Guru Sarkar's Blog

CreateUserWizard - DuplicateUser Error Message not getting clear - Part 2 (jQuery)

2009-10-30T17:59:00Z

Problem:

In Part-1 I tried to solve this problem using JavaScript. Here I will share the code to do the same using jQuery.

If you are new to jQuery, I will suggest you to first go through THIS short and sweet article to begin with before jumping to this code.

To get to know the background please refer Part-1.

So lets see what needs to be done to solve this problem using jQuery.

Steps:

1. Setup your page to use jquery. How-To ?

2: Convert CreateUserStep to Template. Sample ClickHere.

3: Find LiteralControl named ErrorMessage ...change it to Lable Control:

<td align="center" colspan="2" style="color:Red;">

<asp:Label ID="ErrorMessage" runat="server" CssClass="errmsg" EnableViewState="False"></asp:Label>

</td>

Note I added CssClass="errmsg". You don't need to have that class in your stylesheet. It is just what we will use to find this button in jQuery.

4: Convert CUW to CustomNavigationTemplate . This is to get CreateUser button in .aspx source.

5: Add CssClass to Create Button like below:

<CustomNavigationTemplate>

<table border="0" cellspacing="5" style="width:100%;height:100%;">

<tr align="right">

<td align="right" colspan="0">
<asp:Button CssClass="btncreate" ID="StepNextButton" runat="server" CommandName="MoveNext"
Text="Create User" ValidationGroup="CreateUserWizard1" />

</td>

</tr>

</table>

</CustomNavigationTemplate>

Again Note I added CssClass="btncreate". You don't need to have that class in your stylesheet. It is just what we will use to find this label in jQuery.

6: jQuery Code:

<script type="text/javascript"> function clearMsg(id)
{
var lbl = document.getElementById(id);
lbl.innerHTML="";
lbl.innerText="";
};
$(document).ready(function() {
$(".btncreate").click(function() {
var id = $('.errmsg').attr('id');
if (id != null) {
clearMsg(id);
}

});

});

</script>

So what we are doing in jQuery code in Step 6 ??

Simply we are telling what to do when create Button is clicked, but in jQuery manner. Note we are using "btncreate" i.e. Css Class name to reference the Create Button. Then on click event of that button we are getting 'id' of the ErrorMessage Label and passing it to our function clearMsg. This function (clearMsg) gets the label using the id passed to it and clear its innerHTML and innerText.

Conclusion:

This is another way to clear the ErrorMessage set by server-side in CreateUserWizard. This code looks more complex than the one in part 1.

I have not gone into details of how jQuery works. Sorry for being so lazy to write in more detail. Thanks for your time.

CreateUserWizard - DuplicateUser Error Message not getting clear - Part 1

2009-10-20T16:33:00Z

Problem:

This problem with CreateUserWizard(CUW) was pointed by David(haggis999) here.

When you try to Create a new user, CUW will display a message if the user with the same username already exists i.e. somebody took that username. Also the password fields will be cleared upon postback. Now change the username to something else but do not enter anything in the password fields. Now click the CreateUser button. You will see that there will be two * (asteriks) next to the password fields. Note the Duplicate User error message still exists. This is a kind of confusing for the user that the second username is also taken but in reality there was no check made for this second username and the error message displayed is from the pervious check.

Note: I am taking DuplicateUser error message as an example but it could be any other message that is set by server-side. e.g. Minimum Password Length 7 etc.

Background

Now whats going on behind the scene. The username check is done on the Server-side. Upon the first CreateUser click the 'User already exists" message is displayed. But when you click the second time without entering the password the RequiredFieldValidators are at work. That work is done on client side. So still the second click has not reached the server at all. And CUW does not have any mechanism to clear the "User already exists" on client-side. It gets cleared only if the request hits the server and determines no other error and/or there is no duplicate username in the DB.

So we are left to clear that error on client-side ourself. Lets see how we will do that via JavaScript.

Steps:

1: Convert CreateUserStep to Template. Sample ClickHere.

2: Find LiteralControl named ErrorMessage ...change it to Lable Control:

<td align="center" colspan="2" style="color:Red;">

<asp:Label ID="ErrorMessage" runat="server" EnableViewState="True"></asp:Label>

</td>

3: Convert CUW to CustomNavigationTemplate . This is to get CreateUser button in .aspx source.

