Question

my user will use form authentication against Active Directory or database. Theres no Windows Integrated Authentication there!!

What i want is when the user submit the authentication form, it will try to validate the user against Active Directory and if it fail, try with the database.

How can i do that? What i had in mind was to build a custom membership provider that will encapsulate the logic but im not sure how to start.

is there any better idea?

Answer 1

The only way you are going to be able to implement this is by creating a custom provider.

In a perfect world, you could simply create a facade provider and then leverage the appropriate provider, SQL or AD, as necessary, to authenticate and return MembershipUser to whatever degree of completeness you find necessary.

In the real world, this is still possible but you will need to jump through a few hoops:

• create your facade provider and place it first in the providers child element of the membership element AND set it as defaultProvider in the membership element
• properly configure a SqlMembershipProvider and an ActiveDirectoryMembershipProvider and place them after your facade.
• from your facade, access the configured providers from the static Membership.Providers collection to perform the functions as needed.

You may find that you need to repeat this pattern if you need to use roles and while it is applicable, the implementation will be a bit more complex and beyond the scope of this post.

Alternately, full source code for the SQL providers can be found here and are a great starting point and guidance for implementing an industrial grade custom provider.

I would suggest first exploring the path of least resistance (and least labor and headache) and spike a facade before attempting to implement a custom security feature from scratch.

Good luck.