I use the term data store to refer to any physical means of persisting (saving) data — this usually means saving data in a database or in Active Directory, but .NET abstracts the actual data storage mechanism from the classes that manipulate the data. The provider class is the one that stores the data on behalf of other classes that manipulate data. This provider model design pattern, introduced in Chapter 3, is pervasive in .NET since the 2.0 release — you can frequently "plug in" a different backend provider to change the mechanism used to save and retrieve data. The Membership class uses a secondary class (called a membership provider) that actually knows the details of a particular data store and implements all the supporting logic to read and write data to/from it. You can almost think of the Membership class as a business layer class (in that it only manipulates data), and the provider class as the data access class, which provides the details of persistence (even though a pure architect might argue the semantics). Two built-in providers are available for the Membership system, and you can choose one by writing some settings in the web.config file. The built-in providers are the ones for SQL Server (SqlMembershipProvider) and for Active Directory (ActiveDirectoryMembershipProvider), but you can also write your own or find one from a third party (for use with Oracle, MySQL, DB2, and so on, or perhaps XML files). Figure 4-1 illustrates the provider model design pattern.

I find that the use of the provider model provides tremendous flexibility, because you can change the provider used by the Membership API under the hood without affecting the rest of the code, because you just access the Membership "business" class from the pages and the other business classes, and not the providers directly. Actually, you may even ignore which provider is used, and where and how the data is stored (this is the idea behind abstraction of the data store). Abstraction is obviously provided to users in the sense that they don't need to know exactly how their data will be stored, but now we also have abstraction for developers because they, too, don't always need to know how the data is stored!

Figure 4.1. Figure 4-1

To create a new provider, you can either start from scratch by building a completely new provider that inherits directly from System.Web.Security.MembershipProvider (which in turn inherits from System.Configuration.Provider.ProviderBase) or you can just customize the way some methods of an existing provider work. For example, let's assume that you want to modify the SqlMembershipProvider so that it validates a user's password to make sure that it's not equal to his username. You simply need to define your own class, which inherits from SqlMembershipProvider, and you can just override the CreateUser method like this:

Class SqlMembershipProviderEx
    Inherits SqlMembershipProvider
    Public Overloads Overrides Function CreateUser(ByVal username As String,
ByVal password As String, ByVal email As String,
ByVal passwordQuestion As String, ByVal passwordAnswer As String,
ByVal isApproved As Boolean, _
    ByVal providerUserKey As Object, ByRef status As MembershipCreateStatus)
As MembershipUser
        If username.ToLower() = password.ToLower() Then
            status = MembershipCreateStatus.InvalidPassword
            Return Nothing
        Else
            Return MyBase.CreateUser(username, password, email,
passwordQuestion, passwordAnswer, isApproved, _
            providerUserKey, status)
        End If
    End Function
End Class

The provider model design pattern is also very useful in the migration of legacy systems that already use their own custom tables and stored procedures. Your legacy database may already contain thousands of records of user information, and you want to avoid losing them, but now you want to modify your site to take advantage of the new Membership class. Instead of creating a custom application to migrate data to a new data store (or using SQL Server DTS or SQL Server Integration Services to copy the data from your tables to the new tables used by the standard SqlMembershipProvider), you can just create your own custom provider that directly utilizes your existing tables and stored procedures. If you're already using a business class to access your account's data from the ASP.NET pages, then creating a compliant provider class may be just a matter of changing the name and signature of some methods. Alternatively, you can follow this approach: keep your current business class intact but make it private, and then move it inside a new provider class that delegates the implementation of all its methods and properties to that newly private legacy business class. The advantage of doing this instead of just using your current business class "as is" is that you can change to a different data store later by just plugging it into the membership infrastructure — you wouldn't have to change anything in the ASP.NET pages that call the built-in Membership class.

Once you have the provider you want (either one of the default providers, a custom one you developed on your own, or a third-party offering), you have to tell ASP.NET which one you want to use when you call the Membership class' methods.

The web.config file is used to specify and configure the provider for the Membership system. Many of the default configuration settings are hard-coded in the ASP.NET runtime instead of being saved in the Machine.Config file. This is done to improve performance by reading and parsing a smaller XML file when the application starts, but you can still modify these settings for each application by assigning your own values in web.config to override the defaults. You can read the default settings by looking at the Machine.config.default file found in the following folder (the "xxxxx" part should be replaced with the build number of your installation):

C:<Windows Folder>Microsoft.NETFrameworkv2.0.xxxxxCONFIG

What follows is the definition of the <membership> section of the file, where the SqlMembershipProvider is specified and configured:

<system.web>
   <membership>
      <providers>
         <add name="AspNetSqlMembershipProvider"
            type="System.Web.Security.SqlMembershipProvider, System.Web,
               Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
            connectionStringName="LocalSqlServer"
            enablePasswordRetrieval="false"
            enablePasswordReset="true"
            requiresQuestionAndAnswer="true"
            applicationName="/"
            requiresUniqueEmail="false"
            passwordFormat="Hashed"
            maxInvalidPasswordAttempts="5"
            passwordAttemptWindow="10"
            passwordStrengthRegularExpression=""
         />
      </providers>
   </membership>

   <!-- other settings... -->
</system.web>

You can register more providers inside the <providers> section and choose which one you want to use by specifying its name in the defaultProvider attribute of the <membership> element (not shown above). Another attribute of <membership> is userIsOnlineTimeWindow, which specifies how many minutes after the last activity a user is still considered online. That is, if a user logs in, brings up one page, but then closes her browser immediately, she will be counted as being online for this number of minutes. We need this kind of parameter because we have no definite way to know when a user has left the site or closed down his or her browser. You can test this by checking the value returned by Membership.GetNumberOfUsersOnline as users come to your site and then leave.

In the last code snippet, you saw the default settings used to register the SqlMembershipProvider. The following table lists the attributes you can specify when you register the provider, in the <provider> element.

These attributes let you fine-tune the membership system. For example, the capability to specify a regular expression that the password must match gives you great flexibility to meet stringent requirements. But one of the most important properties is certainly passwordFormat, used to specify whether you want passwords to be encrypted, or whether you just want a hash of them saved. Passwords are hashed or encrypted using the key information supplied in the <machineKey> element of the configuration file (you should remember to synchronize this machine key between servers if you will deploy to a server farm). The default algorithm used to calculate the password's hash is SHA1, but you can change it through the validation attribute of the machineKey element. Storing passwords in clear text offers the best performance when saving and retrieving the passwords, but it's the least secure solution. Encrypting a password adds some processing overhead, but it can greatly improve security. Hashing passwords provides the best security because the hashing algorithm is one-way, which means that the passwords cannot be retrieved in any way, even by an administrator. If a user forgets her password, she can only reset it to a new auto-generated one (typically sent by e-mail to the user). The best option always depends on the needs of each particular website: if I were saving passwords for an e-commerce site on which I might also save user credit card information, I would surely hash the password and use a Secure Sockets Layer (SSL) connection in order to have the strongest security. For our content-based website, however, I find that encrypting passwords is a good compromise. It's true that we're also building a small e-commerce store, but we're not going to store very critical information (credit cards numbers or other sensitive data) on our site.

Even though the ASP.NET membership system is prebuilt and ready to go, this is not a good reason to ignore its design and data structures. You should be familiar with this system to help you diagnose any problems that might arise during development or deployment. Figure 4-2 shows the tables used by the SqlMembershipProvider class to store credentials and other user data. Of course, the data store's design of other providers may be completely different (especially if they are not based on relational databases).

Figure 4.2. Figure 4-2

The interesting thing you can see from Figure 4-2 is the presence of the aspnet_Applications table, which contains a reference to multiple applications (websites). Both the aspnet_Users table and the aspnet_Membership table contain a reference to a record in aspnet_Applications through the ApplicationId foreign key. This design enables you to use the same database to store user accounts for multiple sites, which can be very helpful if you have several sites using the same database server (commonly done with corporate websites or with commercial low-cost shared hosting). In a situation where you have a critical application that requires the maximum security, you'll want to store the membership data in a dedicated database that only the site administrator can access. If you are using a SQL Server 2008 Express Edition database, it this requires you to use your own private database, deployed as a simple file under the App_Data special folder. In addition to these tables, there are also a couple of views related to membership (vw_aspnet_MembershipUsers and vw_aspnet_Users) and a number of stored procedures (aspnet_membership_xxx) for the CRUD (Create, Read, Update, and Delete) operations used for authorization. You can explore all these objects by using the Visual Studio's Server Explorer window or SQL Server Management Studio, as shown in Figure 4-3.

Figure 4.3. Figure 4-3

If you configure the provider so that it uses the default SQL Server Express database named ASPNETDB located under the App_Data folder, the ASP.NET runtime will automatically create all these database objects when the application is run for the first time! Because we are using this database for our site, we don't need to do anything else to set up the data store. However, if you're using a full edition of SQL Server 2008, you'll need to set up the tables manually by running the aspnet_sql.exe tool from the Visual Studio 2008 command prompt. You can find the aspnet_sql.exe in the C:<Windows Folder>Microsoft.NETFrameworkv2.0.xxxxx folder if you want to just open it by hand. This little program lets you to choose an existing database on a specified server, and it creates all the required objects to support membership, along with caching, profiles, personalization, and more. Figure 4-4 shows a couple of screens generated by this tool.

Figure 4.4. Figure 4-4

As you saw earlier, creating, validating, and managing users programmatically requires only a few lines of code. But what about writing no code at all? That's actually possible now, thanks to the new Login family of controls introduced with ASP.NET 2.0. These controls provide a premade user interface for the most common operations dealing with membership and security, such as creating a new account, logging in and out, retrieving or resetting a forgotten password, and showing different output according to the authenticated status of the current user. Figure 4-5 shows the Visual Studio IDE with the Login controls section of the Toolbox. It also shows a CreateUserWizard control dropped on a form, and its Smart Tasks pop-up window.

Figure 4.5. Figure 4-5

The CreateUserWizard Control

A wizard is an ASP.NET feature used to create a visual interface for a process that involves multiple steps. Each step has a separate visual panel or frame containing its own group of controls. After the user fills in values for controls of each step, he can press a link to advance to the next step in the wizard.

The CreateUserWizard control creates a user interface for a user to register, by providing the username, password, and e-mail address. The secret question and answer are also requested, but only if the current membership provider has the requiresQuestionAndAnswer attribute set to true; otherwise, these two last textboxes are hidden. When the Submit button is clicked, the control calls Membership.CreateUser under the hood on your behalf. By default, the code produced by the designer (and visible in the Source View) is:

<asp:CreateUserWizard ID="CreateUserWizard1" runat="server">
   <WizardSteps>
      <asp:CreateUserWizardStep runat="server">
      </asp:CreateUserWizardStep>
      <asp:CompleteWizardStep runat="server">
      </asp:CompleteWizardStep>
   </WizardSteps>
</asp:CreateUserWizard>

It contains no appearance attributes, and the control will look plain and simple, with the default font, background, and foreground colors. However, you can specify values for all the attributes used to control the appearance. An easy way to do that is by clicking Auto Format from the Smart Tasks window and selecting one of the premade styles. Figure 4-6 shows the control in the Elegant style.