4: Set the OnClientClick property like below:

<CustomNavigationTemplate>

<table border="0" cellspacing="5" style="width:100%;height:100%;">

<tr align="right">

<td align="right" colspan="0">
<asp:Button class="clsTest" ID="StepNextButton" runat="server" CommandName="MoveNext"
Text="Create User" OnClientClick="clearMessage()" ValidationGroup="CreateUserWizard1" />

</td>

</tr>

</table>

</CustomNavigationTemplate>

5: Add this javascript function to your code:

<script type="text/javascript">
function clearMessage() {
var id = 'CreateUserWizard1_CreateUserStepContainer_ErrorMessage'; //IMPORTANT.Read the 'Points to Note'
var lblError = document.getElementById(id);
if (lblError != null) {
lblError.innerHTML = "";lblError.innerText = "";
}

}

</script>

Points to Note:

There is a limitation to the above code. If you see the var id = 'CreateUserWizard1_CreateUserStepContainer_ErrorMessage'; looks something weird. But if you know asp.net does this work of changing the id of your control. Since the Label ErrorMessage is within the CreateUserStep of the CUW1, it gets this id. So say if your CUW is withing a MasterPage ContentPlaceHolder then your id would be something like this: 'ctl00_ContentPlaceHolder1_CreateUserWizard1_CreateUserStepContainer_ErrorMessage'.

Since the code above has the hardcoded value for this label it will not work if your CUW is inside the MasterPage. So here is what you can do.

Open your page in browser. Right Click and ViewSource of the page. Find your Label ErrorMessage. Get the 'id' and change the above code to reflect the id to your own.

var id = //Get this as mentioned above;

Conclusion:

This is not a robust solution but will work. There is a way to use ClientID of the control in JavaScript which I did not try. One other way is using jQuery which I will demonstrate in another blog article.

Also this is just one such problem. There are, I believe, similar error display issues with CUW. Feel free to point out.

Thanks for reading. I know there is a room for improvement so feel free to comment.

LoginName Control to Display Full Name instead of username

2009-06-16T21:38:00Z

Question:

How do I modify the text in LoginName Control.
I want to display "Full Name" of the currently logged-in User but the LoginName control displays the username (User Id) that user uses to login.
I want to display Full Name along with username in LoginName.

What value LoginName Control displays?

MSDN: "Displays the value of the System.Web.UI.Page.User.Identity.Name property."

So by default with FormsAuthentication it will LoginName will display the username that user used to login. And with Windows Authentication the currenlty logged-in Windows UserName.(Assuming Anonymous Identification is OFF and site requires Login)

LoginName.FormatString Property

Yes, FormatString property of LoginName is what you can use to Modify the text that is displayed.

MSDN: "The FormatString property contains a standard text format string that displays the user's name on the Web page. The string "{0}" indicates where in the string the user's name is inserted."

Suppose you are logged-in as "johndoe". Below are some sample values for FormatString and the corresponding OutPut.

FormatString	Output
----------------------	--------------
"{0}" (i.e default)	johndoe
Empty i.e. not defined	johndoe
"Welcome, {0}"	Welcome, johndoe
"Welcome to my site"	Welcome to my site

What do we get from that?

So now if you want to display Full Name of the user who is logged-in inside LoginName control then in the page_Load of the page (Could be a MasterPage) you should set the FormatString Property like below:

<asp:LoginName ID="LoginName1" runat="server" />

protected void Page_Load(object sender, EventArgs e)

{

//this can come from anywhere like session, database

string fullName = "ABC XYZ";

LoginName1.FormatString = "{0}" + " - " + fullName ; //output: johndoe - ABC XYZ

LoginName1.FormatString = fullName; // output: ABC XYZ

}

Yes, thats it. Play around it to display as you want.

Thanks for reading.

References:

Hide a Parent Node in TreeView if there is No ChildNodes

2009-06-09T15:49:00Z

Scenario:

Say you have a TreeView that is populated based on the logged-in user role. There could be case when there are no chilc nodes for a particular parent node because user does not have access to the pages under that node. So in that case a parent node will appear without any child-nodes. What we want to do is we want to hide a node if it does not have any child nodes and that node is not a Leaf node (Note: Leaf nodes don't have childnodes).

Background:

I have a TreeView and SiteMapDatasource on my .aspx page. Web.config has siteMapProvider settings and a SiteMap file (Web.sitemap).

Now let the code speak.

.aspx file:

<asp:TreeView ID="TreeView1" runat="server" AutoGenerateDataBindings="False" DataSourceID="SiteMapDataSource1"
ontreenodedatabound="TreeView1_TreeNodeDataBound">

</asp:TreeView>

<br />

<asp:SiteMapDataSource ID="SiteMapDataSource1" runat="server" />

Above is .aspx file with controls for this example. You should note we have a event handler for OnTreeNodeDataBound event of TreeView.

