ASP.NET Membership: to be or not to be?

Question

I'm contemplating how I should implement authorization and authentication with ASP.NET and MVC2. Lets refer to this as a user system.

I have seen three types of solutions in the wild:

• Use the built-in ASP.NET Membership system (NerdDinner)
• Roll your own (Shrinkr)
• Create an abstraction layer for the ASP.NET membership (Tekpub's mvcstarter kit)

I've been reading your knowing thoughts and many say that trying to roll your own "user system" might be even dangerous, if you are not careful with the security details. On the other hand, the solution is a whole lot simpler. Everything is probably stored in one database and user specific stuff is in one users table. The overhead for this solution seems to be quite low.

Using the ASP.NET membership solution allows to use a lot of out-of-the-box functionality, but IMHO, is really confusing. You probably need to store the membership stuff in its own database and somehow be able to link the user entity from your site specific database to the ASP.NET one.

If you are using the ASP.NET membership

• How does your database schema look like? How do you create foreign relationships to the ASP.NET membership users (ie. Songs <=> FavoriteSongs (<=> SiteUsers) <=> aspnet_Users)?
• Why didn't you roll your own?

If you have rolled your own

• What kind of user system abstraction layer, if any, did you use?
• Why didn't you use ASP.NET membership?

I'm really paralyzed by analyzing these possibilities. Please kick me in the right direction from this sticky web of membership paralysis! Thank you.

Answer 1

the built in membership provider is already secure and is really REALLY easy to use. You can be up and running with built in membership in a couple of hours. Alternatively (depending on what type of application you're building) you could also check out using OpenID which is what StackOverflow uses.

Also, with the built in Membership Provider, creating relationships is as easy as using a "uniqueidentifier" to relate the aspnet_User table (I can't remember the exact name off the top of my head) with the related table.

I store all of my membership "stuff" in the same database as the system db, and it has never steered me wrong. Creating the membership "stuff" is easy as well. Just run the aspnet_regsql.exe against the database that you want to have asp.net membership

Here's another SO question along the same lines.