Adding Roles to ASP.NET Accounts
(Page 1 of 4 )

Last week we began our discussion of website personalization with Visual Basic 2005. This week, we continue that discussion with an explanation of how to add roles to ASP.NET accounts. This article is excerpted from chapter 12 of the book Programming Visual Basic 2005, written by Jesse Liberty (O'Reilly, 2005; ISBN: 0596009496).

Add Roles to ASP.NET Accounts

Authentication is the process of identifying a user; authorization is the process of deciding which parts of your application that user can see and interact with. The forms-based security controls and database that comes with Visual Basic 2005 allows you to set authorization for specific users based on their being assigned to a role (such as guest, member, manager, etc). You do so in three steps: create the roles, assign permissions to each role, and then assign users to the roles. Any given user may be in more than one role (e.g., administrator and manager). The permissions you assign to each role may determine access to a page, or may change the content of a given page displayed to members of that role.

Create a New Application with Roles

To demonstrate how to create roles and assign users to those roles, you’ll need to create a new application, ASPSecurityRoles. Begin by copying over the web site you used in the previous exercise (FormBasedSecurity), as shown in Figure 12-21.

Figure 12-21.  Copy web site

Set Welcome as the Start page and run the program to make sure you can still log in. Open the WAT and click on the Security tab. In the second column (Roles), you’ll see that roles are not enabled. Click on Enable Roles, as shown in Figure 12-22.

Figure 12-22.  Enabling roles in WAT

Open Web.config and you’ll see that the WAT has updated it to add roles management:

  <system.web>
    <roleManager enabled="true" />
    <authentication mode="Forms"/ >  
    <membership defaultProvider="AspNetSqlMembershipProvider"/>
    <compilation debug="true"/>
  </system.web>

Depending on how your machine is set up and which database you are using, you may or may not have thedefaultProviderentry in yourWeb.config.

Once roles have been created, use the WAT to create your first Role: Manager (it is helpful to have an initial role and a user in that role so that you can have in your code a test to ensure that only Managers, for example, can create new roles or add users to roles).

What you actually call that role—manager, adminstrator, tsar—is entirely up to you.

Under Add/Remove users, click the Manage link and navigate to one of your users (e.g., jliberty) and click the User Is In Role box to add that user to the role, as shown in Figure 12-23.

Using the LoginView’s smart tag, click on Edit Templates and edit the Logged In Template. Add three hyperlinks to the Logged In Template on the Welcome page, as shown in Figure 12-24. Set the NavigateURL to ChangePW.aspx, CreateAccount. aspx, and ManageRoles.aspx, respectively. Be sure to click on End Template Editing when you are done.

Create the ChangePW.aspx page and drag aChangePasswordcontrol onto the page. Use the smart tag to format theChangePassword control, as shown in Figure 12-25.

Set theContinueDestinationPageURLproperty to Login.aspx, and on Login.aspx make sure theContinueDestinationPageURLof the Login control is set to Welcome.aspx. You may also want to confirm or change the Success Text as well as the other text fields (ChangePasswordTitleText,ChangePasswordFailureText, etc.)

Figure 12-23.  Adding users to roles in WAT

Figure 12-24.  End Template Editing of Logged In Template

Figure 12-25.  ChangePassword control

Create the ManageRoles.aspx page. This new page has a somewhat complex layout since it must display the list of roles and the list of users supported by your site, as well as which users have been assigned which roles. The page is shown in Figure 12-26, and the controls are listed in Table 12-1.

Figure 12-26.  ManageRoles.aspx

Table 12-1.  Controls in ManageRoles.aspx

Control name	Control type	Attributes
linkHome	Hyperlink	Inner HTML: Home Page NavigateURL= "Welcome.aspx"
Msg	Label
RolesListBox	ListBox	Autopostback=true
UsersListBox	ListBox	Autopostback=true
btnAddUsersToRole	Button	Add User(s) to Role OnClick="AddUsers_OnClick"
btnCreateRole	Button	Create new Role
		OnClick="CreateRole_OnClick"
pnlCreateRole	Panel	Visible="False"
Label2	Label	New Role:
txtNewRole	TextBox
btnAddRole	Button	Text="Add"
		OnClick="btnAddRole_Click"
UsersInRoleGrid	GridView

TheUsersInRoleGrid should look like Example 12-2.

Example 12-2. UserInRoleGrid source

<asp:GridView runat="server" CellPadding="4" id="UsersInRoleGrid"
                AutoGenerateColumns="false" Gridlines="None"
                CellSpacing="0"
OnRowCommand="UsersInRoleGrid_RemoveFromRole">
       <HeaderStyle BackColor="navy" ForeColor="white" />
       <Columns>
        <asp:TemplateField HeaderText="User Name">
          <ItemTemplate>
           <%# Container.DataItem.ToString() %>
          </ItemTemplate>
        </asp:TemplateField>
        <asp:ButtonField Text="Remove From Role" ButtonType="Link" />
       </Columns>
</asp:GridView>

All of these controls should be laid out in a table, with the text inserted into columns as well. The finished page is shown in Example 12-3.

Example 12-3. Manage Role Page source

<%@ Page Language="VB" AutoEventWireup="false" CodeFile="ManageRoles.aspx.vb" Inherits="ManageRoles_aspx" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/ xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
   <title>Manage Roles</title>
</head>
<body>
   <form id="form1" runat="server">
  <h3>Role Membership
    <asp:HyperLink ID="linkHome" Runat="server" NavigateUrl="Welcome.aspx">
         Home page
    </asp:HyperLink>
  </h3>
  <asp:Label id="Msg" ForeColor="maroon" runat="server" /><BR>
  <table CellPadding="3" border="0">
   <tr>
    <td valign="top">Roles:</td>
    <td valign="top" style="width: 186px">
        <asp:ListBox id="RolesListBox"
           runat="server" Rows="8" AutoPostBack="True" />
    </td>
    <td valign="top">Users:</td>
    <td valign="top">
      <asp:ListBox id="UsersListBox" DataTextField="Username"
         Rows="8" SelectionMode="Multiple" runat="server" />
   </td>
    <td valign="top" visible="false">
        <table>
        <tr>
           <td>
              <asp:Button Text="Add User(s) to Role" id="btnAddUsersToRole"
                runat="server" OnClick="AddUsers_OnClick" />
             </td>
          </tr>
          <tr>
             <td>
                <asp:Button Text="Create new Role" id="btnCreateRole"
                runat="server" OnClick="CreateRole_OnClick"
                Width="170px" Height="24px" />
             </td>
          </tr>
          <tr>
          <td>
         <asp:Panel ID="pnlCreateRole" Runat="server" Width="259px"
          Height="79px" Visible="False" BackColor="#E0E0E0">
            <br />
            &nbsp;&nbsp;
            <asp:Label ID="Label2" Runat="server" Text="New Role:"
             Width="72px" Height="19px"/> 
            <asp:TextBox ID="txtNewRole" Runat="server"/>&nbsp;<br />
            &nbsp;&nbsp;<br />   
            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;
            <asp:Button ID="btnAddRole" Runat="server"
              Text="Add" OnClick="btnAddRole_Click"
              Width="64px" Height="24px" /><br />
         </asp:Panel>

          </td>
          </tr>
          </table>
      </td>
     </tr>
     <tr>
      <td valign="top">Users In Role:</td>
      <td valign="top" style="width: 186px">
          <asp:GridView runat="server" CellPadding="4" id="UsersInRoleGrid" 
                AutoGenerateColumns="false" Gridlines="None"
                         CellSpacing="0"
          OnRowCommand= "UsersInRoleGrid_RemoveFromRole">
              <HeaderStyle BackColor="navy" ForeColor="white" />
              <Columns>
               <asp:TemplateField HeaderText="User Name">
                 <ItemTemplate>
                  <%# Container.DataItem.ToString() %>
                 </ItemTemplate>
               </asp:TemplateField> 
               <asp:ButtonField Text="Remove From Role" ButtonType="Link"
/>
              </Columns>
        </asp:GridView>
     </td>
   </tr>
  </table>
 </form>
</body>
</html>

This page is not designed to be pretty, just useful. It is based on a demonstration .aspx page provided by Microsoft.

The code-behind page must implement five event handlers:

• Page_Load 
  
• AddUsers_OnClick(adding users to roles) 
  
• UsersInRoleGrid_RemoveFromRole(removing users from roles) 
  
• CreateRole_OnClick(opening panel to create a new role)
   
• btnAddRole_Click(adding new role)

Your class will declare three member variables:

• A string array namedrolesArray
  
• A string array namedusersInRole 
  
• An instance ofMembershipUserCollectionnamedusers

TheMembershipUserCollection is defined by the Framework to holdMembershipUserobjects (surprise!). AMembershipUserobject, in turn, is defined by the Framework to represent a single user in the membership data store (in this case, the tables created in SqlServerExpress). This class exposes information about the user such as the user’s email address, and methods such as those needed to change or reset the user’s password.

Here’s how the code works. The first step is to override thePage_Loadevent handler, as shown in Example 12-4.