Web.config:

<siteMap defaultProvider="XmlSiteMapProvider" enabled="true"> <providers>
<add name="XmlSiteMapProvider" type="System.Web.XmlSiteMapProvider"
siteMapFile="Web.siteMap" securityTrimmingEnabled="true"/> </providers>
</siteMap>

Part of web.config is shown above with SiteMapProvider. Note we have siteMapFile="Web.sitemap" and securityTrimmingEnabled="true" for Roles to be applied to the sitemap.

Web.SiteMap:

<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
<siteMapNode url="~/Default.aspx" title="Home" description="Home">
<siteMapNode url="~/Level1.aspx" title="Level 1" description="" >
<siteMapNode url="~/Page1.aspx" title="Page1" description="" />
<siteMapNode url="~/Page2.aspx" title="Page2" description="" />
</siteMapNode>
<siteMapNode url="~/NoChilde.aspx" title="Level 2" description="" />
<siteMapNode url="~/Level3.aspx" title="Level 3" description="" >
<siteMapNode url="~/Page3.aspx" title="Page3" description="" />
</siteMapNode>
</siteMapNode>
</siteMap>

The above sitemap is not very realistic looking but will serve the purpose for our demonstration. We see that siteMapNode "Level 2" does not have any childnode. So we want to hide it and not show in our TreeView. In real case scenario it might have few child nodes with Roles attribute set. If user is not in particular role the SiteMapProvider will hide those node.

Without the code-behind which we are going to see in a moment the TreeView will look like below:

We now want to hide "Level 2" node as it does not have any child node.

.aspx.cs file (code-behind):

protected void TreeView1_TreeNodeDataBound(object sender, TreeNodeEventArgs e)
{
SiteMapNode node = (SiteMapNode)e.Node.DataItem;if(node.HasChildNodes ==false && e.Node.Depth ==1)
{

TreeView1.Nodes[0].ChildNodes.Remove(e.Node);

}

}

In the above code what we are doing is first getting the DataItem for the CurrentNode that is being DataBound. For this we have to use SiteMapNode.

1: we check if the node has Child with node.HasChildNodes ==false.

2: "Home" is at Depth 0 while Level 1,2 and 3 are at Depth 1 and Page1,Page2 and so on are at Depth=2. So to make sure that we are not hiding Home or any leaf nodes (page1,Page2 etc) we are checking that depth of current Node is 1.

If the above two conditions are met then we will remove the current node (i.e. e.Node) from TreeView1.

For this we first get the NodesCollection for TreeView1. i.e. TreeView1.Nodes[0], Here 0 is because we have all Nodes under "Home" parent Node.

After that we call the ChildNodes.Remove method to remove the current Node.

That is it. Now if we run the code we will get the following output for TreeView:

ShowStartingNode=False set for SiteMapDataSource:

If you set the ShowStartingNode=False for SiteMapDataSource then you might want to chage the Depth=0 and also make little change on how to remove node.

The code should look like below:

protected void TreeView1_TreeNodeDataBound(object sender, TreeNodeEventArgs e)
{
SiteMapNode node = (SiteMapNode)e.Node.DataItem;if(node.HasChildNodes ==false && e.Node.Depth ==0)
{

TreeView1.Nodes.Remove(e.Node);

}

}

Thats it. Thanks for reading this article.

Passing Value to an OnCheckedChanged Event Handler of asp.net Checkbox Control

2009-05-11T20:58:00Z

Scenario

In one of our project we have a custom CompositeDataBoundControl. I am binding the control with my custom objects collection and displaying records in <li>.

Each record has One of the <li> that is hidden and contains the UniqueID to identify the record and another <li> has a checkbox that will display boolean value. Now I wanted to update the record with true or false when I check / uncheck the checkbox in my custom control.

Below is my sample control which is to demonstrate the scenario. So if you just copy-paste the code its not going to work. As the purpose is to focus on checkbox and passing value.

<cc1:MyCustomControl Width="100%" runat="server" ID="MyCustomControl1" itemPlaceHolder="itemPlaceHolder1" >

<asp:PlaceHolder runat="server" ID="itemPlaceHolder1"></asp:PlaceHolder>

</LayoutTemplate>

<ul>

<li >First Name</li>

<li >Active</li>

</ul>

</div>

</HeaderTemplate>

<div >

<ul >

</ul>

</div>

</CustomerControlTemplate>

<span>No Data Available.</span>

</EmptyDataTemplate>

</cc1:MyCustomControl >

Now what we want is when I Check or UnCheck then chbActive the corresponding record should be updated in the database. For this to happen I must get the CustID and pass chbActive.Checked to the Database.

