Click here to Skip to main content
13,145,774 members (55,488 online)
Click here to Skip to main content
Add your own
alternative version


1 bookmarked
Posted 11 Oct 2013

Creating a custom membership provider

, 11 Oct 2013
Rate this:
Please Sign up or sign in to vote.
When working with an ASP.NET site that requires some sort of user authentication (almost every time, I'd say), we often need to establish our own

Editorial Note

This articles was originally at but has now been given a new home on CodeProject. Editing rights for this article has been set at Bronze or above, so please go in and edit and update this article to keep it fresh and relevant.

When working with an ASP.NET site that requires some sort of user authentication (almost every time, I'd say), we often need to establish our own logic, and use our own database instead of the one provided by ASP.NET (with our own data model or stuff).

There are basically two reasons why you'd want to create a custom membership provider class:

  • You wish to store your membership information in a database different from the one ASP.NET provides (which is an SQL Server Express database), like an Oracle or MySQL database or a Web Service.
  • You wish to store your membership information in an SQL Server database whose schema (data model) differs from the default one used by the System.Web.Security.SqlMembershipProvider class. An example of this would be if our company already has a shared membership SQL Server database for all applications. 

Given this, it's pretty likely you'll have to create your own membership class, and here's one way to do it:

First of all, implement a class that inherits from the abstract class System.Web.Security.MemershipProvider. This class, as well, inherits from another abstract class,  System.Configuration.Provider.ProviderBase, so we should implement those methods as well. Basically, what needs to be created is a class with the following definition:

public class MyProvider : MembershipProvider

After that, we need to initialize (implement) the class variables used by the base class, setting each one to the value required by our business logic:
<br />//Minimun password length<br />private int minRequiredPasswordLength = 6;<br />//Minium non-alphanumeric char required<br />private int minRequiredNonAlphanumericCharacters = 0;<br />//Enable - disable password retrieval<br />private bool enablePasswordRetrieval = true;<br />//Enable - disable password reseting<br />private bool enablePasswordReset = false;<br />//Require security question and answer (this, for instance, is a functionality which not many people use)<br />private bool requiresQuestionAndAnswer = true;<br />//Application name<br />private string applicationName = "MYAPP";<br />//Max number of failed password attempts before the account is blocked, and time to reset that counter<br />private int maxInvalidPasswordAttempts = 3;<br />private int passwordAttemptWindow = 10;<br />//Require email to be unique <br />private bool requiresUniqueEmail = true;<br />//Password format<br />private MembershipPasswordFormat passwordFormat = new MembershipPasswordFormat();<br />//Regular expression the password should match (empty for none)<br />private string passwordStrengthRegularExpression = String.Empty;<br /><br />Next, implement all the methods you need, with your own custom logic:
<br />public override bool ValidateUser(string username, string password)<br />{<br />//For our example, user will be authenticated if username and password are the same<br />return username == password;<br />}<br /><br />If by any chance you decide not to implement any of the base class methods (and not use the base logic, either), just throw a new NotImplemetedException:
<br /><br />public override string GetUserNameByEmail(string email)<br />{<br />throw new NotImplementedException();<br />}<br /><br />The final step is to modify our Web.config file:
<br /><configuration><br /><system.web><br />...<br />...<br />...<br />...<br /><membership defaultprovider="MyProvider"><br /><providers><br /><add type="MyProvider" name="MyProvider"><br /></providers><br /></membership><br /></system.web><br /></configuration><br /><br />This is obviously an alternative that requires time and work, but if well implemented, it's sure worth it.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

ASP.NET Community
United States United States
This member doesn't quite have enough reputation to be able to display their biography and homepage.
Group type: Collaborative Group

765 members

You may also be interested in...


Comments and Discussions

-- There are no messages in this forum --
Permalink | Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.170915.1 | Last Updated 11 Oct 2013
Article Copyright 2013 by ASP.NET Community
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid