Click here to Skip to main content
15,891,926 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am creating an mvc application in vb.net in which I am trying to map certain fields to certain users so that it is specific to individual users. I have four SQL tables connected that are involved in the mapping. They are UserTable, ClientTable, ProjectTypeTable and IssueTable.

What I am trying to do is this: A user with the ID of one will log on, I get this ID and match it with the userID in the ClientTable to get the correct user for that client. Once I get that I will get the ClientID and match it with the ProjectTypeTable to get the multiple correct projectTypes, eg a client can have 1-8 projects available to them. The IssueTable will have the selected projectType.

I have created a ViewModel which looks like this:

VB
Public Class ClientViewModel
    Public proTable As List(Of ProjectType)
    Public cTable As ClientTable
    Public uTable As UserTable
    Public iTable As IssueTable
End Class


What I planned to do is retrieve the userID when the user logs on and pass it to other views in session state so that the correct userID is kept through out the project until they log out. Here is what I have tried:

VB
Dim uTable As SQLDatabase = New SQLDatabase()
Dim getUserID = (From data In uTable.UserTables Where data.username = user.username AndAlso data.userPassword = user.userPassword Select data.userID)

If (userdetailLocal.Count() > 0) Then
Session("userIDData") = getUserID.ToString()

Then in the submit controller I have this:

VB
Dim getuserID = Session("userIDData")
Dim userModel = New IssueTracker.ClientViewModel()
userModel.cTable = dbServer.ClientTables.Where(Function(x) x.userID = "")
'the speech marks will be the userID retrieved from the session state
userModel.proTable = dbServer.ProjectTypes.Where(Function(x) x.client = "").ToList()
'the speech marks will be the clientID retrieved from the session state


The problem I am having is that I am not actually getting the ID, is this a good way to map the users to specific fields? The ID's do not have to be sent across via session state that was the last thing I tried. How can I do this correctly?
Posted
Updated 27-Jul-15 4:16am
v2
Comments
Richard Deeming 27-Jul-15 10:10am    
You're storing passwords in plain text. That's a very bad idea. You should only ever store a salted hash of the user's password.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]
Ciaran82 27-Jul-15 10:16am    
I am not storing the passwords in plain text I just have not the code for the hashing involved in the question as it is irrelevant to this question and do not want to overload this question
Richard Deeming 27-Jul-15 10:18am    
OK, that's good. :)

I assume you're using a unique salt for each record? The data.userPassword = user.userPassword condition in your query makes it look like you're not.
Ciaran82 27-Jul-15 10:25am    
Yes it have it done I just have it split up into parts for testing purposes, I just so not want the question to fill up with code than is not necessary but yet the password protection is done the way my employers want it to be done.

1 solution

If I understand the question correctly, I wouldn't use different tables for different users. In my opinion the tables should be the same but you can add a column into each table where you place the user id to separate rows for different users. These columns should be foreign keys pointing to user table.

Some notes for the code.

  • You fetch a value to getUserID variable but the value you fetch is the username. Should this be some other field?
  • I hope that the password isn't saved as plain text but handled properly and cannot be seen in any case, even in the database
  • When you fetch the ctable you use an empty string in the condition, not the userid from the session
 
Share this answer
 
Comments
Ciaran82 27-Jul-15 10:23am    
Yes the getUserID value was meant to be userID instead of username I fixed that (that wasn't the problem it was I forgot to change it back when I was trying something different). I am the password protection done the way my employers have it I just have not it in the question, the reason the cTable is fetching an empty string is because the value the session state is not bringing over the value I want correctly because I assume I am doing it incorrectly. I want the empty string to be equal to the variable id retrieved from the session state value.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900