Below is the code for chbActive_OnCheckedChanged which is the main part you might be looking for.

protected void cbbActive_OnCheckedChanged(object sender, EventArgs e)

{

CheckBox chbActive = (CheckBox)sender;

HtmlGenericControl li = (HtmlGenericControl)chbActive.NamingContainer.FindControl("CustID");

int CustID = Convert.ToInt32(li.InnerText.ToString());

bool active = chbActive.Checked;

//Now you have two important values

//Pass it to your update query or as a parameters to your stored Proc to update the corresponding record.

}

The core of this code is:

CheckBox chbActive = (CheckBox)sender;
HtmlGenericControl li = (HtmlGenericControl)chbActive.NamingContainer.FindControl("CustID");

int CustID = Convert.ToInt32(li.InnerText.ToString());

-- Get Reference to the CheckBox

-- Get reference to the <li> that contains the CustID. In the mark-up see we have an ID and runat="server" for your hidden <li>.

-- Get the InnerText of the CustID <li>.

Also worth noting in mark-up:

--- AutoPostBack is set to true.

--- runat="server" and id attributes are set

I know I did not explain a lot but hope the code will speak for itself.

Thanks to the following resources that helped me find answer to my problem.

References:

Customize CreateUserWizard Control with dropDownList for PasswordQuestion

2009-01-30T23:48:00Z

Basic Steps:

Add CreateUserWizard Control to the aspx page (e.g.CreateUser.aspx)
Convert it to Template by customizing the CreateUserStep
Remove the Question TextBox control and add a dropdownList.
Make appropriate name and validation changes
Add CreatingUser event handler to CreatUserWizard Control

Here is the code.

Part of CreateUserWizard markup showing the Password Question Dropdownlist:

<tr>

<td align="right">

<asp:Label ID="QuestionLabel" runat="server" AssociatedControlID="QuestionDDL">Security Question:</asp:Label></td>

<td>
<asp:DropDownList ID="QuestionDDL" runat="server" Width="155px">
</asp:DropDownList>

<asp:RequiredFieldValidator ID="QuestionRequired" runat="server" ControlToValidate="QuestionDDL"

ErrorMessage="Security question is required." ToolTip="Security question is required."

ValidationGroup="CreateUserWizard1" InitialValue="Select a Question">*</asp:RequiredFieldValidator>

<asp:TextBox ID="Question" runat="server" Enabled="False" Visible="False"></asp:TextBox>

</td>

</tr>

The PageLoad event handler for CreateUser.aspx:

protected void Page_Load(object sender, EventArgs e)
{
if (!IsPostBack)
{

//Create a questions arraylist for this sample

//In real-world you would like to get this from some data store
ArrayList pwdQuestion = new ArrayList();
pwdQuestion.Add("Select a Question");
pwdQuestion.Add("Q1");
pwdQuestion.Add("Q2");
pwdQuestion.Add("Q3");
//Get reference to Questions DropDownList inside CUW and bind it to the datasource
DropDownList Questionddl = (DropDownList)CreateUserWizardStep1.ContentTemplateContainer.FindControl("QuestionDDL");
Questionddl.DataSource = pwdQuestion;

Questionddl.DataBind();

}

}

Code for CUW's CreatingUser event handler:

protected void CreateUserWizard1_CreatingUser(object sender, LoginCancelEventArgs e)
{
DropDownList Questionddl = (DropDownList)CreateUserWizardStep1.ContentTemplateContainer.FindControl("QuestionDDL");
CreateUserWizard1.Question = Questionddl.SelectedValue;

}

The code is almost self-Explanatory.

Points to Note:

Note we have not removed the Question TextBox but set its Visible property to False. The reason is if we set requiresQuestionAndAnswer="true" in the web.config for the membership provider and remove the TextBox, we will get an exception that it cannot find TextBox control for Password Question.
You might want to tweak a bit in your code for Validation to work when you are getting values from Database for the dropdownlist.

Storing User Profile into a Custom Table using CreateUser Wizard control

2009-01-27T22:36:00Z

I discussed how you can add extra controls to CreateUserWizard(CUW) Control in the blog post HERE.

Assuming you have gone through the post above, what we will do here is store this extra information collected in CUW into a custom database.

Other option is storing in asp.net Profiles. Check References section at the end to see how to store user information in profiles.

Add Extra Fields to CUW Control:

Lets say we want to collect FirstName and LastName of the User while creating a user.With the help of previous post add two textboxes namely FirstName and LastName. Add Validation controls accordinly.

