I can’t imagine that there doesn’t exist an efficient, lightweight, secure authentication and authorization library for ASP.NET applications that is easy to use in e.g. your controllers and views. I read tons of articles and I performed a zillion searches, but did not find one yet. Does anyone know of such a library? Or did anyone create one himself and is willing to share?
The ASP.NET authentication system is mainly based on the Username rather than on UserId. I really don’t understand that. Imagine you want to create a blog with comments. A user can register and post a comment. Two well-known MVC examples (Nerddinner and MVC Music Store) use the default asp.net authentication system (membershipprovider / identy / principal etc.) and use the Username to store the user that belongs to some object, e.g. “HostedBy”-field.
To me, this seems not a very good practice:
-
It’s not possible to change username without having to change all the related records.
-
Why not us an int as Id? You need just 8 bytes to store 16 million users. Unless you limit the username to 8 byte-characters, it is less efficient in terms of storage space.
-
A string-based relationship seems not very efficient, as string based lookups are slower than integer based lookups.
Oke, I can imagine why you want to use a Guid and not an int, because that is virtually impossible to guess and to remember and that could increase security in some way; if that’s the reason, that’s fine to me.
But, then remains the question why the IIdentity interface makes just the Username available and NOT the UserId. If you use the UserId as foreign key, it’s hard to e.g. fetch a list of all the posts of the current logged in user: you always need a database lookup to fetch the UserId that belongs to the username.
Another thing I wonder about is that the authentication system seems rather bloated. My best guess is that at at most 90% of the users will use an authentication system for just one application. So, why create default functionality to make it capable of serving multiple applications? (the application column in aspnet_Users).
If you don’t care about these things, it’s might be allright, but, I want to prepare for 16+ million users, don’t you? Or, I want to server my pages under 50ms… So.. why the heck did Microsoft build the default authentication system this way? It seems pretty bloated and crappy to me.
A related question (which doesn’t give answer to mine):
How can I access UserId in ASP.NET Membership without using Membership.GetUser()?
OK, you dislike the ASP.NET Membership Provider. If you’re an NHibernate shop, then you could take a look at Rhino Security by Ayende Rahien.