Example 12-4. Page_Load

Protected Sub Page_Load(_
ByVal sender As Object, _
ByVal e As System.EventArgs) Handles Me.Load
   If User.IsInRole("Manager") = False Then
      Response.Redirect("NoPrivs.aspx")
   End If
   Msg.Text = String.Empty
   If Not IsPostBack Then
      rolesArray = Roles.GetAllRoles()
      RolesListBox.DataSource = rolesArray
      RolesListBox.DataBind()
      users = Membership.GetAllUsers()
      UsersListBox.DataSource = users
      UsersListBox.DataBind()
   End If
   If (RolesListBox.SelectedItem IsNot Nothing) Then
      usersInRole = Roles.GetUsersInRole(RolesListBox.SelectedItem.Value)
      UsersInRoleGrid.DataSource = usersInRole
      UsersInRoleGrid.DataBind()
   End If
End Sub

First check that the current user is a manager. If he is, a redirect to an error page:

  If User.IsInRole("Manager") = False Then
     Response.Redirect("NoPrivs.aspx")
  End If

If this is the first time you are displaying the page, get the rolls and bind them to the list box, then get all the users and bind that collection to the Users List Box:

  If Not IsPostBack Then
     rolesArray = Roles.GetAllRoles()
     RolesListBox.DataSource = rolesArray
     RolesListBox.DataBind()
     users = Membership.GetAllUsers()
     UsersListBox.DataSource = users
     UsersListBox.DataBind() 
  End If

If there is a selected item in the Roles List Box, get the list of users who are in that role and bind the list to the users in Roll Grid:

  If (RolesListBox.SelectedItem IsNot Nothing) Then
     usersInRole = Roles.GetUsersInRole(RolesListBox.SelectedItem.Value)
     UsersInRoleGrid.DataSource = usersInRole
     UsersInRoleGrid.DataBind()
  End If

Step 2 is to implement theAddUsers_OnClickevent handler, as shown in Example 12-5.

Example 12-5. AddUsers_OnClick handler

Protected Sub AddUsers_OnClick( _
ByVal sender As Object, _
ByVal e As System.EventArgs) Handles btnAddUsersToRole.Click

   ' A role must be selected
   If RolesListBox.SelectedItem Is Nothing Then
       Msg.Text = "Please select a role."
       Exit Sub
   End If

   ' At least one user must be selected
   If UsersListBox.SelectedItem Is Nothing Then
      Msg.Text = "Please select one or more users."
      Exit Sub
   End If

   ' Create list of users to be added to the selected role
   Dim sizeOfArray As Integer = UsersListBox.GetSelectedIndices.Length
   Dim newUsers(sizeOfArray - 1) As String

   'For i As Integer = 0 To newusers.Length - 1
   '    newusers(i) = _
   '    UsersListBox.Items( _
   '        UsersListBox.GetSelectedIndices()(i)).Value
   'Next

   For i As Integer = 0 To newUsers.Length - 1
       ' get the array of selected indices from the (multiselect) list box
       Dim selectedIndices As Integer() = UsersListBox.GetSelectedIndices()
       ' get the selectedIndex that corresponds to the counter (i)
       Dim selectedIndex As Integer = selectedIndices(i)
       ' get the ListItem in the UserListBox Items collection at that offset
       Dim myListItem As ListItem = UsersListBox.Items(selectedIndex)
       ' get the string that is that ListItem's value property
       Dim newUser As String = myListItem.Value
       ' add that string to the newUsers collection of string
       newUsers(i) = newUser
   Next

   ' Add users to the selected role
   Roles.AddUsersToRole(newUsers, RolesListBox.SelectedItem.Value)
   usersInRole = Roles.GetUsersInRole(RolesListBox.SelectedItem.Value)
   UsersInRoleGrid.DataSource = usersInRole
   UsersInRoleGrid.DataBind()

End Sub

First, check to make sure that a role has been selected:

  If RolesListBox.SelectedItem Is Nothing Then
     Msg.Text = "Please select a role." 
     Exit Sub
  End If

At least one user should be selected:

  If UsersListBox.SelectedItem Is Nothing Then
     Msg.Text = "Please select one or more users."
     Exit Sub
  End If

Create an array to hold the users to be added:

  Dim sizeOfArray As Integer = UsersListBox.GetSelectedIndices.Length
  Dim newusers(sizeOfArray - 1) As String

Iterate through the users, retrieving each selected user’s name:

  For i As Integer = 0 To newusers.Length - 1
      newusers(i) = _
      UsersListBox.Items( _
         UsersListBox.GetSelectedIndices()(i)).Value
  Next

This statement is pretty complicated. The best way to understand it is to rewrite it using interim variables, like this: 

  For i As Integer = 0 To newUsers.Length - 1
      ' get the array of selected indices from the (multiselect) list box
      Dim selectedIndices As Integer() = UsersListBox.GetSelectedIndices()
      ' get the particular selectedIndex that corresponds to the counter (i)
      Dim selectedIndex As Integer = selectedIndices(i)
      ' get the ListItem in the UserListBox Items collection at that offset
      Dim myListItem As ListItem = UsersListBox.Items(selectedIndex)
      ' get the string that is that ListItem's value property
      Dim newUser As String = myListItem.Value
      ' add that string to the newUsers collection of string
      newUsers(i) = newUser
  Next

The advantage of the interim variables is that you can set break points on them and see what their value is, and you can more easily document the code. The disadvantage is minimal, but many programmers (especially those from the “C” culture!) still prefer the terser version.