Create a Custom Table to store User Profile(here FirstName and LastName)

Add a new Table to your Membership Database. Here I have named it User_Profile.
Add 3 columns namely UserId - type uniqueidentifier, FirstName - type varchar(50) and LastName - type varchar(50)
Set UserId as Primary Key
Create a Foreign key relationship between UserId of User_Profile table and aspnet_Users table. You can look sample example screenshots here.

So once you have your table ready to store the information lets go ahead and look at the code how to insert values into it.

Inserting FirstName and LastName into User_Profile

We will use the CreatedUser event of CUW control to do this job. In the design Mode, double click the Create User button. In the code behind for CreateUser page you will see an event handler added for CreatedUser event. Here is the code that says the rest:

protected void CreateUserWizard1_CreatedUser(object sender, EventArgs e)

{

// Get the UserId of the just-added user

MembershipUser newUser = Membership.GetUser(CreateUserWizard1.UserName);

Guid newUserId = (Guid)newUser.ProviderUserKey;

//Get Profile Data Entered by user in CUW control

String FirstName = ((TextBox)CreateUserWizard1.CreateUserStep.ContentTemplateContainer.FindControl("FirstName")).Text;

String LastName = ((TextBox)CreateUserWizard1.CreateUserStep.ContentTemplateContainer.FindControl("LastName")).Text;

// Insert a new record into User_Profile

// Get your Connection String from the web.config. MembershipConnectionString is the name I have in my web.config

string connectionString = ConfigurationManager.ConnectionStrings["MembershipConnectionString"].ConnectionString;

string insertSql = "INSERT INTO User_Profile(UserId,FirstName, LastName) VALUES(@UserId, @FirstName, @LastName)";

using (SqlConnection myConnection = new SqlConnection(connectionString))

{

myConnection.Open();

SqlCommand myCommand = new SqlCommand(insertSql, myConnection);

myCommand.Parameters.AddWithValue("@UserId", newUserId);

myCommand.Parameters.AddWithValue("@FirstName", FirstName);

myCommand.Parameters.AddWithValue("@LastName", LastName);

myCommand.ExecuteNonQuery();

myConnection.Close();

}

Most of the code is self-explanatory. We get the UserId of the newly created user and the values in FirstName and LastName textboxes.

Then its simple sql database insertion code.

NOTE: Make sure you have --> oncreateduser="CreateUserWizard1_CreatedUser" set in your CUW Markup (aspx). If is it not set this custom CreatedUser event handler will not be executed. So the user will be created in your DB but the profile data will not be updated as the code above is not executed at all. Check HERE what I mean.

Concerns:

We haven't taken into consideration one scenario. What if something goes wrong between UserCreation and storing profile. i.e. User is created successfully but Profile does not get stored. May be we will discuss that in some other article.
You can add exception handling.

Thanks for reading.

References:

Storing Additional User Information: http://www.asp.net/learn/security/tutorial-08-cs.aspx
ASP.NET Profiles: http://dotnet-friends.com/tutorials/asp/tutinasp97d3c33a-53a2-4a03-a9c4-30920e0b7feb.aspx

Adding additional controls to CreateUserWizard (CUW) Control

2008-12-05T18:05:00Z

Nothing fancy or new in this post.

CreateUserWizard(CUW) control comes with some default controls for entering UserName,Password, ConfirmPassword, Email, etc. Sometimes you might want to add additional controls eg. for storing Firstname,LastName,CompanyName, etc.

Here is how you can add these additional controls. IDE used is Visual Studio 2005.

Drag and drop a CUW in the designer Panel.
Selet the Control.
Select the small arrow on top right corner of the contol
Select the 'Customize Create User Step'

Now Switch to the Source view. You will find the markup for the CreateUserWizard as below:

<asp:CreateUserWizard ID="CreateUserWizard1" runat="server">

<asp:CreateUserWizardStep ID="CreateUserWizardStep1" runat="server">

<tr>

</tr>

<tr>

<asp:Label ID="UserNameLabel" runat="server" AssociatedControlID="UserName">User Name:</asp:Label></td>

<td>

<asp:TextBox ID="UserName" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="UserNameRequired" runat="server" ControlToValidate="UserName"

ErrorMessage="User Name is required." ToolTip="User Name is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:Label ID="PasswordLabel" runat="server" AssociatedControlID="Password">Password:</asp:Label></td>

<td>

<asp:TextBox ID="Password" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="PasswordRequired" runat="server" ControlToValidate="Password"

