By Razzie


2009-06-30 15:18:15 8 Comments

I need to do something fairly simple: in my ASP.NET MVC application, I want to set a custom IIdentity / IPrincipal. Whichever is easier / more suitable. I want to extend the default so that I can call something like User.Identity.Id and User.Identity.Role. Nothing fancy, just some extra properties.

I've read tons of articles and questions but I feel like I'm making it harder than it actually is. I thought it would be easy. If a user logs on, I want to set a custom IIdentity. So I thought, I will implement Application_PostAuthenticateRequest in my global.asax. However, that is called on every request, and I don't want to do a call to the database on every request which would request all the data from the database and put in a custom IPrincipal object. That also seems very unnecessary, slow, and in the wrong place (doing database calls there) but I could be wrong. Or where else would that data come from?

So I thought, whenever a user logs in, I can add some necessary variables in my session, which I add to the custom IIdentity in the Application_PostAuthenticateRequest event handler. However, my Context.Session is null there, so that is also not the way to go.

I've been working on this for a day now and I feel I'm missing something. This shouldn't be too hard to do, right? I'm also a bit confused by all the (semi)related stuff that comes with this. MembershipProvider, MembershipUser, RoleProvider, ProfileProvider, IPrincipal, IIdentity, FormsAuthentication.... Am I the only one who finds all this very confusing?

If someone could tell me a simple, elegant, and efficient solution to store some extra data on a IIdentity without all the extra fuzz.. that would be great! I know there are similar questions on SO but if the answer I need is in there, I must've overlooked.

9 comments

@Vasily Ivanov 2018-06-26 09:02:53

I tried the solution suggested by LukeP and found that it doesn't support the Authorize attribute. So, I modified it a bit.

public class UserExBusinessInfo
{
    public int BusinessID { get; set; }
    public string Name { get; set; }
}

public class UserExInfo
{
    public IEnumerable<UserExBusinessInfo> BusinessInfo { get; set; }
    public int? CurrentBusinessID { get; set; }
}

public class PrincipalEx : ClaimsPrincipal
{
    private readonly UserExInfo userExInfo;
    public UserExInfo UserExInfo => userExInfo;

    public PrincipalEx(IPrincipal baseModel, UserExInfo userExInfo)
        : base(baseModel)
    {
        this.userExInfo = userExInfo;
    }
}

public class PrincipalExSerializeModel
{
    public UserExInfo UserExInfo { get; set; }
}

public static class IPrincipalHelpers
{
    public static UserExInfo ExInfo(this IPrincipal @this) => (@this as PrincipalEx)?.UserExInfo;
}


    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public async Task<ActionResult> Login(LoginModel details, string returnUrl)
    {
        if (ModelState.IsValid)
        {
            AppUser user = await UserManager.FindAsync(details.Name, details.Password);

            if (user == null)
            {
                ModelState.AddModelError("", "Invalid name or password.");
            }
            else
            {
                ClaimsIdentity ident = await UserManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
                AuthManager.SignOut();
                AuthManager.SignIn(new AuthenticationProperties { IsPersistent = false }, ident);

                user.LastLoginDate = DateTime.UtcNow;
                await UserManager.UpdateAsync(user);

                PrincipalExSerializeModel serializeModel = new PrincipalExSerializeModel();
                serializeModel.UserExInfo = new UserExInfo()
                {
                    BusinessInfo = await
                        db.Businesses
                        .Where(b => user.Id.Equals(b.AspNetUserID))
                        .Select(b => new UserExBusinessInfo { BusinessID = b.BusinessID, Name = b.Name })
                        .ToListAsync()
                };

                JavaScriptSerializer serializer = new JavaScriptSerializer();

                string userData = serializer.Serialize(serializeModel);

                FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                         1,
                         details.Name,
                         DateTime.Now,
                         DateTime.Now.AddMinutes(15),
                         false,
                         userData);

                string encTicket = FormsAuthentication.Encrypt(authTicket);
                HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
                Response.Cookies.Add(faCookie);

                return RedirectToLocal(returnUrl);
            }
        }
        return View(details);
    }

