MembershipProvider in asp.net

Question

What is the MembershipProvider really used for? Do I need it at all? While using forms authentication I never specified any membership provider in the config file, i've been authenticating users by calling FormsAuthentication.SetAuthCookie. I've been reading quite a lot about it yesterday and I can't figure out why would i use it?

Answer 1

The MembershipProvider is first of all a pluggable, standardised repository. If you base your authentication on MembershipProvider, you can later exchange it with another provider with no changes to your web site. Also, it is supported by standard components (the Login, LoginView, LoginStatus, LoginName and PasswordRecovery controls), and can be administered through the ASP.NET administration pages.

Answer 2

It is a very handy thing as Tor already said.

If you use the default controls for usermanagement/login/password reset etc, then you can just change a web.config setting, and your users are able to use another mechanisem to authenticate.

There are providers for AD, for SQL Server for ADAM, for Federrated Login and some more. It is not that important when you develop an intranet application, since you will most likely rely on NTLM or kerberos, but when you publish to the web it gets quite handy.

There is also a 2nd component to this provider, the roleprovider, which is another repository that can be used to handle roles in your application

Answer 3

I don't think its that useful if you don't use the built in controls.

What you can do is just implement a membership provider with all methods throwing NotImplementedException, and implement as you find out what methods are actually used. Its just 2 or 3 if i remember correctly.

The RoleProvider is more useful, i use a provider with just the GetRolesForUser method implemented, so i can use the built in support for role-based authorization.