ErrorMessage="Password is required." ToolTip="Password is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:Label ID="ConfirmPasswordLabel" runat="server" AssociatedControlID="ConfirmPassword">Confirm Password:</asp:Label></td>

<td>

<asp:TextBox ID="ConfirmPassword" runat="server" TextMode="Password"></asp:TextBox>

<asp:RequiredFieldValidator ID="ConfirmPasswordRequired" runat="server" ControlToValidate="ConfirmPassword"

ErrorMessage="Confirm Password is required." ToolTip="Confirm Password is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:Label ID="EmailLabel" runat="server" AssociatedControlID="Email">E-mail:</asp:Label></td>

<td>

<asp:TextBox ID="Email" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="EmailRequired" runat="server" ControlToValidate="Email"

ErrorMessage="E-mail is required." ToolTip="E-mail is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:Label ID="QuestionLabel" runat="server" AssociatedControlID="Question">Security Question:</asp:Label></td>

<td>

<asp:TextBox ID="Question" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="QuestionRequired" runat="server" ControlToValidate="Question"

ErrorMessage="Security question is required." ToolTip="Security question is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:Label ID="AnswerLabel" runat="server" AssociatedControlID="Answer">Security Answer:</asp:Label></td>

<td>

<asp:TextBox ID="Answer" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="AnswerRequired" runat="server" ControlToValidate="Answer"

ErrorMessage="Security answer is required." ToolTip="Security answer is required."

ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

<tr>

<asp:CompareValidator ID="PasswordCompare" runat="server" ControlToCompare="Password"

ControlToValidate="ConfirmPassword" Display="Dynamic" ErrorMessage="The Password and Confirmation Password must match."

ValidationGroup="CreateUserWizard1"></asp:CompareValidator>

</td>

</tr>

<tr>

<asp:Literal ID="ErrorMessage" runat="server" EnableViewState="False"></asp:Literal>

</td>

</tr>

</table>

</ContentTemplate>

</asp:CreateUserWizardStep>

<asp:CompleteWizardStep ID="CompleteWizardStep1" runat="server">

</asp:CompleteWizardStep>

</WizardSteps>

</asp:CreateUserWizard>

Add a Label and Texbox

Now you can add new controls or modify the existing controls as per your requirement. For our case we will add a Label and a TextBox contols to allow users to enter their Company name right before they enter their UserName.

<tr>

<asp:Label ID="CompanyNameLabel" runat="server" AssociatedControlID="CompanyName">Company Name:</asp:Label></td>

<td>

<asp:TextBox ID="CompanyName" runat="server"></asp:TextBox>

<asp:RequiredFieldValidator ID="CompanyNameValidator" runat="server" ControlToValidate="CompanyName"

ErrorMessage="Company Name is required." ToolTip="Company Name is required." ValidationGroup="CreateUserWizard1">*</asp:RequiredFieldValidator>

</td>

</tr>

This is how our control will look.

Points to Note

See the ValidationGroup property property for the new control added is equal to "CreateUserWizard1" i.e. ID of the CreateUserWizard.
How to insert that new field in the database is not shown here. You might want to use ASP.NET Profiles. Check out the resources below.

Conclusion

Here we saw adding extra controls to CUW in the createUser Step. Now if you want to add additional steps to the CUW, check out the Resources below.

Edit

Check this post on 'Storing Additional User Information in Custom Profiles Table'.

Resources

Create Profile in CreateUser Step: http://dotnet-friends.com/tutorials/asp/tutinasp97d3c33a-53a2-4a03-a9c4-30920e0b7feb.aspx
Adding new steps to CreateUserWizard: http://weblogs.asp.net/scottgu/archive/2005/10/18/427754.aspx

Allow an unapproved user to change email address

2008-11-25T20:22:00Z

Writing this with reference to the thread on asp.net forums. This post assumes you are using ASP.NET membership feature. Although the concept can be used if you have the same scenario.

Scenario:

You allow users to register on your website and send them an account activation link to the email address they provided while registration. So ideally you have user information (username,password,etc..) stored in your database but the account is not Approved. Once the user clicks the activiation link in the email that you sent them, the acount gets activated i.e.Approved.

Now what if accidently the email address the user entered is invalid due to some reason. As seen in the thread link, you forgot to validate the email address. So sending activation link will fail or say email will sent to wrong address. So now you have all user information in the database i.e. username/password etc but invalid email address.

So now how will you let the user change the email address? Before user can change the email address you would definitly want to validate the user but Membership.ValidateUser method will fail since the user is not approved yet.

How....?

Design a ChangeEmail.aspx with 3 Textboxes --- txtUserName, txtPassword and txtNewEmail and a Button --- btnChangeEmail.