Figure 4.6. Figure 4-6

The corresponding source code was automatically updated as follows:

<asp:CreateUserWizard ID="CreateUserWizard1" runat="server"
   BackColor="#F7F7DE" BorderColor="#CCCC99" BorderStyle="Solid"
   BorderWidth="1px" Font-Names="Verdana" Font-Size="10pt">
   <WizardSteps>
      <asp:CreateUserWizardStep runat="server">
      </asp:CreateUserWizardStep>
      <asp:CompleteWizardStep runat="server">
      </asp:CompleteWizardStep>
   </WizardSteps>
   <SideBarStyle BackColor="#7C6F57" BorderWidth="0px"
      Font-Size="0.9em" VerticalAlign="Top" />
   <SideBarButtonStyle BorderWidth="0px" Font-Names="Verdana"
      ForeColor="#FFFFFF" />
   <NavigationButtonStyle BackColor="#FFFBFF" BorderColor="#CCCCCC"
      BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana"
      ForeColor="#284775" />
   <HeaderStyle BackColor="#F7F7DE" BorderStyle="Solid" Font-Bold="True"
      Font-Size="0.9em" ForeColor="#FFFFFF" HorizontalAlign="Left" />
   <CreateUserButtonStyle BackColor="#FFFBFF" BorderColor="#CCCCCC"
      BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana"
      ForeColor="#284775" />
   <ContinueButtonStyle BackColor="#FFFBFF" BorderColor="#CCCCCC"
      BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana"
      ForeColor="#284775" />
   <StepStyle BorderWidth="0px" />
   <TitleTextStyle BackColor="#6B696B" Font-Bold="True" ForeColor="#FFFFFF" />
</asp:CreateUserWizard>

Back in Chapter 2, we discussed the disadvantages of having the appearance properties set in the .aspx source files, in comparison to having them defined in a separate skin file as part of an ASP.NET theme. Therefore, I strongly suggest that you not leave the auto-generated appearance attributes in the page's source code, but instead cut and paste them into a skin file. You can paste everything except for the ID property and the <WizardSteps> section, as they are not part of the control's appearance.

The <WizardSteps> section lists all the steps of the wizard. By default it includes the step with the registration form, and a second one with the confirmation message. You can add other steps between these two, and in our implementation we'll add a step immediately after the registration form, where the user can associate a profile to the new account. The wizard will automatically provide the buttons for moving to the next or previous step, or to finish the wizard, and raise a number of events to notify your program of what is happening, such as ActiveStepChanged, CancelButtonClick, ContinueButtonClick, FinishButtonClick, NextButtonClick, and PreviousButtonClick.

If the available style properties are not enough for you, and you want to change the structure of the control, that is, how the controls are laid down on the form, you can do that by defining your own template for the CreateUserWizardStep (or for the CompleteWizardStep). As long as you create the textboxes with the IDs the control expects to find, the control will continue to work without requiring you to write code to perform the registration manually. The best and easiest way to find which ID to use for each control is to have Visual Studio .NET convert the step's default view to a template (click the Customize Create User Step link in the control's Smart Tasks window), and then modify the generated code as needed. The code that follows is the result of Visual Studio's conversion and the deletion of the HTML layout tables:

<WizardSteps>
   <asp:CreateUserWizardStep runat="server">
      <ContentTemplate>
      <b>Sign Up for Your New Account</b><p></p>
      User Name: <asp:TextBox ID="UserName" runat="server" />
      <asp:RequiredFieldValidator ID="UserNameRequired" runat="server"
         ControlToValidate="UserName" ErrorMessage="User Name is required."
         ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
      <br />
      Password: <asp:TextBox ID="Password" runat="server" TextMode="Password" />
      <asp:RequiredFieldValidator ID="PasswordRequired" runat="server"
         ControlToValidate="Password" ErrorMessage="Password is required."
         ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
      <br />
      Confirm Password: <asp:TextBox ID="ConfirmPassword" runat="server"
         TextMode="Password" />
      <asp:RequiredFieldValidator ID="ConfirmPasswordRequired" runat="server"
         ControlToValidate="ConfirmPassword"
         ErrorMessage="Confirm Password is required."
         ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
      <asp:CompareValidator ID="PasswordCompare" runat="server"
         ControlToCompare="Password" ControlToValidate="ConfirmPassword"
         ErrorMessage="The Password and Confirmation Password must match."
         ValidationGroup="CreateUserWizard1"></asp:CompareValidator>
      <br />
      E-mail: <asp:TextBox ID="Email" runat="server" />
      <asp:RequiredFieldValidator ID="EmailRequired" runat="server"
         ControlToValidate="Email" ErrorMessage="E-mail is required."
         ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
      <br />
      Security Question: <asp:TextBox ID="Question" runat="server" />
      <asp:RequiredFieldValidator ID="QuestionRequired" runat="server"
         ControlToValidate="Question" ErrorMessage="Security question is required."
         ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
      <br />

Security Answer: <asp:TextBox ID="Answer" runat="server" />
      <asp:RequiredFieldValidator ID="AnswerRequired" runat="server"
         ControlToValidate="Answer" ErrorMessage="Security answer is required."
         ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
      <br />
      <asp:Literal ID="ErrorMessage" runat="server" EnableViewState="False" />
      </ContentTemplate>
   </asp:CreateUserWizardStep>
   <asp:CompleteWizardStep runat="server">
   </asp:CompleteWizardStep>
</WizardSteps>

Note

All of the various validation controls are declared with a ValidationGroup property set to the control's name, that is, CreateUserWizard1. The CreateUserWizard creates a Submit button with the same property, set to the same value. When that button is clicked, only those validators that have the ValidationGroup property set to the same value will be considered. This is a powerful feature of ASP.NET that you can use anywhere to create different logical forms for which the validation is run separately, according to which button is clicked.

For the custom-made Create User step of the wizard, the Question and Password fields are not automatically hidden if the current membership provider has the requiresQuestionAndAnswer attribute set to false, as would happen otherwise.

You can also set up the control so that it automatically sends a confirmation e-mail to users when they complete the registration process successfully. The setup is defined by the CreateUserWizard's <MailDefinition> subsection, and consists of the sender's e-mail address, the mail subject, and a reference to the text file that contains the e-mail's body. The following code shows an example:

<asp:CreateUserWizard runat="server" ID="CreateUserWizard1">
   <WizardSteps>
      ...
   </WizardSteps>
   <MailDefinition
      BodyFileName="~/RegistrationMail.txt"
      From="[email protected]"
      Subject="Mail subject here">
   </MailDefinition>
</asp:CreateUserWizard>

The RegistrationMail.txt file can contain the <% UserName %> and <% Password %> special placeholders, which at runtime will be replaced with the values taken from the new registration's data. To send the mail, you must have configured the SMTP server settings in the web.config file, through the <mailSettings> element and its subelements, as shown in the following code:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
   <system.web> <!-- some settings here...--> </system.web>
   <system.net>
      <mailSettings>
         <smtp deliveryMethod=" Network " from="[email protected]">

<network defaultCredentials="true" host="(localhost)" port="25" />
         </smtp>
      </mailSettings>
   </system.net> </configuration>

The Login Control

The Login control does exactly what its name suggests: it allows the user to log in. It provides the user interface for typing the username and password, and choosing whether the login will be persistent (saved across different sessions) or not. For the default simple appearance, you just need to declare the control as follows:

<asp:Login ID="Login1" runat="server" />

However, if you apply the Elegant prebuilt style to it, it will look as shown in Figure 4-7.

Figure 4.7. Figure 4-7

Under the covers, this control calls the Membership.ValidateUser method to check whether the provided credentials are found in the data store, and if so, it calls FormsAuthentication.RedirectFormLoginPage to create the encrypted authentication ticket, saves it into a client cookie, and redirects the user to the page that he or she originally tried to access before being redirected to the login page. The control exposes a lot of properties: many are for changing its appearance (colors, fonts, etc.), and others enable you to specify whether you want to show a link to the registration page (CreateUserText and CreateUserUrl properties), a link to the page to recover a forgotten password (PasswordRecoveryText and PasswordRecoveryUrl properties), and whether the control should be hidden when the user is already logged in (the VisibleWhenLoggedIn property). Of course, you can completely customize the way the CreateUserWizard control looks, by defining a template. Here's an example:

<asp:Login ID="Login1" runat="server">
   <LayoutTemplate>
      Username: <asp:TextBox ID="UserName" runat="server" />
      <asp:RequiredFieldValidator ID="UserNameRequired" runat="server"
         ControlToValidate="UserName" ErrorMessage="User Name is required."
         ValidationGroup="Login1">*</asp:RequiredFieldValidator>
      Password: <asp:TextBox ID="Password" runat="server" TextMode="Password" />
      <asp:RequiredFieldValidator ID="PasswordRequired" runat="server"
         ControlToValidate="Password" ErrorMessage="Password is required."
         ValidationGroup="Login1">*</asp:RequiredFieldValidator>
      <asp:CheckBox ID="RememberMe" runat="server" Text="Remember me next time." />
      <asp:Literal ID="FailureText" runat="server" EnableViewState="False" />
      <asp:Button ID="LoginButton" runat="server" CommandName="Login"
      Text="Log In" ValidationGroup="Login1" />
   </LayoutTemplate>
</asp:Login>

Remember that the only important thing is that you give textboxes, buttons, labels, and other controls the specific IDs that the parent control expects to find. If you start defining the template from the default template created by VS2008, this will be very easy.

The ChangePassword Control

The ChangePassword control allows users to change their current password through the user interface shown in Figure 4-8.

Figure 4.8. Figure 4-8

This control is completely customizable in appearance, by means of either properties or a new template. As with the CreateUserWizard control, its declaration can contain a <MailDefinition> section, where you can configure the control to send a confirmation e-mail to the user with her new credentials.

The PasswordRecovery Control

The Password Recovery control enables users to recover or reset their password, in case they forgot it. The first step, shown in Figure 4-9, is to provide the username.

Figure 4.9. Figure 4-9

For the next step, the user will be asked the question he or she chose at registration time. If the answer is correct, the control sends the user an e-mail message. As expected, there must be the usual MailDefinition, along with the current password, or a newly generated one if the membership provider's enablePasswordRetrieval attribute is set to false or if the provider's passwordFormat is hashed.

<asp:LoginView ID="LoginView1" runat="server">
   <AnonymousTemplate>
      <asp:Login runat="server" ID="Login1" />
   </AnonymousTemplate>
   <LoggedInTemplate>
      <asp:LoginName ID="LoginName1" runat="server" FormatString="Welcome {0}" />
      <br />
      <asp:LoginStatus ID="LoginStatus1" runat="server" />
   </LoggedInTemplate>
</asp:LoginView>

Since ASP.NET 2.0 was released Microsoft has released an AJAX framework to build rich user interfaces. It was originally an add-on to the .NET Framework, but became part of the framework with the 3.5 release. The ASP.NET AJAX framework is a natural extension of programming with .NET, except that it is a JavaScript framework that executes in the browser. The main benefit of the ASP.NET AJAX framework is the capability to program in JavaScript the way you can against the .NET Framework. This should drastically reduce the learning curve needed for ASP.NET programmers to leverage this AJAX framework. While there are great AJAX frameworks available, such as JQuery, ASP.NET AJAX is specifically designed to integrate tightly with the server-side aspects of ASP.NET, such as the Membership and Profile providers.

