Custom login will not work



When I started a new ASP project I was eager to use the login facilities
offered in Framework 2.0/VS 2005.

I wanted:
- A custom principal that could hold my integer UserID from the database
- An easy way to classify different pages as either Admin, Member or Public,
where login is necessary for Admin and Member but not for Public. My idea was
to put the pages in different directories to easily keep my order.
- An easy menu system that would show only accesible pages

I carefully read the newsgroups and put together what I thought was a good
mix of working ideas. I think I am quite close but I don't really make it all

Hopefully someone can give me a hint by scanning through my code sample:


web.config content:
<authentication mode="Forms">
<forms loginUrl="Public/Login.aspx" defaultUrl="/Default.aspx"
name=".ASPXFORMSAUTH" path="\">
<deny users="?"/>
<allow users="*"/>

Global.asax content:
<script runat="server">

Protected Sub Application_AuthenticateRequest(ByVal sender As Object,
ByVal e As System.EventArgs)
Dim app As HttpApplication
Dim authTicket As FormsAuthenticationTicket
Dim authCookie As String = ""
Dim cookieName As String = FormsAuthentication.FormsCookieName
Dim userIdentity As FormsIdentity
Dim userData As String
Dim userDataGroups As String()
Dim PersonID As Integer
Dim roles As String()
Dim userPrincipal As CustomPrincipal
Dim AllowAccess as Boolean

app = DirectCast(sender, HttpApplication)

If app.Request.IsAuthenticated AndAlso
app.User.Identity.AuthenticationType = "Forms" Then
'Get authentication cookie
authCookie = app.Request.Cookies(cookieName).Value
Catch ex As Exception
'Cookie not found generates exception: Redirect to loginpage
End Try

'Decrypt the authentication ticket
authTicket = FormsAuthentication.Decrypt(authCookie)

'Create an Identity from the ticket
userIdentity = New FormsIdentity(authTicket)

'Retrieve the user data from the ticket
userData = authTicket.UserData

'Split user data in main sections
userDataGroups =

'Read out ID and roles
PersonID = CType(userDataGroups(0), Integer)
roles = userDataGroups(1).Split(CustomPrincipal.DELIMITER_ROLES)

'Rebuild the custom principal
userPrincipal = New CustomPrincipal(userIdentity, PersonID, roles)

'Set the principal as the current user identity
app.Context.User = userPrincipal

End If

'If we already are heading for Login page then we don't need to
check anything more
If Request.Url.AbsolutePath.ToLower =
FormsAuthentication.LoginUrl.ToLower Then
Exit Sub
End If

'Evaluate if access is allowed
Select Case BaseDirectory(Request.Url)
Case "Member", "Admin"
'For all restricted pages we need to check user validity

If IsNothing(app.Context.User) Then
'User is not authenticated
AllowAccess = False

ElseIf IsNothing(SiteMap.CurrentNode) OrElse
(SiteMap.CurrentNode.Roles.Count = 0) Then
'Missing SiteMap means access is implicitly allowed
AllowAccess = True

AllowAccess = False
'Loop through each role and check to see if user is in
one of them
For Each Role As String In SiteMap.CurrentNode.Roles
If app.Context.User.IsInRole(Role) Then
AllowAccess = True
Exit For
End If
End If

Case Else
'Public folders are always OK
AllowAccess = True

End Select

If Not AllowAccess Then
End If

End Sub

Protected Function BaseDirectory(ByVal u As System.Uri) As String
Select Case u.Segments.Length
Case Is < 3
Throw New Exception("BaseDirectory expecting at least one
level of directories")
Case 3
Return ""
Case Else
Return u.Segments(2).Replace("/", "")
End Select
End Function


Public Class CustomPrincipal
Inherits System.Security.Principal.GenericPrincipal

Private _PersonID As Integer

Public Const DELIMITER_SECTIONS As String = ";"
Public Const DELIMITER_ROLES As String = ","

Public Enum Roles
Member = 1
Editor = 2
Admin = 3
End Enum

Public Sub New(ByVal identity As System.Security.Principal.IIdentity,
ByVal PersonID As Integer, ByVal roles As String())
MyBase.New(identity, roles)
_PersonID = PersonID
End Sub

Public ReadOnly Property UserName() As String
Return MyBase.Identity.Name
End Get
End Property

Public ReadOnly Property PersonID() As Integer
Return _PersonID
End Get
End Property

Public Shadows ReadOnly Property IsInRole(ByVal role As Roles) As Boolean
Return MyBase.IsInRole(role)
End Get
End Property

End Class

Partial Class Login
Inherits System.Web.UI.Page

Protected Sub cmdLogin_Click(ByVal sender As Object, ByVal e As
System.EventArgs) Handles cmdLogin.Click
Dim p As Person
Dim RedirectUrl As String

p = New Person
p.Load(txtUserID.Text, txtPassword.Text)