And finally in Global.asax.cs

    protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
        HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];

        if (authCookie != null)
        {
            FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
            JavaScriptSerializer serializer = new JavaScriptSerializer();
            PrincipalExSerializeModel serializeModel = serializer.Deserialize<PrincipalExSerializeModel>(authTicket.UserData);
            PrincipalEx newUser = new PrincipalEx(HttpContext.Current.User, serializeModel.UserExInfo);
            HttpContext.Current.User = newUser;
        }
    }

Now I can access the data in views and controllers simply by calling

User.ExInfo()

To log out I just call

AuthManager.SignOut();

where AuthManager is

HttpContext.GetOwinContext().Authentication

@Erik Funkenbusch 2017-05-31 20:49:11

All right, so i'm a serious cryptkeeper here by dragging up this very old question, but there is a much simpler approach to this, which was touched on by @Baserz above. And that is to use a combination of C# Extension methods and caching (Do NOT use session).

In fact, Microsoft has already provided a number of such extensions in the Microsoft.AspNet.Identity.IdentityExtensions namespace. For instance, GetUserId() is an extension method that returns the user Id. There is also GetUserName() and FindFirstValue(), which returns claims based on the IPrincipal.

So you need only include the namespace, and then call User.Identity.GetUserName() to get the users name as configured by ASP.NET Identity.

I'm not certain if this is cached, since the older ASP.NET Identity is not open sourced, and I haven't bothered to reverse engineer it. However, if it's not then you can write your own extension method, that will cache this result for a specific amount of time.

@Alex 2017-06-08 19:31:32

Why "do not use session"?

@Erik Funkenbusch 2017-06-08 19:42:16

@jitbit - because session is unreliable, and insecure. For the same reason you should never use session for security purposes.

@Alex 2017-06-08 19:58:59

"Unreliable" can be addressed by repopulating session (if empty). "Unsecure" - there are ways to protect from session hijacking (by useing HTTPS-only + other ways). But I actually agree with you. Where would you cache it then? Info like IsUserAdministrator or UserEmail etc.? You thinking HttpRuntime.Cache?

@Erik Funkenbusch 2017-06-08 20:11:56

@jitbit - That's one option, or another cacheing solution if you have it. Making sure to expire the cache entry after a period of time. Insecure also applies to the local system, since you can manually alter the cookie and guess session ID's. Man in the middle is not the only concern.

@LukeP 2012-05-09 21:24:50

Here's how I do it.

I decided to use IPrincipal instead of IIdentity because it means I don't have to implement both IIdentity and IPrincipal.

  1. Create the interface

    interface ICustomPrincipal : IPrincipal
    {
        int Id { get; set; }
        string FirstName { get; set; }
        string LastName { get; set; }
    }
    
  2. CustomPrincipal

    public class CustomPrincipal : ICustomPrincipal
    {
        public IIdentity Identity { get; private set; }
        public bool IsInRole(string role) { return false; }
    
        public CustomPrincipal(string email)
        {
            this.Identity = new GenericIdentity(email);
        }
    
        public int Id { get; set; }
        public string FirstName { get; set; }
        public string LastName { get; set; }
    }
    
  3. CustomPrincipalSerializeModel - for serializing custom information into userdata field in FormsAuthenticationTicket object.

    public class CustomPrincipalSerializeModel
    {
        public int Id { get; set; }
        public string FirstName { get; set; }
        public string LastName { get; set; }
    }
    
  4. LogIn method - setting up a cookie with custom information

    if (Membership.ValidateUser(viewModel.Email, viewModel.Password))
    {
        var user = userRepository.Users.Where(u => u.Email == viewModel.Email).First();
    
        CustomPrincipalSerializeModel serializeModel = new CustomPrincipalSerializeModel();
        serializeModel.Id = user.Id;
        serializeModel.FirstName = user.FirstName;
        serializeModel.LastName = user.LastName;
    
        JavaScriptSerializer serializer = new JavaScriptSerializer();
    
        string userData = serializer.Serialize(serializeModel);
    
        FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                 1,
                 viewModel.Email,
                 DateTime.Now,
                 DateTime.Now.AddMinutes(15),
                 false,
                 userData);
    
        string encTicket = FormsAuthentication.Encrypt(authTicket);
        HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
        Response.Cookies.Add(faCookie);
    
        return RedirectToAction("Index", "Home");
    }
    
  5. Global.asax.cs - Reading cookie and replacing HttpContext.User object, this is done by overriding PostAuthenticateRequest

    protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
    {
        HttpCookie authCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
    
        if (authCookie != null)
        {
            FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
    