The ASP.NET AJAX framework is composed of a series of pseudo-namespaces and -classes. I use the prefix "pseudo" because there are no true object-oriented concepts in JavaScript. But the ASP.NET AJAX framework provides a series of common classes that can be used to build the rich user experiences demanded by users today. For more information on the AJAX namespaces and classes visit http://msdn.microsoft.com/en-us/library/bb397536.aspx.

The Sys.Services namespace contains a set of classes that interact with the Membership, Role, and Profile providers on the server through web services. The Authentication class is the proxy class used to interact with the Membership provider. This class has two members, Login and Logout. The Login method performs forms authentication and sets the authentication cookie upon successful authentication. The following table describes the arguments to Login:

Similarly, the Logout function clears the form's authentication cookie, and the user must log back in to the site to access secured content areas. The Logout function takes a series of arguments, too:

Before forms authentication can be executed using ASP.NET AJAX, it must be enabled to do so in the web.config file. If you are creating a new website with Visual Studio 2008, there will be a line in the web.config file that needs to be uncommented to enable grant access from the application's services. The section is actually part of the system.web.extensions section, which holds the key to implementing the ASP.NET AJAX interfaces to profiles and roles:

<system.web.extensions>
<scripting>

<webServices>

    <authenticationService enabled="true" requireSSL="false" />

    <profileService enabled="true" readAccessProperties="FirstName, LastName" />

<roleService enabled="true" />

</webServices>

<scriptResourceHandler enableCompression="true" enableCaching="true" />
</scripting>
</system.web.xtensions>

Once these sections have been officially added to the site, client-side script can be written to access these providers.

Basically, you have two ways to control and protect access to sensitive pages: you can do it either imperatively (programmatically) or declaratively (using a config file). If you want to do it by code, in the page's Load event you would write something like the following snippet:

If Not Roles.IsUserInRole("Administrators") Then
    Throw New System.Security.SecurityException("Sorry, this is a restricted
function you are not authorized to perform")
End If

When you don't pass the username to the Roles.IsUserInRole method, it takes the name of the current user, and then "forwards" the call to the IsInRole method of the current user's IPrincipal interface. Therefore, you can call it directly and save some overhead by using the following code:

If Not Me.User.IsInRole("Administrators") Then
    Throw New System.Security.SecurityException("Sorry, this is a restricted
function you are not authorized to perform")
End If

The biggest disadvantage of imperative (programmatic) security is that to secure an entire folder, you have to copy and paste this code in multiple pages (or use a common base class for them). Even worse, when you want to change the ACL (access control list) for a page or folder (because, for example, you want to allow access to a newly created role), you will need to change the code in all those files! Declarative security makes this job much easier: you define an <authorization> section in a web.config (either for the overall site or for a subfolder), which specifies the users and roles who are allowed to access a certain folder or page. The following snippet of web.config gives access to members of the Administrators role, while everyone else (*) is denied access to the current folder's pages:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
   <system.web>
      <authorization>
         <allow roles="Administrators" />
         <deny users="*" />
      </authorization>
      <!-- other settings... -->
   </system.web>
</configuration>

Authorization conditions are evaluated from top to bottom, and the first one that matches the user or role stops the validation process. This means that if you switched the two preceding conditions, the <deny> condition would match for any user, and the second condition would never be considered; as a result, nobody could access the pages. This next example allows everybody except anonymous users (those who have not logged in and who are identified by the ? character):

<authorization>
   <deny users="?" />
   <allow users="*" />
</authorization>

If you want to have different ACLs for different folders, you can have a different <authorization> section in each folder's web.config file. As an alternative, you can place all ACLs in the root web.config, within different <location> sections, as in this code:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
   <system.web>
      <!-- settings for the current folder -->
      <authorization>
         <allow users="*" />
      </authorization>
   </system.web>

   <location path="Admin">
      <!-- settings for the Admin sub-folder -->
      <system.web>
         <authorization>
            <allow roles="Administrators" />
            <deny users="*" />
         </authorization>
      </system.web>
   </location>

   <location path="Members">
      <!-- settings for the Members sub-folder -->
      <system.web>
         <authorization>
            <deny users="?" />
            <allow users="*" />
         </authorization>

</system.web>
   </location>
</configuration>

The path attribute of the <location> section can be the name of a subfolder (as shown above) or the virtual path of a single page. Using the <location> section is the only way to declaratively assign a different ACL to specific individual pages, since you can't have page-level web.config files. Although it's possible to restrict individual pages, it's more common to restrict entire subfolders.

Programmatic security checks are still useful and necessary in some cases, though, such as when you want to allow everybody to load a page but control the visibility of some visual controls (e.g., buttons to delete a record, or a link to the administration section) of that page to specific users. In these cases, you can use the code presented earlier to show, or hide, some server-side controls or containers (such as Panel) according to the result of a call to User.IsInRole. Alternatively, you can use a LoginView control that, in addition to its sections for anonymous and logged-in users, can also define template sections visible only to users who belong to specific roles. The next snippet produces different output according to whether the current user is anonymous, is logged in as a regular member or is logged in and belongs to the Administrators role:

<asp:LoginView ID="LoginView1" runat="server">
   <AnonymousTemplate>anonymous user</AnonymousTemplate>
   <LoggedInTemplate>member</LoggedInTemplate>
   <RoleGroups>
      <asp:RoleGroup Roles="Administrators">
         <ContentTemplate>administrator</ContentTemplate>
      </asp:RoleGroup>
   </RoleGroups>
</asp:LoginView>

Note that in cases where the currently logged-in user is also in the Administrators role, the LoginView control only outputs the content of the <Administrators> section, not that of the more general <LoggedInTemplate> section.

Finally, roles are also integrated with the site map, which lets you specify which roles will be able to see a particular link in the Menu or TreeView control that consumes the site map. This is a very powerful feature that makes it easy to show a user only the menu options he is actually allowed to access! For example, if you want the Admin link to be visible only to Administrators, here's how you define the map's node:

<siteMapNode title="Admin" url="~/Admin/Default.aspx" roles="Administrators">

However, to enable this to work you must also register a new provider for the SiteMap system (in the <siteMap> section of the web.config file), and set its securityTrimmingEnabled attribute to true. Registering the provider for the site map is very similar to registering a provider for the membership or roles system; in the "Solution" section you will see code examples to illustrate this.

Like the Authentication service, ASP.NET AJAX provides an interface to leverage Roles through web services on the client. The service has to be turned on by enabling in the web.config (shown in the previous section on authentication). The Sys.Services.RoleService class has three methods that need to be discussed: Load, IsUserInRole, and Roles.

The Load method loads the roles for the currently authenticated user. The Roles themselves are stored in client-side memory if the call to the load function is successful.

The IsUserInRole function checks to see if the current user belongs to a specified role and takes one parameter, role, which is the name of the role to check. The function returns true if the current user belongs to the role; otherwise, it returns false.

The Roles function returns an array listing all the roles that the current user belongs to. The Load method must be called before accessing the Roles function; otherwise, no roles will be returned.

Sometimes you may need to access the user's profile from a business class, such as we are doing in this book. The Profile property is dynamically added only to the ASPX pages' code-behind classes, so you can't use it in those situations. However, you can still access it through the Profile property exposed by the current HttpContext. The HttpContext class is the container for the current web request — it's used to pass around objects that are part of the request: forms, properties, ViewState, and so on. Anytime you process a page, you will have this HttpContext information, so you can always pull a Profile class instance out of the HttpContext class. The returned type is ProfileBase, though, not the ProfileCommon object generated on-the-fly that enabled you to use IntelliSense and access properties in a strongly typed manner. Therefore, the resulting Profile class instance read from the HttpContext.Current.Profile will not be strongly typed. No problem — just create a ProfileBase object and use its methods to retrieve values. I have added a series of methods to the Helpers class to help with this in the Beer House. The first step is a series of overloaded GetUserProfile methods that return a ProfileBase object. The Create method has two overloads, one that accepts just the username and one that accepts the username and if they are authenticated. I created three versions of the GetUserProfile method, one to handle each of the Create overloads and one to automatically retrieve the profile for the current user, passing in his or her authentication status.

Public Shared Function GetUserProfile() As ProfileBase
        Return ProfileBase.Create(CurrentUserName,
CurrentUser.Identity.IsAuthenticated)
End Function

Public Shared Function GetUserProfile(ByVal vUserName As String) As ProfileBase
        Return ProfileBase.Create(vUserName, CurrentUser.Identity.IsAuthenticated)
End Function

Public Shared Function GetUserProfile(ByVal vUserName As String,
ByVal isAuthenticated As Boolean) As ProfileBase
        Return ProfileBase.Create(vUserName, isAuthenticated)
End Function

The next method to investigate is the ProfileBase.GetProfileGroup method. It accepts the name of the profile group you want to access and returns it as a ProfileGroupBase object. In the following example, I return the ProfileGroup as an object instead of a ProfileGroupBase. This seems to make it easier to cast the group as a custom object, such as the shopping cart, if needed.

Private Shared Function GetProfileSubGroup(ByVal profile As ProfileBase,
ByVal vSubGroup As String) As Object
        Return profile.GetProfileGroup(vSubGroup)
End Function

The ProfileBase's GetPropertyValue and SetPropertyValue can be used to access and update profile values. If a value is a member of a SubGroup, you simply need to access the SubGroup and call these methods from it. The wrapper methods that follow demonstrate using the PropertyValue functions.

Public Shared Function GetProfileSubGroupStringProperty(
ByVal profile As ProfileBase, ByVal vSubGroup As String,
ByVal vProperty As String) As String
      If Not IsNothing(profile) AndAlso Not
IsNothing(profile.GetProfileGroup(vSubGroup)) Then
         Return profile.GetProfileGroup(vSubGroup).GetPropertyValue(vProperty)
      Else
         Return String.Empty
      End If
End Function

Public Shared Function GetProfileSubGroupIntegerProperty(ByVal profile As

ProfileBase, ByVal vSubGroup As String, ByVal vProperty As String) As Integer
      If Not IsNothing(profile) Then
         Return GetProfileSubGroup(profile, vSubGroup).GetPropertyValue(vProperty)
      Else
         Return 0
      End If
End Function

Public Shared Function GetProfileSubGroupObjectProperty(ByVal profile As
ProfileBase, ByVal vSubGroup As String, ByVal vProperty As String) As Object
      If Not IsNothing(profile) Then
         Return GetProfileSubGroup(profile, vSubGroup).GetPropertyValue(vProperty)
      Else
         Return Nothing
      End If
End Function

Public Shared Function GetProfileTheme(ByVal profile As ProfileBase) As String
      Return GetProfileSubGroupStringProperty(profile, "Preferences",
"Theme").ToString
End Function

Public Shared Sub SetProfileTheme(ByVal profile As ProfileBase,
ByVal sTheme As String)
      GetProfileSubGroup(profile, "Preferences").setpropertyvalue("Theme", sTheme)
End Sub

Public Shared Function GetSubscriptionType(ByVal profile As ProfileBase) As
 SubscriptionType
      Return CType(GetProfileSubGroupStringProperty(profile, "Preferences",
"Newsletter"), SubscriptionType)
End Function

As we proceed through the application, you will see places where these helper methods are used, such as in the Newsletter module:

' retreive all subscribers to the plain-text and HTML newsletter
Dim subscribers As New List(Of SubscriberInfo)

For Each user As MembershipUser In Membership.GetAllUsers
Dim userProfile As ProfileBase = Helpers.GetUserProfile(user.UserName, False)
      If Not Helpers.GetSubscriptionType(userProfile) <> SubscriptionType.None Then
         Dim subscriber As New SubscriberInfo(user.UserName, user.Email, _
            Helpers.GetProfileFirstName(userProfile), _
            Helpers.GetProfileLastName(userProfile),
Helpers.GetSubscriptionType(userProfile))
            subscribers.Add(subscriber)
            Newsletter.Lock.AcquireWriterLock(Timeout.Infinite)
            Newsletter.TotalMails += 1
            Newsletter.Lock.ReleaseWriterLock()

End If
Next

An option that I did not employ in the Beer House is to create a custom profile class that inherits from ProfileBase and automatically instantiates itself with properties that map to the profile properties defined in the web.config. Lee Dumond does a great job explaining this on his blog, http://leedumond.com/blog/getting-strongly-typed-profile-properties-from-a-class-library/. Either way works just fine and the choice is yours.