If p.IsEmpty Then
Throw New Exception("Login failed. Please check your
username and password and try again.")
End If

'Create a ticket with validated user
CreateAuthenticationTicket(p, chkPersist.Checked)

'Redirect to requested page
RedirectUrl = GetReturnUrl

Catch ex As Exception
lblFailure.Text = ex.Message
End Try
End Sub

Public ReadOnly Property GetReturnUrl() As String
If IsNothing(Request.QueryString("ReturnUrl")) Then
'Default page
Return FormsAuthentication.DefaultUrl
'Requested page if present
Return Request.QueryString("ReturnUrl")
End If
End Get
End Property

Public Sub CreateAuthenticationTicket(ByVal p As Person, ByVal
Persistant As Boolean)
Dim authTicket As FormsAuthenticationTicket
Dim encTicket As String
Dim cookie As HttpCookie

'Create a ticket
authTicket = New FormsAuthenticationTicket(1, p.Name, _
DateTime.Now.AddMonths(1), _
Persistant, p.UserData)

'Encrypt the ticket into a string
encTicket = FormsAuthentication.Encrypt(authTicket)

'Create the cookie
cookie = New HttpCookie(FormsAuthentication.FormsCookieName,

If Persistant Then
'Specify expiration date
cookie.Expires = Now.AddMonths(1)
End If

'Save the cookie

Catch ex As Exception
Throw New Exception("CreateAuthenticationTicket: " & ex.Message)
End Try
End Sub
End Class

Sitemap content:
<siteMapNode title="Start" url="default.aspx" description="Return to start
page" roles="*">
<siteMapNode title="Activities">
<siteMapNode title="Calender" url="Public/Calendar.aspx" roles="*" />
<siteMapNode title="My Responsibility"
url="Member/MyResponsibility.aspx" roles="*" />
<siteMapNode title="Edit Activity" url="Member/ActivityEdit.aspx"
roles="1" />
<siteMapNode title="Add Activity" url="Member/ActivityAdd.aspx"
roles="2" />

Problems found with this code:
1) You need to click Logout twice to get out
2) You don't reach pages in the Public folder without logging in
3) After login some redirection doesn't work.
If the Login page itself is placed in a subdirectory, then it will not find
the defaultURL.
4) The TreeView control based on a sitemap always show all menus even if
they are mapped to different roles.

Steven Cheng[MSFT]

Hello jaklithn,

From your description, you're wantting to build an ASP.NET web application
which is protected by forms authentication and you will also add some
addtional data like userID and roles associated with each user. Then,you'll
authorize the access to each page and the display links of navigation menu
according to these roles. You're wondering how to conveniently implement
this in ASP.NET 2.0,correct?

As for this scenario, based on my experience, here are some of my
understanding and suggestion:

For forms authentication, you do can use the global.asax or a custom
httpmodule to manually parse the authentication cookie and get additional
user data(roles) from it and assign them to our custom principal class
instance. However, the drawback of this is:

1. We can not use the built-in role-manager service in ASP.NET 2.0(new
feature), which can help us automatically handle role management(associate
role to a certain user after authentication)

2. If you want to customize our navigation controls(such as Treeview or
menu ) to display items according to current user's authorization roles,
you need to manually write code instead of using the built-in security
trimming feature.

I have another solution you can also consider here:

Instead of manually do the role management(through global.asax or
httpmodule), use the built-in membership and role management service:

#ASP.NET 2.0 Membership, Roles, Forms Authentication, and Security

You just need to configure the membership provider and enable role manager
in web.config, by default it use SQL Express database file as persistent

And for the authorization on page url , it still is automatically managed
as long as you configure the <authorization> settings correctly. For
navigation menu's displaying, you can have a look at the Site-Map security
trimming feature in ASP.NET 2.0:

#ASP.NET Site-Map Security Trimming

here is a live example provided by ASP.NET product manager ScottGu, the
example is using windows authentication , but it easier to change to forms

#Recipe: Implementing Role-Based Security with ASP.NET 2.0 using Windows
Authentication and SQL Server

and the only problem here is that how to store the additional userID
data(or any other additional data associated with each user). Here I
suggest you consider using the Profile service which can help store some
custom data(basic types or custom class type) that associate with each
user(mapping to forms authentication &membership service):

#ASP.NET Profile Properties Overview

Please have a look at these resources. If there is anything unclear, please
feel free to let me know.


Steven Cheng

Microsoft MSDN Online Support Lead


Get notification to my posts through email? Please refer to

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at


This posting is provided "AS IS" with no warranties, and confers no rights.

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question