            JavaScriptSerializer serializer = new JavaScriptSerializer();
    
            CustomPrincipalSerializeModel serializeModel = serializer.Deserialize<CustomPrincipalSerializeModel>(authTicket.UserData);
    
            CustomPrincipal newUser = new CustomPrincipal(authTicket.Name);
            newUser.Id = serializeModel.Id;
            newUser.FirstName = serializeModel.FirstName;
            newUser.LastName = serializeModel.LastName;
    
            HttpContext.Current.User = newUser;
        }
    }
    
  6. Access in Razor views

    @((User as CustomPrincipal).Id)
    @((User as CustomPrincipal).FirstName)
    @((User as CustomPrincipal).LastName)
    

and in code:

    (User as CustomPrincipal).Id
    (User as CustomPrincipal).FirstName
    (User as CustomPrincipal).LastName

I think the code is self-explanatory. If it isn't, let me know.

Additionally to make the access even easier you can create a base controller and override the returned User object (HttpContext.User):

public class BaseController : Controller
{
    protected virtual new CustomPrincipal User
    {
        get { return HttpContext.User as CustomPrincipal; }
    }
}

and then, for each controller:

public class AccountController : BaseController
{
    // ...
}

which will allow you to access custom fields in code like this:

User.Id
User.FirstName
User.LastName

But this will not work inside views. For that you would need to create a custom WebViewPage implementation:

public abstract class BaseViewPage : WebViewPage
{
    public virtual new CustomPrincipal User
    {
        get { return base.User as CustomPrincipal; }
    }
}

public abstract class BaseViewPage<TModel> : WebViewPage<TModel>
{
    public virtual new CustomPrincipal User
    {
        get { return base.User as CustomPrincipal; }
    }
}

Make it a default page type in Views/web.config:

<pages pageBaseType="Your.Namespace.BaseViewPage">
  <namespaces>
    <add namespace="System.Web.Mvc" />
    <add namespace="System.Web.Mvc.Ajax" />
    <add namespace="System.Web.Mvc.Html" />
    <add namespace="System.Web.Routing" />
  </namespaces>
</pages>

and in views, you can access it like this:

@User.FirstName
@User.LastName

@David Keaveny 2012-06-26 07:29:26

Nice implementation; watch out for RoleManagerModule replacing your custom principal with a RolePrincipal. That caused me a lot of pain - stackoverflow.com/questions/10742259/…

@Adam Vigh 2012-10-03 11:55:31

Lovely, I just have one question: Can storing the user id in the forms auth ticket, as you've just described cause any security issues? Is it possible that the user can tamper that data?

@LukeP 2012-10-03 17:54:00

@AdamVigh See here: support.microsoft.com/kb/910443 (What is the role of a ticket in Forms Authentication?) and here: stackoverflow.com/questions/8635965/… - so it looks like a tampered with ticket will not decrypt unless it's a situation described in the second link (you're replacing hex 0 with G-Z letters which will be converted to 0 anyway therefore keeping the ticket intact).

@Pierre-Alain Vigeant 2012-11-20 21:47:42

How would you manage an anonymous user? The code in Application_PostAuthenticateRequest won't run and the as cast will return null everywhere. Normally, the User property is never null.

@Pierre-Alain Vigeant 2012-11-20 22:27:10

ok I found the solution, just add an else switch which pass "" (empty string) as the email and the Identity will be anonymous.

@1110 2012-12-25 13:00:31

DateTime.Now.AddMinutes(N)... how to make this so it doesn't logout user after N minutes, can the logged in user be persisted (when user check 'Remember Me' for example)?

@Gabriel 2013-01-10 11:04:41

@LukeP: Perfect solution! and even integrated with MVC! Just design a question, which directory/project do you usually put the ICustomPrincipal/CustomPrincipal files?

@LukeP 2013-01-10 16:13:27

@Gabriel I put all membership code in the main project. I will usually create a Membership folder/namespace reference it where it's needed.

@Rui Lima 2013-03-21 18:59:18

Isn't this a bit unsecure if our principal has sensitive data such has roles or permissions?