So far, all the examples have shown how to read and write the profile for the current user. However, you can also access other users' profiles — very useful if you want to implement an administration page to read and modify the profiles of your registered members. Your administrator must be able to read and edit the profile properties for any user. The ProfileCommon class exposes a GetProfile method that returns the profile for any specified user, and once you obtain this profile instance you can read and edit the profile properties just as you can do for the current user's profile. The only difference is that after changing some values of the retrieved profile, you must explicitly call its Save method, which is not required when you modify the profile for the current user. (In the case of the current user, Save is called automatically by the runtime when the page unloads.) Here's an example of getting a profile for a specified user and then modifying a property value in that profile:

Dim profile As ProfileCommon = Profile.GetProfile("Marco")
profile.BirthDate = New DateTime(1980, 9, 28)
profile.Save()

The preceding code works only for registered users who are logged in. Sometimes, however, you want to be able to store profile values for users who are not logged in. You can explicitly enable anonymous identification support by adding the following line to web.config:

<anonymousIdentification enabled="true"/>

After that, you must indicate what properties are available to anonymous users. By default, a property is only accessible for logged-in users, but you can change this by setting the property's allowAnonymous attribute to true, as follows:

<add name="FavoriteTheme" type="String"
   allowAnonymous="true" defaultValue="Colorful" />

This is useful to allow an anonymous user to select a theme for his current session. This would not be saved after his session terminates because we don't have an actual user's identity to allow us to persist the settings. Another important concern regarding profiles for anonymous users is the migration from anonymous to authenticated status. Consider the following situation: a registered user comes to the site and browses it without logging in. He or she then changes some profile properties available to anonymous users, such as the name of the favorite theme. At some point, he or she wants to access a restricted page and needs to log in. Now, because the favorite theme was selected while the user was anonymous, it was stored into a profile linked to an anonymous user ID. After the user logs in, he or she then becomes an authenticated user with a different user ID. Therefore, that user's previous profile settings are loaded, and the user will get a site with the theme selected during a previous session, or the default one. What you wanted to do, however, was to migrate the anonymous user's profile to the authenticated user's profile at the time he or she logged in. This can be done by means of the Profile_MigrateAnonymous global event, which you can handle in the Global.asax file. Once this event is raised, the HttpContext.Profile property will already have returned the authenticated user's profile, so it's too late for us to save the anonymous profile values. You can, however, get a reference to the anonymous profile previously used by the user and then copy values from it to the new profile. In the "Solution" section, you will see how to implement this event to avoid losing the user's preferences.

Along with the Authentication and Roles, the Sys.Services.ProfileService class provides client-side access to the Profile service. There are two main functions to become familiar with: Load and Save. The Load function loads the user's profile into client memory. The method accepts an array of profile properties to load, along with the typical callback function names. If null is passed into the Load function, the full set of profile properties is loaded.

Sys.Services.ProfileService.load(null,

LoadCompletedCallback, ProfileFailedCallback, null);

The profileServer also has to be enabled in the web.config file, as shown earlier. When you enable the ProfileService class, you have to explicitly define what fields can be read and which fields can be written to. You cannot create new profile fields through the ProfileService. You also cannot change the Read/Write status of a property through the service.

Readonly properties are defined as a comma-separated list in the readAccessProperties value. A similar list can be set to the witeAccessProperties. The list does not have to match, and it can overlap.

<profileService enabled="true" readAccessProperties="FirstName, LastName" />

Because this control will be used in the administration area to read and edit the profile for any user, it needs a public property that stores the name of the user for whom you are querying. In ASP.NET 1.x, the typical way to make a property value persistent across postbacks is to save it in the control's ViewState collection, so that it is serialized into a blob of base-64 encoded text, together with all the other property values, and saved in the __VIEWSTATE HTML hidden field. This is better than session state because it doesn't use server resources to save temporary values because the values are saved as part of the overall page. The user won't see the hidden values, but they are there in the user's browser and he'll post them back to the server along with the other form data each time he does a postback. The problem with view state is that it can be disabled, by setting the page's or control's EnableViewState property to False. Disabling this feature is a common way to minimize the volume of data passed back and forth across the network. Unfortunately, controls that use view state to store values will not work correctly if view state is disabled on any particular host page. To resolve this issue, ASP.NET 2.0 introduced a new type of state called control state, which is a similar to view state, except that it's only related to a particular control, and it can't be disabled. Values that a control wants to save across postbacks can be saved in the control state, while values that are not strictly necessary can go into the view state. In reality, both categories of values will be serialized and saved into the same single __VIEWSTATE field, but the internal structure makes a difference between them. With the view state, you would just read and write the property value from and to the control's ViewState object from inside the property's accessor functions. To use control state, you need to do the following:

Following is the complete code needed to define and persist a control's UserName property:

Partial Class UserProfile
    Inherits System.Web.UI.UserControl

#Region " Properties "

    Public ReadOnly Property FirstName() As String
        Get
            Return FullName.Split(" ")(0)
        End Get
    End Property

    Public ReadOnly Property LastName() As String
        Get
            Return FullName.Split(" ")(FullName.Split(" ").Length - 1)

End Get
    End Property

    Public ReadOnly Property FullName() As String
        Get
            Return Request("fullname")
        End Get
    End Property

    Public ReadOnly Property EMail() As String
        Get
            Return Me.Request.QueryString("Email")
        End Get
    End Property

    Public ReadOnly Property DOB() As String
        Get
            Return Request("dob")
        End Get
    End Property

    Public ReadOnly Property Gender() As String
        Get
            Return Request("gender")
        End Get
    End Property

    Public ReadOnly Property PostCode() As String
        Get
            Return Request("postcode")
        End Get
    End Property

    Public ReadOnly Property Country() As String
        Get
            Return Request("country")
        End Get
    End Property

#End Region

    Private _userName As String = String.Empty
    Public Property Username() As String
        Get
            If String.IsNullOrEmpty(_userName) Then
                Return Helpers.CurrentUser.Identity.Name
            End If
            Return _userName
        End Get
        Set(ByVal value As String)
            _userName = value
        End Set
    End Property

    Protected Sub Page_Init(ByVal sender As Object, ByVal e As System.EventArgs)

Handles Me.Init
        Me.Page.RegisterRequiresControlState(Me)
    End Sub

    Protected Overrides Sub LoadControlState(ByVal savedState As Object)
        Dim ctlState As Object() = CType(savedState, Object())
        MyBase.LoadControlState(savedState)
        _userName = CStr(ctlState(1))
    End Sub

    Protected Overrides Function SaveControlState() As Object
        Dim ctlState() As Object
        ReDim ctlState(1) ' Initializes the array with 2 objects
        ctlState(0) = MyBase.SaveControlState()
        ctlState(1) = _userName
        Return ctlState
  End Function
End Class

This is somewhat more complicated than the older method of using the host page's view state, but you gain the advantage of independence from that page's configuration. You have to weigh the added complexity against the needs of your application. If you'll have a large application with many pages, it is probably wise to use control state because you can't be sure if one of the host pages might have view state disabled (in a large system it's almost guaranteed that some pages will have it disabled). Also, if your controls might be used by other applications within your company, or even other companies, you should definitely use control state to give you the added peace of mind to know that your controls will always work.

Now you can write some code for handling user profiles within a control. In the control's code-behind, you should handle the Load event to load the specified user's profile, so you can populate the various input controls with profile values. If no username is specified, the current user's profile will be loaded:

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)
Handles Me.Load
      If Not Me.IsPostBack Then

         ' if the UserName property contains an empty string, retrieve the profile
         ' for the current user, otherwise for the specified user
         Dim profile As ProfileBase = GetProfile()
         ddlSubscriptions.SelectedValue = profile.GetProfileGroup("Preferences")
.GetPropertyValue("Newsletter").ToString
         ddlLanguages.SelectedValue = profile.GetProfileGroup("Preferences")
.GetPropertyValue("Culture")
         txtFirstName.Text = profile.GetPropertyValue("FirstName")
         txtLastName.Text = profile.GetPropertyValue("LastName")

         If String.IsNullOrEmpty(Gender) Then
            ddlGenders.SelectedValue = Gender
         Else
            ddlGenders.SelectedValue = profile.GetPropertyValue("Gender")

End If

         If Not profile.GetPropertyValue("BirthDate") = DateTime.MinValue Then
            txtBirthDate.Text = profile.GetPropertyValue("BirthDate")
.ToShortDateString
         End If
         ddlOccupations.SelectedValue = profile.GetPropertyValue("Occupation")
         txtWebsite.Text = profile.GetPropertyValue("Website")
         txtStreet.Text = profile.GetProfileGroup("Address")
.GetPropertyValue("Street")
         txtCity.Text = profile.GetProfileGroup("Address").GetPropertyValue("City")
         txtPostalCode.Text =
profile.GetProfileGroup("Address").GetPropertyValue("PostalCode")
         ddlState.SelectedValue =
profile.GetProfileGroup("Address").GetPropertyValue("State")

         If String.IsNullOrEmpty(Country) Then
            ddlCountry.SelectedValue = Country
         Else
            ddlCountry.SelectedValue =
profile.GetProfileGroup("Address").GetPropertyValue("Country")
         End If

         txtPhone.Text = profile.GetProfileGroup("Contacts")
.GetPropertyValue("Phone")
         txtFax.Text = profile.GetProfileGroup("Contacts").GetPropertyValue("Fax")
         txtAvatarUrl.Text = GetAvatarURL()
         txtSignature.Text = profile.GetProfileGroup("Forum")
.GetPropertyValue("Signature")
      End If
End Sub

This control doesn't have a Submit button to initiate saving profile values, so create a public method named SaveProfile that the host page will call when needed:

Public Sub SaveProfile()
      ' if the UserName property contains an emtpy string, save the
current user's profile,
      ' othwerwise save the profile for the specified user
      Dim profile As ProfileBase = GetProfile()

      profile.GetProfileGroup("Preferences").SetPropertyValue("Newsletter",
CType([Enum].Parse( _
         GetType(SubscriptionType), ddlSubscriptions.SelectedValue),
SubscriptionType))
      profile.GetProfileGroup("Preferences").SetPropertyValue("Culture",
ddlLanguages.SelectedValue)
      profile.SetPropertyValue("FirstName", txtFirstName.Text)
      profile.SetPropertyValue("LastName", txtLastName.Text)
      profile.SetPropertyValue("Gender", ddlGenders.SelectedValue)
      If txtBirthDate.Text.Trim().Length > 0 Then
         profile.SetPropertyValue("BirthDate", DateTime.Parse(txtBirthDate.Text))

End If
      profile.SetPropertyValue("Occupation", ddlOccupations.SelectedValue)
      profile.SetPropertyValue("Website", txtWebsite.Text)
      profile.GetProfileGroup("Address").SetPropertyValue("Street", txtStreet.Text)
      profile.GetProfileGroup("Address").SetPropertyValue("City", txtCity.Text)
      profile.GetProfileGroup("Address").SetPropertyValue("PostalCode",
txtPostalCode.Text)
      profile.GetProfileGroup("Address").SetPropertyValue("State",
ddlState.SelectedValue)
      profile.GetProfileGroup("Address").SetPropertyValue("Country",
ddlCountry.SelectedValue)
      profile.GetProfileGroup("Contacts").SetPropertyValue("Phone", txtPhone.Text)
      profile.GetProfileGroup("Contacts").SetPropertyValue("Fax", txtFax.Text)
      profile.GetProfileGroup("Forum").SetPropertyValue("AvatarUrl",
txtAvatarUrl.Text)
      profile.GetProfileGroup("Forum").SetPropertyValue("Signature",
txtSignature.Text)
      profile.Save()

   End Sub

In Chapter 2, we discussed the use of master pages and CSS to create a consistent user interface for the public facing website. The same techniques are just as important for the site's administration. The administrative section has its own dedicated master page, which primarily differs from the public site's layout by having an accordion panel to use for navigation in the admin area.

The Accordion control is actually a part of the ASP.NET AJAX control toolkit, a set of free controls produced by Microsoft that extend the ASP.NET AJAX framework (www.codeplex.com/AjaxControlToolkit). The version I am using with this site is 3.0.20820; you should check the project's page to use the most current bits as they change from time to time.

The Accordion control allows multiple panes to be defined, but only one is visible at a time. Each of the panels is collapsible, meaning that they are neatly hidden from the user when they are not needed.

The user can select the pane he or she wants to see by clicking on the visible header. In the Beer House administrative section, the header defines a module's administrative pages and tasks.

<ajaxToolkit:Accordion ID="aAdminMenu" runat="server" FadeTransitions="false"
 FramesPerSecond="100"
 TransitionDuration="250" CssClass="accordion" HeaderCssClass="header"
ContentCssClass="content" RequireOpenedPane="True" AutoSize="None">
<Panes>

<ajaxToolkit:AccordionPane ID="apArticles" runat="server">

<!-- Content (ListView) -->

</ajaxToolkit:AccordionPane>

<!-- Other Panes -->
</Panes>
</ajaxToolkit:Accordion>

Inside each pane is a dedicated ListView containing links to the administrative duties of the module. Typically, this includes links to manage any items as well as adding new items. The lists are actually manually built by calling a series of methods in a AdminMenuItems class, but you could drive them from a table or configuration setting. Considering the size and scope of the Beer House site, it is simpler to create a class to manually build the navigation. Each of the methods in the AdminMenuItems class is a shared method that builds an ArrayList of AdminMenuItems. An AdminMenuItem contains a MenuName, ImageURL and URL property. The MenuName is the test displayed in the hyperlink to the page. The ImageURL is the path to an associated image icon. The URL is the path to the actual page to be loaded.

Public Shared Function FetchSecurityMenuItems() As ArrayList

      Dim userItems As New ArrayList()
      userItems.Add(New AdminMenuItem("Users", "ManageUsers.aspx"))
      userItems.Add(New AdminMenuItem("New User", "AddEditUser.aspx"))
      userItems.Add(New AdminMenuItem("Roles", "ManageRoles.aspx"))
      userItems.Add(New AdminMenuItem("New Role", "AddEditRole.aspx"))

      Return userItems

End Function

The AdminMenuItem has several overloaded constructors; I am using the version that accepts the MenuName and URL. This creates a simple text-based navigation list. The FetchSecurityMenuItems method returns an ArrayList of AdminMenuItems that are ultimately bound to the ListView in the security panel of the Accordion control.

Private Sub BindNavItems()

      'Other Admin Menu ListView binding code

      lvSecurity.DataSource = AdminMenuItems.FetchSecurityMenuItems
      lvSecurity.DataBind()

End Sub

Each AccordionPane in the Accordion has a header that list what the pane contains, for example the Security pane holds links to manage users and roles. The Header template defines the content listed in the pane's header, which is always visible. When the user clicks on the header, it will expand if it is not the currently visible pane, and the open pane will contract.

The Content template defines the elements contained in the expanded pane. For the administration navigation, this means the ListView bound to the module's admin links. Each of the ListView holds an unordered list (<UL>), with each list item (<LI>) containing the navigational link.

<ajaxToolkit:AccordionPane ID="apSecurity" runat="server">
<Header>

<div>
               <span>Security</span>

</div>
</Header>
<Content>

<asp:ListView ID="lvSecurity" runat="server">

<LayoutTemplate>

   <ul>

      <li id="itemPlaceholder" runat="server" />

   </ul>

</LayoutTemplate>

<ItemTemplate>

   <li><a href="<%#Eval("URL")%>">

      <%#Eval("MenuName")%></a></li>

</ItemTemplate>

</asp:ListView>
</Content>
</ajaxToolkit:AccordionPane>

The Accordion completes its visual look by applying a series of styles that assigns background images and font colors.

/* Accordion */

.accordion
{
    font-size:8.5pt;
    font-family:Tahoma;
    background:url(images/item_bg.gif);
}

.accordion .header
{
    cursor: pointer;
    background: url(images/hd_bg.gif) repeat-x;
    border-bottom: solid 1px #57566f;
    border-bottom-color: #800000;
}
.accordion .header DIV
{
    cursor:pointer;
    height:30px;
    padding-left:40px;
    background-color:Transparent;
    background-position:center left;
    background-repeat:no-repeat;
}
.accordion .header SPAN
{
    cursor:pointer;
    font-weight:bold;
    display:block;
    padding-top:8px;
    color:#fff;
}
.accordion .header:hover
{
    cursor:pointer;
    height:31px;
    background-color:Transparent;
    background:url(images/hd_hover_bg.gif) repeat-x;
    border-bottom:none;
}
.accordion UL
{
    padding:0;
    margin:5px 5px 5px 15px;
    list-style-type:none;
}
.accordion LI
{
    background-color:Transparent;
    background-repeat:no-repeat;
    background-position:left center;
    vertical-align:middle;
    padding:6px 5px 6px 25px;
    cursor:hand;
}
.accordion LI DIV
{
    padding-left: 10px;
    color: #993333;
    cursor: hand;
}
.accordion LI:hover

{
    text-decoration:underline;
}

The balance of the Admin master page is very similar to the public master page. The menu links refer to the primary management pages for the related modules instead of the public pages.

This page's user interface can be divided into three parts:

The following code provides the user interface for the first two parts:

<asp:UpdatePanel runat="server" ID="uppnlUsers">
                  <ContentTemplate>
                     <table style="width: 95%">
                        <tr>
                           <td>
                              <p>
                              </p>
                              <b>- Total registered users:
                                 <asp:Literal runat="server" ID="lblTotUsers" />
<br />
                                 - Users online now:
                                 <asp:Literal runat="server" ID="lblOnlineUsers" />
</b>
                              <p>
                              </p>
                              Click one of the following link to display all
users whose name begins with that
                              letter:
                              <p>
                              </p>
                              <asp:ListView runat="server" ID="lvAlphabet">
                                 <LayoutTemplate>
                                    <span runat="server" id="itemPlaceHolder" />
                                 </LayoutTemplate>
                                 <ItemTemplate>
                                    <span>
                                       <asp:LinkButton ID="LinkButton1" runat=
"server" Text='<%# Container.DataItem %>'
                                          CommandArgument='<%# Container.DataItem
%>' />&nbsp;&nbsp;</span>

</ItemTemplate>
                              </asp:ListView>
                              <p>
                              </p>
                              Otherwise use the controls below to search users
by partial username or e-mail:
                              <p>
                              </p>
                              <asp:DropDownList runat="server" ID=
"ddlSearchTypes" CssClass="formStyleDropDown">
                                 <asp:ListItem Text="UserName" Selected="true" />
                                 <asp:ListItem Text="E-mail" />
                              </asp:DropDownList>
                              contain
                              <asp:TextBox runat="server" ID="txtSearchText"
CssClass="formField" />
                              <asp:Button runat="server" ID="btnSearch" Text=
"Search" />
                              <p>
                              </p>
                           </td>
                        </tr>
                        <tr>
                           <td align="right">
                              <asp:Literal runat="server" ID="ltlstatus" />
                              <asp:Button ID="Button1" runat="server" Text=
"New User" />
                           </td>
                        </tr>

As you see, the alphabet bar is built by a ListView control, not a fixed list of links. The ListView will be bound to an array of characters, displayed as links. I used a ListView instead of static links for a couple of reasons. First, this will make it much easier to change the bar's layout, if you want to do so later, because you only need to change the template, not a series of links. Second, if you decide to add localization to this page later, the ListView's template can remain exactly the same, and it is sufficient to bind it to a different array containing the selected language's alphabet.