Partial ChangeEmail.aspx :

<body>

<form id="form1" runat="server">

<div>

<strong><span style="font-size: 24pt">

Change Email:<br />

</span></strong>

<asp:Label ID="Label1" runat="server" Text="User Name"></asp:Label>

<asp:TextBox ID="txtUsername" runat="server"></asp:TextBox><br />

<asp:Label ID="Label2" runat="server" Text="Password"></asp:Label>

<asp:TextBox ID="txtPassword" runat="server"></asp:TextBox><br />

<asp:Label ID="Label3" runat="server" Text="New Email"></asp:Label>

<asp:TextBox ID="txtNewEmail" runat="server"></asp:TextBox><br />

<asp:Button ID="btnChangeEmail" runat="server" Text="Button" OnClick="btnChangeEmail_Click" />

</div>
</form>
</body>

ChangeEmail.aspx.cs :

protected void btnChangeEmail_Click(object sender, EventArgs e)

{

MembershipUser user = Membership.GetUser(txtUsername.Text);

//Check if user does exist

if (user != null)

{

//Check if unapproved user wants to change the email

if (user.IsApproved == false)
{

//Temporary approve that user

user.IsApproved = true;
Membership.UpdateUser(user);

//Verify the user before you change the email address

if (Membership.ValidateUser(txtUsername.Text, txtPassword.Text))
{

user.Email = txtNewEmail.Text;
Membership.UpdateUser(user);
//Here you can write your code to send a new activation Link to the user To new Email address

}

//Undo the approve until user clicks the approval link
user.IsApproved = false;Membership.UpdateUser(user);
}

//If an approved user wants to change the email

else

{

if (Membership.ValidateUser(txtUsername.Text, txtPassword.Text))
{

user.Email = txtNewEmail.Text;
Membership.UpdateUser(user);
}

}

}

Some Points to Note:

Take care of the Email Validation by using RegularExpression Validator Controls or something similar
The ChangeEmail.aspx will now work for users who are approved as well as unapproved.

I know this post is not too organized ...but hope it serves the purpose.

Reference:

http://forums.asp.net/t/1351002.aspx

Changing user password in Web.config

2008-11-18T19:19:00Z

Say you have your user credientials placed in your web.config . How do you change the passord for a user programatically. Less talk, more code.

Sample web.config in root folder:

<system.web>

<compilation debug="true" />
<authentication mode="Forms"><forms loginUrl="login.aspx" defaultUrl="default.aspx">
<credentials passwordFormat="Clear">
<user name="user" password="user" />
<user name="admin" password="admin" />
</credentials>
</forms>
</authentication>
<authorization>
<deny users="?"/> </authorization>
</system.web>

Code for changing Password:

Configuration webconfig = WebConfigurationManager.OpenWebConfiguration("~");

SystemWebSectionGroup sysweb = (SystemWebSectionGroup)webconfig.GetSectionGroup("system.web");

AuthenticationSection authSection = sysweb.Authentication;

FormsAuthenticationUserCollection users = authSection.Forms.Credentials.Users;
FormsAuthenticationUser user = users["UserName"]; //you can grab it from a textbox or User.Identity.Name ~ current LoggedIn User
user.Password = "newPassword" //you can grab it from a textbox......

webconfig.Save();

Namespaces added:

using System.Configuration;

using System.Web.Configuration;

Points to Note:

Configuration webconfig = WebConfigurationManager.OpenWebConfiguration("~");

I got an exception : “System.InvalidOperationException: ConfigurationSection properties cannot be edited when locked” when tried to use Configuration webconfig = WebConfigurationManager.OpenWebConfiguration("~//web.config");

Permissions to web.config

Make sure to grant Modify/Write permission to ASPNET useraccount (or the user account which is going to perform this action).

Setting authorization rules for a particular page or folder in web.config

2008-09-29T17:50:00Z

I have seen so many people asking again and again how to give allow access to particular page to a person or roles. So I thought its good to put this in one place. I will discuss how to configure web.config depending on the scenario.

We will start with a web.config without any authorization and modify it on case by case bassis.

No Authorization

We will start with the root web.config without any authorization.

<configuration>
<system.web>
<authentication mode="Forms">
</authentication>
</system.web>

</configuration>

Deny Anonymous user to access entire website

This is the case when you want everybody to login before the can start browsing around your website. i.e. The first thing they will see is a login page.

<system.web>
<authentication mode="Forms">
</authentication>
<authorization>
<deny users="?"/> //will deny anonymous users
</authorization>

</system.web>

The above situation is good when user don't have to register themselves but instead their user account is created by some administrator.