@Ben Cameron 2013-04-10 21:22:10

This is a great answer. I am having one problem with though. My session/cookie doesn't persist between browser sessions. Has anyone else had this issue or know a fix?

@LukeP 2013-04-11 09:02:56

Have you tried making your FormsAuthenticationTicket object persistent (by changing false to true)?

@mg1075 2013-05-12 00:29:09

@LukeP - does the Thread.CurrentPrincipal also need to be set to the newUser in the PostAuthenticationRequest? (See comment from Rus Cam in answer from Sriwantha Attanayake.)

@hakan 2013-06-16 23:11:00

what is the user repository class in this line? var user = userRepository.Users.Where(u => u.Email == viewModel.Email).First();

@LukeP 2013-06-17 00:27:53

@piedpiper It's whatever you use to get your user object from your data layer. This is where you would get user's information like first name and last name from.

@ryanulit 2013-06-27 19:10:25

FYI - If anyone is still having trouble with the principal being null for anonymous users, this q/a solved the problem for me - stackoverflow.com/questions/11476301/…

@TugboatCaptain 2013-07-15 18:35:36

instead of manually using the as conversion repeatedly you can use an extension method: public static <yourType> ToCustom(this IPrincipal principal) { return principal as <yourType>; } @User.ToCustom().someProperty

@Jonathan Levison 2013-07-16 19:50:42

If you are using the WebApiController, you will need to set Thread.CurrentPrincipal at Application_PostAuthenticateRequest for it to work as it does not rely on HttpContext.Current.User

@Mike Wade 2013-07-26 13:57:09

The FormsAuthentication cookie should have the HttpOnly attribute set to true to prevent JavaScript from accessing your auth cookie. I also had to put the PostAuthenticateRequest event wireup in public override void Init() otherwise I got a NullReferenceException from the framework. But the answer was great other than that :)

@Abhinav Gujjar 2014-01-29 19:01:31

Has anyone figured out how to accomplish log off with this ? Logoff seems to have broken.

@LukeP 2014-01-29 21:30:16

@AbhinavGujjar FormsAuthentication.SignOut(); works fine for me.

@BlackICE 2014-02-04 21:18:58

Any suggestions on how to do this with OWIN?

@LukeP 2014-02-04 21:28:52

@BlackICE I'm currently writing an app that uses OWIN and I do it a bit differently now. I have a need to store a lot more information than I am prepared to in a cookie so I just store email address in a claim and create work context with full user object pulled from cache, or database if it's not in cache yet. Ask a question and link it here and I'll do my best to help.

@BlackICE 2014-02-07 15:08:04

@LukeP I'm reading up on OWIN now to get up to speed on it, I don't think a cookie is the best place for what I'm storing either as it could be substantial. Is Cache better than Session for this?

@LukeP 2014-02-08 17:38:09

@BlackICE I don't think one is better than the other one. They're different. I like using cache because I've already implemented a nice wrapper for all my cache needs. Also see: stackoverflow.com/questions/428634/…

@BlackICE 2014-02-10 14:39:39

@LukeP Here's my question: stackoverflow.com/questions/21679836/…

@LukeP 2014-02-10 15:33:02

@BlackICE I'll answer when I get back home from work. Like I said I am doing it differently now so you might or might not like it, but it will let you do what you want to do.

@Mark Homans 2014-02-20 15:02:56

Great answer! If by any chance you want to serialize DateTime's, then i would suggest not to use JavaScriptSerializer. It converts the date to a format like so: /Date(352162800000)/, and when deserialising i ended up with a date a day earlier...(timezone glitch maybe?) i would recomend NewtonSoft's Json.NET (james.newtonking.com/json) to do the serializing.

@Sakthivel 2014-06-26 11:29:46

Could you add some more and lighten us by explaining adding roles to this method and using it in controller "Users = "Admin" ?

@Timeless 2014-07-26 23:03:56

I always get null from Request.Cookies[FormsAuthentication.FormsCookieName], it's weird.

@LukeP 2014-07-27 12:08:50

@Timeless Try using Fiddler and checking if the cookie is being set correctly during login.

@Timeless 2014-07-28 05:02:48

@LukeP Is there any limitation on the length(size) of the userdata?