The third part of the page, which lists users and some of their properties, contains a ListView. A ListView can automatically take care of sorting, paging, and editing, without requiring us to write a lot of code. Following is the complete code used to define the ListView:

<asp:ListView ID="lvUsers" runat="server">
   <LayoutTemplate>
      <table cellspacing="0" cellpadding="0" class="AdminList">
         <tr class="AdminListHeader">
            <td>
               UserName
            </td>
            <td>
               Edit
            </td>
            <td>

Delete
            </td>
         </tr>
         <tr id="itemPlaceholder" runat="server">
         </tr>
      </table>
   </LayoutTemplate>
   <EmptyDataTemplate>
      <tr>
         <td colspan="3">
            <p>
               Sorry there are no Users available at this time.</p>
         </td>
      </tr>
   </EmptyDataTemplate>
   <ItemTemplate>
      <tr>
         <td class="ListTitle">
            <a href="AddEditUser.aspx?CurrentUserName=<%#Eval("UserName")%>">
               <%#Eval("UserName")%></a>
         </td>
         <td>
            <a href="AddEditUser.aspx?CurrentUserName=<%#Eval("UserName")%>">
               <img src="../images/edit.gif" alt="" width="16" height="16"
class="AdminImg" /></a>
         </td>
         <td>
<asp:ImageButton ID="btnDelete" AlternateText="Delete this User?" ImageUrl=
'~/images/delete.gif' CausesValidation="False" runat="server" CommandName=
"DeleteUser" OnClientClick="ConfirmMsg('User')," /></td>
      </tr>
   </ItemTemplate>
</asp:ListView>
<div class="pager">
   <asp:DataPager ID="pagerBottom" runat="server" PageSize="10" PagedControlID
="lvUsers"
QueryStringField="pageNo">
<Fields>
   <asp:NextPreviousPagerField ButtonCssClass="command" FirstPageText="«"
 PreviousPageText="<"
      RenderDisabledButtonsAsLabels="true" ShowFirstPageButton="true"
ShowPreviousPageButton="true"
      ShowLastPageButton="false" ShowNextPageButton="false" />
   <asp:NumericPagerField ButtonCount="7" NumericButtonCssClass="command"
 CurrentPageLabelCssClass="current"
      NextPreviousButtonCssClass="command" />
   <asp:NextPreviousPagerField ButtonCssClass="command" LastPageText="»"
 NextPageText=">"
      RenderDisabledButtonsAsLabels="true" ShowFirstPageButton="false"
ShowPreviousPageButton="false"
      ShowLastPageButton="true" ShowNextPageButton="true" />
</Fields>
   </asp:DataPager>
</div>

Deleting a user account is a serious action that can't be undone, so have the administrator confirm this action before proceeding! This can be done by adding a JavaScript "confirm" in the link's onclick client-side event, through the button's new OnClientClick property. This is done by adding the JavaScript to the button's markup, OnClientClick="ConfirmMsg('User'),", which calls the ConfirmMsg function defined in the TBH.js file. It will be used throughout the site to question users before they perform a delete operation.

function ConfirmMsg(entityName) {
   return confirm('Warning: This will delete the ' + entityName + ' from the
 database.'),
}

Before looking at the code-behind file, I want to point out another small, but handy, new feature: the ListView has a <EmptyDataTemplate> section that contains the HTML markup to show when the list is bound to an empty data source. This is a very cool feature because you can use this template to show a message when a search produces no results.

In the page's code-behind file there is a class-level MemershipUserCollecion object that is initialized with all the user information returned by Membership.GetAllUsers. The Count property of this collection is used in the page's Load event to show the total number of registered users, together with the number of online users. In the same event, we also create the array of letters for the alphabet bar, and bind it to the ListView control. The code is:

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)
 Handles Me.Load

      If Not IsPostBack Then
         BindAlphabet()
      End If

   End Sub

   Private Sub BindAlphabet()
      Dim alphabet As Char() = {"A"c, "B"c, "C"c, "D"c, "E"c, "F"c, _
                  "G"c, "H"c, "I"c, "J"c, "K"c, "L"c, _
                  "M"c, "N"c, "O"c, "P"c, "Q"c, "R"c, _
                  "S"c, "T"c, "U"c, "V"c, "W"c, "X"c, _
                  "Y"c, "Z"c}

      lvAlphabet.DataSource = alphabet
      lvAlphabet.DataBind()

      lblTotUsers.Text = allUsers.Count.ToString()
      lblOnlineUsers.Text = Membership.GetNumberOfUsersOnline().ToString()
   End Sub

   Private Sub BindUsers()

      BindAlphabet()

      Dim users As MembershipUserCollection = Nothing

      Dim lSearchText As StringBuilder = New StringBuilder()
      If String.IsNullOrEmpty(lvUsers.Attributes("SearchText")) = False Then

lSearchText.Append(lvUsers.Attributes("SearchText"))
      End If

      Dim searchByEmail As Boolean = False
      If String.IsNullOrEmpty(lvUsers.Attributes("SearchByEmail")) = False Then
         searchByEmail = Boolean.Parse(lvUsers.Attributes("SearchByEmail"))
      End If

      If lSearchText.Length > 0 Then
         If (searchByEmail) Then
            users = Membership.FindUsersByEmail(lSearchText.ToString())
         Else
            users = Membership.FindUsersByName(lSearchText.ToString())
         End If
      Else
         users = allUsers
      End If

      lvUsers.DataSource = users
      lvUsers.DataBind()

End Sub

The grid is not populated when the page first loads, but rather after the user clicks a link on the alphabet bar or runs a search. This is done in order to avoid unnecessary processing and, thus, have a fast-loading page. When a letter link is clicked, the ListView's ItemCommand event is raised. You handle this event to retrieve the clicked letter and then run a search for all users whose name starts with that letter. If the All link is clicked, you'll simply show all users. Because this page also supports e-mail searches, a "SearchByEmail" attribute is added to the control and set to false, to indicate that the search is by username by default. This attribute is stored in the grid's Attributes collection so that it is persisted in the view state and doesn't get lost during a postback. Here's the code:

Private Sub lvAlphabet_ItemCommand(ByVal sender As Object, ByVal e As
System.Web.UI.WebControls.ListViewCommandEventArgs) Handles lvAlphabet.ItemCommand
      lvUsers.Attributes.Add("SearchByEmail", False.ToString())
      If (e.CommandArgument.ToString().Length = 1) Then

         lvUsers.Attributes.Add("SearchText", e.CommandArgument.ToString() + "%")
         BindUsers()
      Else
         lvUsers.Attributes.Add("SearchText", "")
         BindUsers()
      End If

   End Sub

The code that actually runs the query and performs the binding is in the BindUsers method. It takes a Boolean value as an input parameter that indicates whether the allUsers collection must be repopulated (necessary just after a user is deleted). The text to search for and the search mode (e-mail or username) are not passed as parameters, but rather are stored in the grid's Attributes. Here is the code:

Private Sub BindUsers()

      Dim users As MembershipUserCollection = Nothing

      Dim lSearchText As StringBuilder = New StringBuilder()

If String.IsNullOrEmpty(lvUsers.Attributes("SearchText")) = False Then
         lSearchText.Append(lvUsers.Attributes("SearchText"))
      End If

      Dim searchByEmail As Boolean = False
      If String.IsNullOrEmpty(lvUsers.Attributes("SearchByEmail")) = False Then
         searchByEmail = Boolean.Parse(lvUsers.Attributes("SearchByEmail"))
      End If

      If lSearchText.Length > 0 Then
         If (searchByEmail) Then
            users = Membership.FindUsersByEmail(lSearchText.ToString())
         Else
            users = Membership.FindUsersByName(lSearchText.ToString())
         End If
      Else
         users = allUsers
      End If

      lvUsers.DataSource = users
      lvUsers.DataBind()

   End Sub

The BindUsers method is also called when the Search button is clicked. In this case, the SeachByEmail attribute will be set according to the value selected in the ddlSearchTypes drop-down list, and the SearchText will be equal to the entered search string with the addition of a leading and a trailing "%", so that a full LIKE query is performed:

Protected Sub btnSearch_Click(ByVal sender As Object, ByVal e As EventArgs)
Handles btnSearch.Click
      Dim searchByEmail As Boolean = (ddlSearchTypes.SelectedValue = "E-mail")
      lvUsers.Attributes.Add("SearchText", "%" + txtSearchText.Text + "%")
      lvUsers.Attributes.Add("SearchByEmail", searchByEmail.ToString())
      BindUsers()

   End Sub

When the trashcan icon is clicked, the ListView raises the ItemDeleting event. Notice the username is not accessible through the DataKeys property, but rather by accessing the DataItem property of the ListView. This is because the users were bound to the ListView as an array of strings and, therefore, do not have a primary key or even a field to access the values. This event handler then calls the DeleteUser method, passing the username. From inside this event handler, you can use the static methods of the Membership and ProfileManager classes to delete the user account and its accompanying profile. After that, BindUsers is called again with true as a parameter, so that the collection of all users is refreshed, and the label displaying the total number of users is also refreshed:

Private Sub lvUsers_ItemDeleting(ByVal sender As Object, ByVal e As
System.Web.UI.WebControls.ListViewDeleteEventArgs) Handles lvUsers.ItemDeleting

DeleteUser(lvUsers.Items(e.ItemIndex).DataItem)
   End Sub

   Private Sub DeleteUser(ByVal UserName As String)

      If Membership.DeleteUser(UserName) Then

         BindUsers()

         ltlstatus.Text = "The user was deleted."

      Else

         ltlstatus.Text = "The user was not deleted."

      End If

End Sub

Figure 4-19 shows the page listing all current users.

Figure 4.19. Figure 4-19

The AddEditUser.aspx page is linked from a row of the ManagedUsers.aspx list. It takes a username parameter on the querystring, and allows an administrator to see all the membership details about that user (i.e., the properties of the MembershipUser object representing that user), and supports editing the user's personal profile. The user interface of the page is simple and is divided in three sections:

Following is the code for AddEditUser.aspx:

<table id="Table1" cellspacing="1" cellpadding="1" width="525" align="center"
border="0">
               <tr>
                  <td>
                     <asp:Literal ID="ltlMessage" runat="server"></asp:Literal>
                  </td>
               </tr>
               <tr>
                  <td>
                     <table id="Table2" cellspacing="0" cellpadding="0" width=
"100%" align="center" border="0">
                        <tr>
                           <td class="fieldname">
                              Username
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:Literal runat="server" ID="ltlUserName">
</asp:Literal>
                              <div runat="server" id="dUserName">
                                 <asp:TextBox ID="txtUserName" runat="server"
CssClass="formField"></asp:TextBox><sup><font
                                    color="red" size="2">*</font></sup>&nbsp;
                                 <asp:RequiredFieldValidator ID=
"RequiredFieldValidator3" runat="server" ControlToValidate="txtUserName"
                                    Display="None" ErrorMessage="You must supply
a Username."></asp:RequiredFieldValidator>
                                 <asp:ValidatorCalloutExtender ID=
"ValidatorCalloutExtender1" runat="server" TargetControlID=
"RequiredFieldValidator1">
                                 </asp:ValidatorCalloutExtender>
                              </div>

</td>
                        </tr>
                        <tr>
                           <td class="fieldname">
                              E-Mail
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:Literal runat="server" ID="ltlEMail">
</asp:Literal>
                              <div runat="server" id="dEMail">
                                 <asp:TextBox ID="txtEmail" runat="server"
CssClass="formField"></asp:TextBox><span
                                    style="font-size: 10pt; vertical-align: super;
color: #ff0000">*</span>
                                 <asp:RequiredFieldValidator ID=
"RequiredFieldValidator2" runat="server" ControlToValidate="txtEmail"
                                    Display="None" ErrorMessage="You must supply
a valid E-Mail"></asp:RequiredFieldValidator>
                                 <asp:ValidatorCalloutExtender ID=
"ValidatorCalloutExtender2" runat="server" TargetControlID=
"RequiredFieldValidator2">
                                 </asp:ValidatorCalloutExtender>
                              </div>
                           </td>
                        </tr>
                        <tr runat="server" id="trQuestion">
                           <td class="fieldname">
                              <asp:Label runat="server" ID="lblQuestion"
AssociatedControlID="Question" Text="Security question:" />
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:TextBox runat="server" ID="Question" Width

