Custom Membership Provider

Topics: General
Jul 8, 2011 at 1:09 PM

Hi, I would like to know if its possible to use a custom provider for logging into composite itself, overriding the standard users. This would ideally read from an SQL (since I already have a large database of users from another website). I am new to Composite so any help would be appreciated. Thanks!

Coordinator
Jul 11, 2011 at 9:16 AM

Hi @naibla The security related logic isn't completly separated. You can make it work by:

1) Copying users from your database to C1's database. That would be something like

using(var conn = new DataConnection()) {
   foreach(User user in myUserDatabase) {
      Guid userId = user.Id;

      // Checking whether the user already exists
      if(conn.GetData<IUser>(u => u.Id == userId).Any()) continue;
    
      var newUser = conn.New<IUser>();
      newUser.Id = userId;
      newUser.Username = ...;
      ...
      conn.AddNew(newUser);

      // Assigning user group rights
      var roleAssigment = conn.New<IUserUserGroupRelation>();
      roleAssigment.UserId = userId;
      roleAssigment.UserGroupId = ... /* Id of a user group which rights should be inherited */;
      conn.AddNew(roleAssigment);
   }
}


If password aren't encrypted in your User database, that would be the only step. Just execute this code f.e. on every startup to keep user databases syncronyzed

2) If passwords are hashed, you need to override password validation logic.


Create a custom Composite.dll version, in which interface Composite.C1Console.Security.Plugins.LoginProvider.IFormLoginProvider and class DataBasedFormLoginProvider are public (not internal as it is now)

Create a class which implements IFormLoginProvider and inherits DataBasedFormLoginProvider, overridethe method that validates passowords  
Edit Composite.config, Configure Composite.C1Console.Security.Plugins.LoginProviderConfiguration to use the new provider

<Composite.C1Console.Security.Plugins.LoginProviderConfiguration defaultLoginProviderPlugin="DataBasedFormLoginProvider">
    <LoginProviderPlugins>
      <add name="AllWindowsLoginProvider" type="Composite.Plugins.Security.LoginProviderPlugins.ValidateAllWindowsLoginProvider.ValidateAllWindowsLoginProvider, Composite" />
      <add name="DataBasedFormLoginProvider" type="Composite.Plugins.Security.LoginProviderPlugins.DataBasedFormLoginProvider.DataBasedFormLoginProvider, Composite" />
      <add name="FormLoginProvider" type="Composite.Plugins.Security.LoginProviderPlugins.ConfigBasedFormLoginProvider.ConfigBasedFormLoginProvider, Composite">
        <ValidLogins>
          <add password="19A2768D-429C-41e0-8969-E80ECB1D9829" name="admin" />
        </ValidLogins>
      </add>
    </LoginProviderPlugins>
  </Composite.C1Console.Security.Plugins.LoginProviderConfiguration>


It was done at least once by @burningice, so it should work

Jul 11, 2011 at 3:43 PM

Thank you so much! I will give it a shot.

Jul 12, 2011 at 3:23 PM
Edited Jul 12, 2011 at 3:52 PM

I've been having trouble getting it to run at start up. I followed the instructions here: http://docs.composite.net/C1/Releasehistory/NewFeatures.aspx?ID=1984

and to some extent here: http://docs.composite.net/C1/Console/ConsoleFAQ.aspx?q=How+to+create+scheduled+tasks+in+C1%3F

 

Currently, when I reboot Composite, nothing happens.

I put the dll in /bin, but do I need to reference it in the web.config? If so, where?

EDIT: Fixed it, I had not made the OnBeforeInitialize() and OnInitialized() public :p