Aug 31 2006

Web.config and membership

Posted by admin under Membership profile and roles

Lets look at what your web.config looks like with regards to membership, role and profile system. If you want to use SQL 2000 as database backend, then you need to enter these entries by hand.

First under system.web you define providers for erach of the subsystems - i.e a membership provider, a profile provider and a role provider. Basically what we are trying to tell ASP.NET is that when it comes to profile management, use this provider (defined by specifying class name), when it comes to membership management use that provider etc. 



<membership defaultProvider="AspNetSqlMembershipProvider">
	<providers>
		<clear/>
		<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="mainConn" minRequiredPasswordLength="5" minRequiredNonalphanumericCharacters="0" requiresQuestionAndAnswer="false" applicationName="membershipSampleApp"/>
	</providers>
</membership>
<profile>
	<providers>
		<clear/>
		<add name="AspNetSqlProfileProvider" connectionStringName="mainConn" applicationName="membershipSampleApp" type="System.Web.Profile.SqlProfileProvider"/>
	</providers>
</profile>
<roleManager enabled="true" cacheRolesInCookie="true" defaultProvider="AspNetSqlRoleProvider" cookieName=".ASPXROLES" cookiePath="/" cookieTimeout="30" cookieRequireSSL="false" cookieSlidingExpiration="true" createPersistentCookie="false" cookieProtection="All">
	<providers>
		<clear/>
		<add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="mainConn" applicationName="membershipSampleApp"/>
	</providers>
</roleManager>


So lets look deeper at the membership part
As you can see we are specifying a connectionStringName (we call it mainConn) - and by doing that we are able to tell the provider which connectionstring to use - and in the end which database backend final storage should happen in.

There are some more options, like minRequiredPasswordLength and minRequiredNonalphanumericCharacters which are pretty selfexplaining, they define how complex a users password must be.

Now, requiresQuestionAndAnswer, I set it to false, cause I hate verification systems where you have to answer a question - I want the passwords to be emailed to my email address, nothing else.

As I said, all providers points to a connectionString so we would better define that as well: 




<connectionStrings>
	<add name="mainConn" connectionString="Data Source=(local);Initial Catalog=k1;User ID=sa;PWD=stefan;" providerName="System.Data.SqlClient"/>
</connectionStrings>