Next, call the staticAddUsersToRole on theRolesclass, passing in the array of user-names, and the role you want these users added to. Rebind the users who are in that role to theUsersInRoleGrid:

  Roles.AddUsersToRole(newUsers, RolesListBox.SelectedItem.Value)
  usersInRole = Roles.GetUsersInRole(RolesListBox.SelectedItem.Value)
  UsersInRoleGrid.DataSource = usersInRole
  UsersInRoleGrid.DataBind()

As noted earlier, step 3 is to implementUsersInRoleGrid_RemoveFromRoleas shown in Example 12-6.

Example 12-6. UsersInRoleGrid_RemoveFromRole

Protected Sub UsersInRoleGrid_RemoveFromRole( _
ByVal sender As Object, _
ByVal e As System.Web.UI.WebControls. GridViewCommandEventArgs) _
Handles UsersInRoleGrid.RowCommand

   ' get the user to remove
   Dim index As Integer = Convert.ToInt32(e.CommandArgument)
   Dim username As String = _
   CType(UsersInRoleGrid.Rows(index).Cells(0).Controls(0), _
      DataBoundLiteralControl).Text

   ' remove the user
   Roles.RemoveUserFromRole(username, RolesListBox.SelectedItem.Value)
   ' Rebind the users in role to Gridview
   usersInRole = Roles.GetUsersInRole(RolesListBox.SelectedItem.Value)
   UsersInRoleGrid.DataSource = usersInRole
   UsersInRoleGrid.DataBind() 
End Sub

Step 4 is to add the CreateRole_OnClickevent handler, which makes the CreateRole panel visible, as shown in Example 12-7.

Example 12-7. CreateRole button Click event handler

Protected Sub CreateRole_OnClick( _
ByVal sender As Object, _
ByVal e As System.EventArgs) Handles btnCreateRole.Click
    pnlCreateRole.Visible = True
End Sub

The purpose of this is to present the panel, which contains a text box for the user to enter a new role and an Add button, as shown in Figure 12-27.

Figure 12-27.  Create new role

Finally, implement thebtnAddRole_Clickevent handler, shown in Example 12-8.

Example 12-8. AddRole button Click event handler

Protected Sub btnAddRole_Click( _
ByVal sender As Object, _
ByVal e As System.EventArgs) Handles btnAddRole.Click
    If txtNewRole.Text.Length > 0 Then
       Dim newRole As String = txtNewRole.Text

       ' if the role does not already exist, add it
       ' rebind the roles list box
       If Roles.RoleExists(newRole) = False Then
         Roles.CreateRole(newRole)
         rolesArray = Roles.GetAllRoles()
         RolesListBox.DataSource = rolesArray
         RolesListBox.DataBind()
       End If
    End If
    txtNewRole.Text = String.Empty
    pnlCreateRole.Visible = False
End Sub

Check to make sure there is text in the NewRole text box, and then check to make sure the role does not exist. If it does not, create the new role using the Shared CreateRole method of the Roles class, provided by the Framework.

You do not need an instance ofRolesto callCreateRole becauseCreateRole is Shared.

Get all the roles by calling the Shared methodGetAllRolesand store the roles in the member arrayrolesArray, to which you bind the list box. When the role is added, the text box is cleared and the panel is made invisible.

Run the application and click on Manage Roles to add a couple of roles. Next, click on a role (to highlight it) and highlight one or more users; then click Add User(s) to Role. The results are shown in Figure 12-28.

Figure 12-28.  Adding users to roles

Add each user to one or more roles.

Next: Restricting Access to Pages Based on Roles >>
 

More Visual Basic.NET Articles
More By O'Reilly Media

Comments On: Adding Roles to ASP.NET Accounts

· This article is an excerpt from the book "Programming Visual Basic 2005," published...    · This code has helped a lot! Only thing is I'm getting an error that some of the...    · I read this article because I was looking for a way to add membership to my website....    · This excerpted article should explain the term "WAT." I don't know WAT that means. ...   >>> Post your comment now!

Buy this book...

This article is excerpted from chapter 12 of the book Programming Visual Basic 2005, written by Jesse Liberty (O'Reilly, 2005; ISBN: 0596009496). Check it out today at your favorite bookstore. Buy this book now.