Question

I have a site that uses the SqlMembershiprovider. Its is a webshop. The user logs on with his username and password there.

Apart from that there is controller that is responsible for displaying delivery details for orders, that are imported from another system. These orders have no connection to users in the membershipsystem. To display delivery details you have to give the ordernumber and a token that is printed on the invoice.

To allow access I would like to implement a custom membershiprovider that is used only for this single controller. Is it feasible to use 2 different providers for one application?

EDIT

There are a couple of pages that the user can access once he provided the ordernumber and token.

Answer 1

I don’t think you need a separate membership provider. Just make that action and associated actions public (don’t decorate with the AuthorizeAttribute). Then require that the order number and invoice token provided be valid. That is, if you have the order number and it’s associated token, then you get to display the delivery details. You can check this by just verifying that they match in the data provided by the other system.

[AcceptVerbs( HttpVerbs.Post )]
public ActionResult DeliveryDetails( string orderNumber, string invoiceToken )
{
      var order = otherDb.Orders
                         .Where( o => o.OrderNumber == orderNUmber
                                      && o.InvoiceToken == invoiceToken )
                         .SingleOrDefault();

      if (order == null)
      {
          return View("Error");
      }

      return View(order);
}