Allow access to everyone to a particular page

Sometimes you want to allow public access to your registeration page and want to restrict access to rest of the site only to logged / authenticated users .i.e. do not allow anonymous access. Say your registration page is called register.aspx in your site's root folder. In the web.config of your website's root folder you need to have following setup.

<configuration>

<system.web>

<authentication mode="Forms"/>
<authorization> <deny users="?"/> //this will restrict anonymous user access
</authorization>
</system.web>

<location path="register.aspx"> //path here is path to your register.aspx page e.g. it could be ~/publicpages/register.aspx
<system.web>
<authorization>
<allow users="*"/> // this will allow access to everyone to register.aspx
</authorization>

</system.web>
</location>

</configuration>

Till now we saw either allow users or to authenticated users only. But there could be cases where we want to allow particular user to certain pages but deny everyone else (authenticated as well as anonymous).

To allow access to particular user only and deny everyone else

Say you want to give access to user "John" to a particular page e.g. userpersonal.aspx and deny all others the location tag above should look like below:

<location path="userpersonal.aspx">
<system.web>
<authorization>
<allow users="John"/> // allow John ..note: you can have multiple users seperated by comma e.g. John,Mary,etc
<deny users="*"/> // deny others
</authorization>
</system.web>

</location>

Allow only users in particular Role

Here I am will not show how to setup roles. I assume you have roles managment setup for users. We will see now what needs to be done in web.config to configure authorization for a particular role. e.g You have two roles. Customer and Admin and two folders CustomerFolder and AdminFolder. Users in Admin role can access both folders. Users in Customers role can access only CustomerFolder and not AdminFolder. You will have to add location tags for each folder path as shown below:

<location path="AdminFolder">

<system.web>
<authorization>
<allow roles="Admin"/> //Allows users in Admin role
<deny users="*"/> // deny everyone else
</authorization>
</system.web>

</location>
<location path="CustomerFolder">

<system.web>
<authorization>
<allow roles="Admin, Customers"/> //Allow users in Admin and Customers roles
<deny users="*"/> // Deny rest of all
</authorization>
</system.web>

</location>

Alternate way - using individual web.config for each Folder

Alternative to above mentioned method of using <location../> tag, you can add web.config to each folder and configure authorization accordingly almost similar to one show above but not using location tag. Taking same eg. as above. Add web.config to both the folders - AdminFolder and CustomerFolder.

Web.config in AdminFolder should look like:

<configuration>

<system.web>

<authorization>
<allow roles="Admin"/> //Allows users in Admin role
<deny users="*"/> // deny everyone else
</authorization>
</system.web>

</configuration>
Web.config in CustomerFolder should look like:

<configuration>

<system.web>

<authorization>
<allow roles="Admin, Customers"/> //Allow users in Admin and Customers roles
<deny users="*"/> // Deny rest of all
</authorization>
</system.web>

</configuration>

Images and CSS files

Say you have all your images and CSS in a seperate folder called images and you are denying anonymous access to your website. In that case you might see that on your login page you cannot see images(if any) and css(if any) applied to your login page controls.

In that case you can add a web.config to the images and css folder and allow access to everyone to that folder. So your web.config in images folder should look as below:

<configuration>

<system.web>
<authorization>
<allow users="*"/> //Allow everyone

</authorization>
</system.web>

</configuration>

Common Mistakes

I have seen people complaining that they have setup their roles correctly and also made entry to their web.config but still their authorization doesn't work. Even they have allowed access to their role that user cannot access particular page/folder. The common reason for that is placing <deny../> before <allow ../>.

Say the web.config from AdminFolder as we have seen before is something like this:

//This web.config will not allow access to users even they are in Admin Role

<configuration>

<system.web>

<authorization>

<deny users="*"/> // deny everyone else
<allow roles="Admin"/> //Allows users in Admin role
</authorization>
</system.web>

</configuration>

Since the authorization is done from top to bottom, rules are checked until a match is found. Here we have <deny users="*"/> first and so it will not check for allow any more and deny access even if in Admin role.

So PUT all allows BEFORE ANY deny.

NOTE: deny works the same way as allow. You can deny particular roles or users as per your requirement.

I hope this will answer some of the question regarding how to authorize pages / folders(directories). Comments welcome.

Resources

ASP.NET Authorization : http://msdn.microsoft.com/en-us/library/wce3kxhd.aspx
Authorizing Users and Roles: http://quickstarts.asp.net/QuickStartv20/aspnet/doc/security/authorization.aspx