanumericCharacters="0"
              type="System.Web.Security.SqlMembershipProvider, System.Web,
                    Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
        </providers>
      </membership>

    </system.web>
</configuration>

Automatic Setup

The next step to run a managed website is to create your first user and place it into an Admin role. That is tricky because you would normally want your Admin functionality to be protected. To have this done automatically you can place the following code in your Global.asax.

        public void Application_Start(object sender, EventArgs e)
        {
            String[] requiredRoles = { "Admin", "Users", "Editors" };
            foreach (String role in requiredRoles)
            {
                if (!Roles.RoleExists(role))
                {
                    Roles.CreateRole(role);
                }
            }
            string[] users = Roles.GetUsersInRole("Admin");
            if (users.Length == 0)
            {
                // create admin user
                MembershipCreateStatus status;
                MembershipUser adminUser = Membership.GetUser("admin");

                if (adminUser != null)
                {
                    status = MembershipCreateStatus.Success;
                }
                else
                {
                    Membership.CreateUser("admin", "easy12guess", "webmaster@yourdomain.com",
                                          "Favorite color?", "Offwhite", true, out status);
                }
                if (MembershipCreateStatus.Success.Equals(status))
                {
                    Roles.AddUserToRole("admin", "Admin");
                }
                else
                {
                    //Logger.Warn(("Unable to create admin user: " + status.ToString()));
                }
            }
        }

That bit of code will ensure that your required roles and an Admin user is created with a fresh website and database.

Controlling Access

Next, lock down the Admin folder so that only users in the Admin role can reach it. The following configuration segment can be added to the bottom of your Web.config just before the closing the configuration element.

  <location path="Admin">
    <system.web>
      <authorization>
        <allow roles="Admin"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

The Free Controls

Now you are ready to use the controls to manage users and roles. The User Controls I created are a set of controls I called the Manager Controls.

• ManagerControl.ascx
• UserManager.ascx
• RolesManager.ascx

These User Controls are in the ManagedControls folder underneath the Admin folder. To use them, simply download the Managed Website and try it yourself. It comes pre-configured to talk to a local database called ManagedWebsite over a Trusted Connection, so be sure to set that up before trying to view the site.

Feel free to do whatever you like with this sample website. You will notice that I did not bother to style it in any way. It also only provides the basic functionality of the Membership and Role providers. It does not manage Profile data. What it does do is allow you to create users, edit their bits and assign users to roles.

Enjoy!