New site creation and security/authentication,- should I use ASP.net Membership Provider?

Question

There seem to many ways to skin this particular cat - but which is the best and easiest to implement. It would seem that the ASP.net Membership Provider is the one that will save more time, so my questions are:

1. What are the pros/cons of Membership?
2. How do you integrate the auto generated user db with your own custom made db? e.g customers/orders/products db. (We are talking MS Sql here BTW)
3. Where can I find a good tutorial thats up do date?

Many thanks.

Answer 1

Membership is lightweight and easy to set up. You can also use the various providers to use Active Directory or some other member location.

You shouldn't need to integrate the databases, you can use one to authenticate users and then as long as they are valid, go query another database for the data. This is a good way to keep information seperate for security reasons.

For a good tutorial, I'd suggest: http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx

And if you want to create your own membership provider: http://www.asp.net/learn/videos/video-189.aspx

Answer 2

Tutorials - there are a series of good tutorials on the ASP.Net site. We have used the membership provider facilities, and have it integrated with our database - we use the "user name" value as a foreign key to our own tables with additional "business" information.

The system works well with minimal coding.

Answer 3

Overall I give it a thumbs up, but there are several minor cons I can think of:

• Roles are just strings, there's no way to attach additional information to them without rolling your own code.
• Some of the Login controls don't set their default button properly, so hitting the "enter" key while in an input field does nothing. You can fix this by setting it yourself.
• No default way to require numbers in a password, just symbols.
• Login controls w/ SqlMembershipProvider don't display specific "user is locked out" messages.

Either a con or a pro, depends on your point of view:

• User names are case-insensitive in the SqlMembershipProvider