Zoki's Blog

Using the built in ASP.NET Membership provider in Windows Forms or Console applications

Creating and validating users

One of the features in ASP.NET 2.0 is the Membership and Role providers. These providers represent nicely designed system that allows us to handle the storage of user information any way we like and all we need to do is to create the appropriate providers and configure the application to use them. The abstraction provided by MembershipProvider base class for example, is a very powerful concept in ASP.NET 2.0. It simplifies the management of user information by providing a neat layer. Even though these providers are created for use in ASP.NET it will be very nice if we could use the same providers in Windows Forms or Console applications. As we know, ASP.NET 2.0 provides the SqlMembershipProvider class and the aspnet_regsql.exe command line utility to create the database for the required user management. This database could be standalone database that will hold only the membership and roles data (there are more things that we could do with it like personalization but this is not the scope in this blog) or part of our custom application database.

In this first part I will discuss how to create and validate users and I will use a standalone database just to show you how easy the integration of the ASP.NET 2.0 Membership and Roles provider in Windows Forms/Console applications.

Let’s create a very simple console application with user management. At the begging just create one Console application (C# or VB does not matter) and add reference to System.Web assembly in the project and the using statement as follows:

using System.Web.Security;

Now add the following code to Main() method:

if (Membership.ValidateUser("Zoki", "Password"))
{
    Console.WriteLine("User valid.");
}
else
{
    Console.WriteLine("User invalid.");
}
Console.ReadLine();

You can try and run the application at this point. Please not be surprised when the application reports that the user is invalid, after all, the username and password that we are trying to validate, don't exist in the database. To check if this validation works we should create user and validate the same. Add the following code above the ValidateUser call:

MembershipCreateStatus status = new MembershipCreateStatus();
Membership.CreateUser("firstuser", "p@ssword", 
                      "zoki.zlatanov@gmail.com", "question",
                      "answer", true, out status);
Console.WriteLine(status);

Run the application now...

Works, right?

So where is the magic here? We haven’t done anything to configure the membership provider or told it which database to use?
The secret is that the membership provider checks for, and creates if needed, a new directory under the application directory named App_Data with a SQL Express database ASPNETDB with the required structure. This database is then used to store the user information. To see the database click on the Show All Files button in the explorer, Open the bin/Debug folder and you will see an App_Data folder with the ASPNETDB.MDF database inside of it.
In this moment we have done very little work and in the meantime we have a working application that can register and validate users. If we try to execute the code again we will get DuplicateUserName status but the validation of the user (the ValidateUser method) will pass again. The problem that we are facing now is the bunch of information that we need to pass to the CreateUser method just to create one. For example supplying the password question and answer in Windows Forms application is not quite common task. Fortunately the Membership.CreateUser method has an overload that accepts only 2 parameters which will do our job. Those parameters are naturally username and password. Lets add the following code

Membership.CreateUser("seconduser", "p@ssword1");

instead

Membership.CreateUser("firstuser", "p@ssword", 
                      "zoki.zlatanov@gmail.com",
                      "question", "answer", true,
                      out status);

Run the application...
You are getting an exception System.Web.Security.MembershipCreateUserException with the message "The password-answer supplied is invalid.".
To avoid this we should set the Membership properties. There is one way to do that and that is by adding these settings to application app.config. Because we still don't have one in our application lets add it. Now we need to add the following to the bottom of the <configuration> section:

<system.web>
  <membership>
    <providers>
      <remove name="AspNetSqlMembershipProvider"/>
      <add name="AspNetSqlMembershipProvider"
           type="System.Web.Security.SqlMembershipProvider, System.Web,
           Version=2.0.0.0, Culture=neutral,
           PublicKeyToken=b03f5f7f11d50a3a"
           connectionStringName="LocalSqlServer"
           enablePasswordRetrieval="false"
           enablePasswordReset="false"
           requiresQuestionAndAnswer="false"
           applicationName="/"
           requiresUniqueEmail="false"
           passwordFormat="Hashed"
           maxInvalidPasswordAttempts="3"
           minRequiredPasswordLength="4"
           minRequiredNonalphanumericCharacters="0"
           passwordAttemptWindow="10"
           passwordStrengthRegularExpression="" />
    </providers>
  </membership>
</system.web>

This section is very familiar cause it comes from a web application config file. Maybe it seems little strange but as I've mention in the beginning the Membership provider was written by the ASP.NET team for ASP.NET use.  So what does this section actually do? This configuration block removes the default membership provider as defined in the machine.config and adds the same one but this time with all our settings in place.
Try to run the application now... The user will be created without any problems.

In the next part I will show you how to add roles and set users roles.

Until next time... Happy coding