="100%" />
                              <asp:RequiredFieldValidator ID="valRequireQuestion"
runat="server" ControlToValidate="Question"
                                 SetFocusOnError="true" Display="Dynamic"
ErrorMessage="Security question is required."
                                 ToolTip="Security question is required."
ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
                           </td>
                        </tr>
                        <tr runat="server" id="trAnswer">
                           <td class="fieldname">
                              <asp:Label runat="server" ID="lblAnswer"
AssociatedControlID="Answer" Text="Security answer:" />
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:TextBox runat="server" ID="Answer" Width=
"100%" />
                              <asp:RequiredFieldValidator ID="valRequireAnswer"
runat="server" ControlToValidate="Answer"
                                 SetFocusOnError="true" Display="Dynamic"
ErrorMessage="Security answer is required."
                                 ToolTip="Security answer is required."
ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>
                           </td>
                        </tr>
                        <tr runat="server" id="trRegistered">
                           <td class="fieldname">
                              Registered:
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:Literal runat="server" ID="lblRegistered" />
                           </td>
                        </tr>
                        <tr runat="server" id="trLastLogin">
                           <td class="fieldname">
                              Last Login:
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:Literal runat="server" ID="lblLastLogin" />
                           </td>
                        </tr>
                        <tr runat="server" id="trLastActivity">
                           <td class="fieldname">
                              Last Activity:
                           </td>
                           <td width="10">
                           </td>
                           <td>
                              <asp:Literal runat="server" ID="lblLastActivity" />
                           </td>
                        </tr>
                        <tr>
                           <td colspan="3">
                              <table runat="server" id="tUserStatus" cellspacing
="0" cellpadding="0" width="100%"
                                 align="center" border="0">
                                 <tr>
                                    <td class="fieldname">
                                       <asp:Label runat="server" ID
="lblOnlineNow" AssociatedControlID="chkOnlineNow" Text="Online Now:" />
                                    </td>
                                    <td width="10">
                                    </td>
                                    <td>
                                       <asp:CheckBox runat="server" ID
="chkOnlineNow" Enabled="false" />

</td>
                                 </tr>
                                 <tr>
                                    <td class="fieldname">
                                       <asp:Label runat="server" ID
="lblApproved" AssociatedControlID="chkApproved" Text="Approved:" />
                                    </td>
                                    <td width="10">
                                    </td>
                                    <td>
                                       <asp:CheckBox runat="server" ID=
"chkApproved" AutoPostBack="true" />
                                    </td>
                                 </tr>
                                 <tr>
                                    <td class="fieldname">
                                       <asp:Label runat="server" ID=
"lblLockedOut" AssociatedControlID="chkLockedOut" Text="Locked Out:" />
                                    </td>
                                    <td width="10">
                                    </td>
                                    <td>
                                       <asp:CheckBox runat="server" ID=
"chkLockedOut" AutoPostBack="true" />
                                    </td>
                                 </tr>
                              </table>
                           </td>
                        </tr>
                        <tr>
                           <td colspan="3">
                           </td>
                        </tr>
                        <tr>
                           <td colspan="3">
                              <div runat="server" id="dPassword">
                                 Password &nbsp;&nbsp;
                                 <asp:TextBox ID="txtPwd" runat="server"
TextMode="Password" CssClass="formField"></asp:TextBox><span
                                    style="vertical-align: super; color: red">*
                                    <asp:RequiredFieldValidator ID
="RequiredFieldValidator1" runat="server" ControlToValidate="txtPwd"
                                       Display="None" ErrorMessage="You must
supply a Password."></asp:RequiredFieldValidator>
                                 </span>&nbsp;<br />
                                 <asp:ValidatorCalloutExtender ID
="ValidatorCalloutExtender3" runat="server" TargetControlID=
"RequiredFieldValidator3">
                                 </asp:ValidatorCalloutExtender>
                                 Confirm Password
                                 <asp:TextBox ID="txtPwdConfirm" runat="server"
TextMode="Password" CssClass="formField"></asp:TextBox>
                                 <asp:CompareValidator ID="CompareValidator1"
runat="server" ControlToCompare="txtPwdConfirm"

ControlToValidate="txtPwd" Display="None"
ErrorMessage="The Passwords do not Match."></asp:CompareValidator>
                                 <asp:ValidatorCalloutExtender ID=
"ValidatorCalloutExtender4" runat="server" TargetControlID="CompareValidator1">
                                 </asp:ValidatorCalloutExtender>
                              </div>
                           </td>
                        </tr>
                        <tr>
                           <td colspan="3">
                           </td>
                        </tr>
                     </table>
                  </td>
               </tr>
               <tr>
                  <td>
                     <div class="sectiontitle">
                        Edit user's roles</div>
                  </td>
               </tr>
               <tr>
                  <td>
                     <asp:CheckBoxList ID="cblRoles" runat="server"
 RepeatColumns="3">
                     </asp:CheckBoxList>
                  </td>
               </tr>
               <tr>
                  <td>
                  <uc1:UserProfile ID="UserProfile1" runat="server" />
                  </td>
               </tr>
               <tr>
                  <td>
                     <table id="Table11" cellspacing="1" cellpadding="1" width
="300" align="center" border="0">
                        <tr>
                           <td class="AdminDetailsAction">
                              <asp:LinkButton ID="lbDelete" CssClass=
"AdminButton" runat="server" CausesValidation="false">Delete</asp:LinkButton>
                           </td>
                           <td class="AdminDetailsAction">
                              <asp:LinkButton ID="lbCancel" CssClass=
"AdminButton" runat="server" CausesValidation="false">Cancel</asp:LinkButton>
                           </td>
                           <td class="AdminDetailsAction">
                              <asp:LinkButton ID="lbUpdate" CssClass=
"AdminButton" runat="server">Update</asp:LinkButton>
                           </td>
                        </tr>
                     </table>
                  </td>

</tr>
            </table>

When the page loads, the username parameter is read from the querystring, a MembershipUser instance is retrieved for that user, and the values of its properties are shown by the first section's controls. Remember, as an administrator you are authenticated, so you must keep the username you want to edit separate from your account credentials. The membership provider assumes your account is to be used, if one is not specified, so there is some work required to keep these separated. The CurrentUserName property helps with this problem:

Private Property CurrentUserName() As String
      Get
         If Not IsNothing(ViewState("CurrentUserName")) Then
            Return ViewState("CurrentUserName").ToString
         Else
            If Not IsNothing(Request("CurrentUserName")) Then
               Return Request("CurrentUserName").ToString
            Else
               Return String.Empty
            End If
         End If
      End Get
      Set(ByVal value As String)
         ViewState("CurrentUserName") = value
      End Set
   End Property

The Page Load event handler checks to see if a username was passed and either loads the user's information to be edited or clears the controls so a new user can be added to the site.

Protected Sub Page_Load1(ByVal sender As Object, ByVal e As System.EventArgs)
Handles Me.Load

      If Not IsPostBack Then

         If String.IsNullOrEmpty(CurrentUserName) = False Then 'Better make sure
            BindUser()
         Else
            ClearUser()
         End If

      End If

   End Sub

The GetMember function wraps the Membership.GetUser method so that it can be consistently called as needed in the site.

Private Function GetMember() As MembershipUser
      Dim mu As MembershipUser = Membership.GetUser(CurrentUserName)
      Return mu
   End Function

The BindUser method gets the Membership user object for the desired user and binds the controls to the corresponding values.

Private Sub BindUser()

      Dim mu As MembershipUser = GetMember()

      dUserName.Visible = False
      dEMail.Visible = False
      dPassword.Visible = False
      tUserStatus.Visible = True
      trRegistered.Visible = True
      trLastActivity.Visible = True
      trLastLogin.Visible = True
      trQuestion.Visible = False
      trAnswer.Visible = False

      lbUpdate.Text = "Update"

      ltlUserName.Text = mu.UserName
      ltlEMail.Text = mu.Email
      lblRegistered.Text = mu.CreationDate.ToString("f")
      lblLastLogin.Text = mu.LastLoginDate.ToString("f")
      lblLastActivity.Text = mu.LastActivityDate.ToString("f")

      chkOnlineNow.Checked = mu.IsOnline
      chkApproved.Checked = mu.IsApproved
      chkLockedOut.Checked = mu.IsLockedOut
      chkLockedOut.Enabled = mu.IsLockedOut

      BindRoles()

   End Sub

In the Page_Load event handler you also call the BindRoles method, as follows, which fills a CheckBoxList with all the available roles and then retrieves the roles the user belongs to, and finally selects them in the CheckBoxList:

Protected Sub BindRoles()
        BindRoles(String.Empty)
End Sub

Protected Sub BindRoles(ByVal vUserName As String)

        cblRoles.DataSource = Roles.GetAllRoles
        cblRoles.DataBind()

        For Each role As String In Roles.GetRolesForUser(vUserName)
            cblRoles.Items.FindByText(role).Selected = True
        Next

End Sub

When the Update Roles button is pressed, the user is first removed from all her roles, and then is added to the selected ones. The removal that occurs first is necessary because a call to Roles.AddUserToRole will fail if the user is already a member of that role. This is a list collection that enables you to specify the datatype you wish to support for objects stored in the list. When you declare an instance of this collection, you have to indicate which datatype you want to store in it by enclosing it in angle brackets. Therefore, if you say "List<string>" you are asking for a list collection that is strongly typed to accept strings. You could have also asked for a collection of any other datatype, including any custom class you might create to hold related data.

Here's the code for the UpdateRoles method:

Private Sub UpdateRoles(ByVal mu As MembershipUser)

        Dim currRoles() As String = Roles.GetRolesForUser(mu.UserName)

        If currRoles.Length > 0 Then
            Roles.RemoveUserFromRoles(UserName, currRoles)
        End If

        ' and then add the user to the selected roles
        Dim newRoles As New List(Of String)
        For Each item As ListItem In cblRoles.Items
            If item.Selected Then
                newRoles.Add(item.Text)
            End If
        Next
        Dim userNames() As String = {mu.UserName}
        Roles.AddUsersToRoles(userNames, newRoles.ToArray)

        lblRolesFeedbackOK.Visible = True

End Sub

As you see, you don't make individual calls to Roles.AddUserToRole for each selected role. Instead, you first fill a list of strings with the names of the selected roles and then make a single call to Roles.AddUserToRoles. When the Create Role button is pressed, you first check to see if a role with the same is already present, and if not, you create it. Then, the BindRoles method is called to refresh the list of available roles:

Protected Sub btnNewRole_Click(ByVal sender As Object, ByVal e As EventArgs)
Handles btnNewRole.Click
        If Not Roles.RoleExists(txtNewRole.Text.Trim) Then
            Roles.CreateRole(txtNewRole.Text.Trim)
            BindRoles()
        End If
    End Sub

When the Approved checkbox is clicked, an auto-postback is made, and in its event handler you update the MembershipUser object's IsApproved property according to the checkbox's value, and then save the change:

Protected Sub chkApproved_CheckedChanged(ByVal sender As Object, ByVal e As
System.EventArgs) Handles chkApproved.CheckedChanged
        Dim User As MembershipUser = Membership.GetUser(CurrentUserName)
        If Not IsNothing(User) Then
            User.IsApproved = chkApproved.Checked
            Membership.UpdateUser(User)
        End If
End Sub

It works in a similar way for the Locked Out checkbox, except that the corresponding MembershipUser property is read-only, and the user is unlocked by calling the UnlockUser method. After this is done, the checkbox is made read-only because you can't lock out a user here (as mentioned previously). Take a look at the code:

Protected Sub chkLockedOut_CheckedChanged(ByVal sender As Object, ByVal e As
System.EventArgs) Handles chkLockedOut.CheckedChanged
        If chkLockedOut.Checked = False Then
            Dim user As MembershipUser = Membership.GetUser(CurrentUserName)
            If Not IsNothing(user) Then
                user.UnlockUser()
                chkLockedOut.Enabled = False
            End If
        End If
End Sub

Finally, when the Update button is clicked, a call to the UserProfile's SaveProfile is made, as you've done in other pages:

Protected Sub lbUpdate_Click(ByVal sender As Object, ByVal e As System.EventArgs)
Handles lbUpdate.Click

        UpdateUser(Membership.GetUser(CurrentUserName))
        UserProfile1.SaveProfile()

End Sub

Figure 4-20 shows this page.

