What to use for membership in ASP.NET

Question

I'm not very experienced at using ASP.NET, but I've used built in membership providers for simple WebForms application, and I found them PITA when trying to extend the way they work (add/remove few fields and redo controls accordingly). Now I'm preparing for MVC (ASP.NET MVC or Monorail based) project, and I'm thinking - is there a better way to handle users? Have them log in/log out, keep certain parts of the site available to certain users (like logged in users, or something similar to "share this with friends" feature of many social networking sites, where you can designate users that have access to certain things. How best to acheave this in the way that will scale well?

Answer 1

Have you considered using ActiveDirectory for this? Or, perhaps, OpenLDAP? You can manage each user's groups, permissions, 'authority', and so on.

Answer 2

It depends.

If it's an internal application, Active Directory or OpenLDAP might be the way to go.

If it's a public application, I suggest to look at aspnet_regsql. You will be able to setup a database with Authentication in no time.

Answer 3

I guess, I wasn't clear on that. To rephrase my question: Would you use standard ASP.NET membership provider for a web-facing app, or something else (what)?

Answer 4

The Membership Provider in ASP.NET is very handy and extensible. It's simple to use the "off the shelf" features like Active Directory, SQL Server, and OpenLDAP. The main advantage is the ability to not reinvent the wheel. If your needs are more nuanced than that you can build your own provider by extending overriding the methods that the ASP.NET controls use.

I am building my own Custom Membership Provider for an e-commerce website. Below are some resources for more information on Membership Providers. I asked myself the same questions when I start that project.

These resources were useful to me for my decision:

• Writing a Custom Membership Provider - DevX
• How do I create a Customer Membership Provider - ASP.NET, Microsoft
• Implementing a Membership Provider - MSDN
• Examining ASP.NET 2.0's Membership, Roles, and Profile - 4GuysFromRolla
• Create Custom Membership Provider for ASP.NET Website Security - David Hayden
• Setting up a Custom Membership Provider - Channel 9

I personally don't think there is a need to use something other than the builtin stuff unless you either want to abuse yourself or your needs are impossible to satisfy by anything the builtin functionality.