Create a Web Application with a Logon Page

Configure the Web Application for Forms Authentication

Develop Functions to Generate a Hash and Salt value

Create a User Account Database

Use ADO.NET to Store Account Details in the Database

Authenticate User Credentials against the Database

Test the Application

Start Visual Studio .NET and create a new C# ASP.NET Web application called FormsAuthSQL.

Use Solution Explorer to rename WebForm1.aspx to Logon.aspx

Add the controls listed in Table 1 to Logon.aspx to create a simple logon form.

Your Web page should resemble the one illustrated in Figure 1.

Figure 1. Logon page Web form

Set the TextMode property of the txtPassword to Password.

Use Solution Explorer to open Web.config.

Locate the <authentication> element and change the mode attribute to Forms.

Add the following <forms> element as a child of the <authentication> element and set the loginUrl, name, timeout, and path attributes as follows.

<authentication mode="Forms">
  <forms loginUrl="logon.aspx" name="sqlAuthCookie" timeout="60" path="/">
  </forms>
</authentication>

Add the following <authorization> element beneath the <authentication> element. This will allow only authenticated users to access the application. The previously established loginUrl attribute of the <authentication> element will redirect unauthenticated requests to the logon.aspx page.

<authorization>
  <deny users="?" />
  <allow users="*" />
</authorization>

Open Logon.aspx.cs and add the following using statements to the top of the file beneath the existing using statements.

using System.Security.Cryptography;
using System.Web.Security;

Add the following static method to the WebForm1 class to generate a random salt value and return it as a Base 64 encoded string.

private static string CreateSalt(int size)
{
  // Generate a cryptographic random number using the cryptographic
  // service provider
  RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
  byte[] buff = new byte[size];
  rng.GetBytes(buff);
  // Return a Base64 string representation of the random number
  return Convert.ToBase64String(buff);
}

Add the following static method to generate a hash value based on a supplied password and salt value.

private static string CreatePasswordHash(string pwd, string salt)
{
  string saltAndPwd = String.Concat(pwd, salt);
  string hashedPwd =
         FormsAuthentication.HashPasswordForStoringInConfigFile(
                                              saltAndPwd, "SHA1");
  return hashedPwd;
}

On the Microsoft SQL Server programs menu, click Query Analyzer, and then connect to your local SQL Server.

Enter the following SQL script. Note that you must replace "LocalMachine" with your own computer name towards the end of the script.

USE master
GO
-- create a database for the security information
IF EXISTS (SELECT * FROM master..sysdatabases WHERE name = 'UserAccounts')
  DROP DATABASE UserAccounts
GO
CREATE DATABASE UserAccounts
GO
USE UserAccounts
GO
CREATE TABLE [Users] (
  [UserName] [varchar] (255) NOT NULL ,
  [PasswordHash] [varchar] (40) NOT NULL ,
  [salt] [varchar] (10) NOT NULL,
  CONSTRAINT [PK_Users] PRIMARY KEY  CLUSTERED
  (
    [UserName]
  ) ON [PRIMARY]
) ON [PRIMARY]
GO
-- create stored procedure to register user details
CREATE PROCEDURE RegisterUser
@userName varchar(255),
@passwordHash varchar(40),
@salt varchar(10)
AS
INSERT INTO Users VALUES(@userName, @passwordHash, @salt)
GO
-- create stored procedure to retrieve user details
CREATE PROCEDURE LookupUser
@userName varchar(255)
AS
SELECT PasswordHash, salt
FROM Users
WHERE UserName = @userName
GO
-- Add a login for the local ASPNET account
-- In the following statements, replace LocalMachine with your
-- local machine name
exec sp_grantlogin [LocalMachineASPNET]
-- Add a database login for the UserAccounts database for the ASPNET account
exec sp_grantdbaccess [LocalMachineASPNET]
-- Grant execute permissions to the LookupUser and RegisterUser stored procs
grant execute on LookupUser to [LocalMachineASPNET]
grant execute on RegisterUser to [LocalMachineASPNET]

Run the query to create the UserAccounts database.

Exit Query Manager.

Return to Visual Studio .NET and double-click the Register button on the Web form to create a button click event handler.

Add the following code to the method.

string salt = CreateSalt(5);
string passwordHash = CreatePasswordHash(txtPassword.Text,salt);
try
{
  StoreAccountDetails( txtUserName.Text, passwordHash, salt);
}
catch(Exception ex)
{
  lblMessage.Text = ex.Message;
}

Add the following using statement at the top of the file, beneath the existing using statements.

using System.Data.SqlClient;

Add the StoreAccountDetails utility method using the following code. This code uses ADO.NET to connect to the UserAccounts database and stores the supplied username, password hash and salt value in the Users table.

private void StoreAccountDetails( string userName,
                                  string passwordHash,
                                  string salt )
{
  // See "How To Use DPAPI (Machine Store) from ASP.NET" for information
  // about securely storing connection strings.
  SqlConnection conn = new SqlConnection( "Server=(local);" +
                                          "Integrated Security=SSPI;" +
                                          "database=UserAccounts");
  SqlCommand cmd = new SqlCommand("RegisterUser", conn );
  cmd.CommandType = CommandType.StoredProcedure;
  SqlParameter sqlParam = null;

  sqlParam = cmd.Parameters.Add("@userName", SqlDbType.VarChar, 255);
  sqlParam.Value = userName;

  sqlParam = cmd.Parameters.Add("@passwordHash ", SqlDbType.VarChar, 40);
  sqlParam.Value = passwordHash;

  sqlParam = cmd.Parameters.Add("@salt", SqlDbType.VarChar, 10);
  sqlParam.Value = salt;

  try
  {
    conn.Open();
    cmd.ExecuteNonQuery();
  }
  catch( Exception ex )
  {
    // Code to check for primary key violation (duplicate account name)
    // or other database errors omitted for clarity
    throw new Exception("Exception adding account. " + ex.Message);
  }
  finally
  {
    conn.Close();
  }
}

Return to the Logon form and double-click the Logon button to create a button click event handler.

Add the following code to the Logon button click event handler to call the VerifyPassword method and display a message based on whether or not the supplied user name and password are valid.

bool passwordVerified = false;
try
{
  passwordVerified = VerifyPassword(txtUserName.Text,txtPassword.Text);
}
catch(Exception ex)
{
  lblMessage.Text = ex.Message;
  return;
}
if (passwordVerified == true )
{
  // The user is authenticated
  // At this point, an authentication ticket is normally created
  // This can subsequently be used to generate a GenericPrincipal
  // object for .NET authorization purposes
  // For details, see "How To: Use Forms authentication with GenericPrincipal
  // objects
  lblMessage.Text = "Logon successful: User is authenticated";
}
else
{
  lblMessage.Text = "Invalid username or password";
}

On the Build menu, click Build Solution.

In Solution Explorer, right-click logon.aspx, and then click View in Browser.

Enter a user name and password, and then click Register.

Use SQL Server Enterprise Manager to view the contents of the Users table. You should see a new row for the new user name together with a generated password hash.

Return to the Logon Web page, re-enter the password, and then click Logon. You should see the message "Logon successful: User is authenticated."

Now enter an invalid password (leaving the user name the same). You should see the message "Invalid username or password."

Close Internet Explorer.