Figure 4.20. Figure 4-20

The ManageRoles page provides a list of the site's roles with links to edit and delete them. The two role administration pages both derive from RoleAdminPage, which in turn derives from AdminPage. The RoleAdminPage contains the RoleName property, which is built upon the PrimaryKeyIdAsString property defined in the BasePage class.

Public Class RoleAdminPage
        Inherits AdminPage

#Region " Properties "

        Protected Property RoleName() As String
            Get
                Return PrimaryKeyIdAsString("Role")
            End Get
            Set(ByVal value As String)
                PrimaryKeyIdAsString("Role") = value
            End Set
        End Property

#End Region

End Class

The PrimaryKeyIdAsString property is a catch-all sort of pattern designed to catch string parameters entered in the querystring or stored in the page's view state. I call it the PrimaryKeyIdAsString property because it is primarily used to manage values associated with primary keys in tables. However it can be used for any value that might potentially be passed in the querystring. The main difference between PrimaryKeyId and PrimaryKeyIdAsString property is the string version returns an empty string when no matching parameter is found. The PrimaryKeyId returns 0 for an empty integer parameter.

Public Property PrimaryKeyIdAsString(ByVal vPrimaryKey As String) As String
Get
                If Not IsNothing(ViewState(vPrimaryKey)) Then
                    Return ViewState(vPrimaryKey)
                ElseIf Not IsNothing(Request.QueryString(vPrimaryKey)) Then
                    ViewState(vPrimaryKey) = Request.QueryString(vPrimaryKey)
                    Return Request.QueryString(vPrimaryKey)
                End If
                Return String.Empty
End Get
Set(ByVal Value As String)
                ViewState(vPrimaryKey) = Value
End Set
End Property

The ManageRoles page relies on a ListView, which follows a common pattern with a table used for the layout, and a column to display the role, and edit and delete it. The first row of the table defines a header row, with column titles and applies the AdminList style class. In the case of the DarkBeer theme, this uses a maroon background and bold white font.

The ItemTemplate defines the binding responsible for rendering the content for each record. This is more than just echoing the text, it also renders the links and buttons for the user to edit and delete an existing role. The role name itself is wrapped in an anchor tag that loads the AddEditRole.aspx page, passing the role to modify.

The delete ImageButton leverages the built-in Deleting event handler of the ListView to handle the deleting process. Notice the ListView's DataKeyNames property is left blank, this is because the collection of roles bound to the ListView is a collection of strings, and therefore does not contain any primary key values.

<asp:ListView ID="lvRoles" runat="server" DataKeyNames="Role">
                     <LayoutTemplate>
                       <table cellspacing="0" cellpadding="0" class="AdminList">
                          <tr class="AdminListHeader">
                            <td>
                              Role
                            </td>
                            <td>
                              Edit
                            </td>
                            <td>
                              Delete
                            </td>
                          </tr>
                          <tr id="itemPlaceholder" runat="server">
                          </tr>
                         </table>
<!--Common Data Pager Control Here -->
                     </div>
                     </LayoutTemplate>
                     <EmptyDataTemplate>
                       <tr>
                          <td colspan="3">
                            <p>
                               Sorry there are no Roles available at this time.</p>
                          </td>
                       </tr>
                     </EmptyDataTemplate>
                     <ItemTemplate>
                       <tr>
                          <td class="ListTitle">
                            <a href="<%# String.Format("AddEditRole.aspx?Role
={0}", Container.DataItem.ToString()) %>">
                              <%# Container.DataItem.ToString() %></a>
                          </td>
                          <td>
                            <a href="<%# String.Format("AddEditRole.aspx?Role
={0}", Container.DataItem.ToString()) %>">
                              <img src="../images/edit.gif" alt="" width="16"
height="16" class="AdminImg" /></a>
                          </td>
                          <td>
                            <asp:ImageButton runat="server" ID=
"btnDeleteEvents" CommandArgument='<%# Eval("Role")%>'
                              CommandName="Delete" ImageUrl=

"~/images/delete.gif" AlternateText="Delete" CssClass="AdminImg"
                              OnClientClick="return confirm('Warning: This
will delete the Role from the database.')," />
                          </td>
                       </tr>
                     </ItemTemplate>
                   </asp:ListView>

Similarly to the ManageUsers page, when a user clicks the trash can icon to delete a row the ItemDeleting event fires, and the role name is passed to the DeleteRoles function. This function first purges any users from the role before it deletes it from the site.

Private Sub lvRoles_ItemDeleting(ByVal sender As Object, ByVal e As
 System.Web.UI.WebControls.ListViewDeleteEventArgs) Handles lvRoles.ItemDeleting
      DeleteRole(lvRoles.Items(e.ItemIndex).DataItem)
   End Sub

   Private Sub DeleteRoles(ByVal vRole As String)
      If Roles.GetUsersInRole(vRole).Length > 0 Then
         Roles.RemoveUsersFromRole(Roles.GetUsersInRole(vRole), vRole)
      End If
      Roles.DeleteRole(vRole)
      BindRoles()
End Sub

In this edition of the Beer House, the user and user and role management is broken into two distinct groups of pages that enables you to add a little more functionality. The AddEditRole page allows us to add new roles, edit existing roles, and add users to a specific role.

When the page is loaded, it checks to see if there has been a role name passed to the page, if not it clears the controls by calling the ClearRoleInfo method. If there is a role to work on, it binds the role and any associated users to the controls.

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)
Handles Me.Load

      If Not IsPostBack Then

         MultiView1.ActiveViewIndex = 0

         If String.IsNullOrEmpty(RoleName) = False Then
            BindRoleInfo()
         Else
            clearRoleinfo()
         End If

      End If

   End Sub

    Private Sub ClearRoleInfo()

        txtRole.Text = String.Empty

flUser.visible = False
        lvUsers.Items.Clear

    End Sub

The BindRoleInfo method sets the text of the txtRole to the role, if it exists. I did this because, if the role does not exist, it needs to be added. If the role exists, then it is bound to the txtRole and a list of UsersInRole is bound to the lvUsers ListView. The list just shows the users in this role. There is also a delete button to remove the user from the list.

Private Sub BindRoleInfo()
        BindRoleInfo(RoleName)
    End Sub

    Private Sub BindRoleInfo(ByVal sRole As String)

        If Roles.RoleExists(sRole) = False Then
            txtRole.Text = String.Empty

            Exit Sub
        End If

        txtRole.Text = sRole

        lvUsers.DataSource = Roles.GetUsersInRole(sRole)
        lvUsers.DataBind()

    End Sub

The MultiView control, introduced with ASP.NET 2.0, allows the definition of different panes of information that can be displayed based on runtime logic. It is great for exchanging what is visible based on server-side logic. In the case of administering a role, it can display either the role information or a view where a new user can be added. When the Add User to Role button is clicked, the second view is displayed and the first view is hidden. In fact the content of the hidden view is not even sent to the browser, making the actual content sent to the client thinner. However, this does mean that any activity to hide or display a view must involve a round trip to the server to determine which view should be displayed. We will see in the next chapter how to hide and display DIVs using JavaScript in a similar fashion, but all the activity is managed on the client.

A TextBox is used to collect the username to be added to the role. A TextBox is a better solution in this situation because the list of usernames could be very large. The TextBox is extended with an AutoCompleteExtender that retrieves a list of potential usernames as the administrator types characters in the TextBox. The AutoCompleteExtender is part of the ASP.NET AJAX Control Toolkit, discussed earlier in this chapter. The AutoCompleteExtender provides a suggestion effect that allows the administrator to see potential accounts without being overwhelmed with a large list of usernames.

To make the AutoCompleteExtender work, there must be a web service with a web method it can call to retrieve the suggestions. The method signature has to be in the form of a String and an Integer. The String is the phrase to be used as the search filter, and the Integer is a count limit the AutoCompleteExtender wants. This is used to limit the size of the list displayed below the TextBox. If there were no limit, the list could be infinitely long. The MaximumPrefixLength property signals to the AutoCompleteExtender how many characters need to be entered before it queries the web service for a list. This again is useful to help limit any potential long list of results. The ServicePath is the URL to the web service, and the ServiceMethod is the name of the method in the web service used to perform the filtering.

<asp:View runat="server" ID="vAddUserToRole">
   <fieldset id="Fieldset1">
      <legend>Assign New User</legend>
      <br />
      Role:
      <asp:Literal runat="server" ID="ltlRole" />
      <br />
      User
      <asp:TextBox ID="txtUser" runat="server" CssClass=
"formField"></asp:TextBox>&nbsp;&nbsp;&nbsp;
      <asp:Button runat="server" ID="btnAddUserToRole2" Text=
"Add User To Role" />&nbsp;&nbsp;&nbsp;
      <asp:Button runat="server" ID="btnCancelAddUserToRole" Text="Cancel" /><br />
      <asp:AutoCompleteExtender runat="server" ID="autoComplete1" TargetControlID
="txtUser"
         ServicePath="~/MembersService.asmx" ServiceMethod="SearchUsersByName"
 MinimumPrefixLength="1"
         CompletionInterval="1000" EnableCaching="true" CompletionSetCount="12" />
   </fieldset>
</asp:View>

The SearchUsersByName method uses the same search routine used in the ManageUsers.aspx page, Membership.FindUsersByName method. The AutoCompleteExtender passes in each character as it is typed and builds a list of potential usernames that match the characters already entered. The SearchUsersByName method retrieves the list of potential MembershipUsers and adds the usernames to a StringCollection. This is then copied to an array of Strings and returned to the AutoCompleteExtender to display as a list below the targeted TextBox control.

<WebMethod()> _
<System.Web.Script.Services.ScriptMethod()> _
Public Shared Function SearchUsersByName(ByVal vName As String,
ByVal count As Integer) As String()

        Dim saUsers As String()
        Dim UserNames As New StringCollection

        Dim users As MembershipUserCollection = Membership.FindUsersByName(vName)

        For Each mu As MembershipUser In users
            UserNames.Add(mu.UserName)
        Next

        Dim saUsers As String() = New String(UserNames.Count - 1) {}
        UserNames.CopyTo(saUsers, 0)

        Return saUsers
End Function