@LukeP 2014-07-28 17:29:36

@Timeless There are limits to how big the cookie can be. See here: stackoverflow.com/questions/5381526/…

@Pharylon 2014-09-17 18:27:01

At least in MVC 5 you need to do Context.User = newUser; instead of HttpContext.Current.User = newuser.

@Rajshekar Reddy 2015-03-10 15:37:17

@LukeP I am not able to use in the view like @User.FirstName as you have mentioned. I have followed your post exactly, Is there anything that needs to be set? @((User as CustomPrincipal).FirstName) is working

@Chad Richardson 2015-03-10 23:51:48

@LukeP same question as Reddy. I am not able to use in the view like '@User.FirstName' as you have mentioned. I have followed your post exactly, Is there anything that needs to be set? '@((User as CustomPrincipal).FirstName)' is working

@LukeP 2015-03-23 17:29:16

@Reddy and Chad Richardson: Have you implemented the BaseViewPage and made it default in Views/web.config? Also which version of MVC are you using?

@Rajshekar Reddy 2015-03-24 11:24:06

@LukeP sorry I had to set the <pages pageBaseType="Your.Namespace.BaseViewPage"> in the webConfig of the views folder but I did it in the main wenConfig. My bad I overlooked it. All working fine. Thanks Brother

@J86 2015-04-02 11:24:39

@LukeP how do Roles fit into the above? When I put this [Authorize(Roles = "Admin")]on my controller, it keeps failing, even though my user is in Role Admin (I checked Db)

@Sinaesthetic 2015-04-28 00:37:03

@Ciwan check the the principal to make sure it's getting loaded in. I can't speak for what you're using, but we use ClaimsPrincipal. As long as the type and value are set correctly, it should work. In some cases, you may need a custom authorize attribute depending on how you implemented the identity.

@Ryan Veteze 2015-05-08 21:36:52

@LukeP - this probably needs a question all it's own, but how do I use my own custom password authentication? I have an existing ASP.NET app that I'm porting to MVC5. It seems easiest if I can keep using my existing User table with encrypted passwords. Hash hash = new Hash("SHA256"); if(u.Password == hash.Encrypt(EnteredTyped)) And not have to switch everything over to Membership? Or how do extend Membership with custom Authentication that will allow me to point it to my existing User table?

@Ehsan 2015-07-02 22:21:25

thanks for the solution, after using this; how can I use the authentication for a specific controller??

@gaurav bhavsar 2015-09-22 09:00:34

@LukeP I implement Custom IPrinciple as you mention above, but I am getting authCookie = null always, does I am missing anything ?

@fiberOptics 2015-12-09 13:29:28

Is there any new/improved way of implementation for MVC5?

@Pcodea Xonos 2016-02-10 09:37:34

How to manage an anonymous user else { HttpContext.Current.User = new CustomPrincipal(""); } after if (authCookie != null) { //.. } Unfortunately I have no idea if is it safe.

@shamim 2016-05-18 13:07:25

@LukeP, Your step-4 login method not contain the returnUrl,with out using the [Authorize] attribute how to get return url.

@Joakim Hansson 2016-05-19 16:52:56

I've been developing in C#/.NET for quite a while now but recently got into web. I didn't get into authentication/authorization until today and I started by saying that I didn't want to just use the built in stuff by Microsoft. Your answer + debugging helped me understand the authentication model for ASP.NET. Thank you!

@Felipe Oriani 2016-10-06 00:47:22

I've been implementing it and it works fine on my local iis. When I host it on a medium trust server it expires my authentication less than 1 minuto. Is there something I can do?

@Alex 2017-06-08 18:52:41

@LukeP this is a great solution. The only downside is - it works with FormsAuth only. I need to be able to use both Forms and Windows authentication. (the WindowsPricncipal one). Will keep digging.

@Mike 2018-07-30 19:41:08

Why does "IsInRole" always return false in your IPrincipal?

@LukeP 2018-07-31 14:45:54

@Mike Because it's just an example and not full implementation. Outside of the scope of the question.

@Mike 2018-07-31 17:23:06

If I was to use the code as is then I would never get past the login page to an Authorized page. The IsInRole will get called return false and take action to have the user login in again. in your code example you should probably return true and add a comment to show that more work is needed in that area to ensure proper authentication.

@John Rasch 2009-06-30 15:28:27

I can't speak directly for ASP.NET MVC, but for ASP.NET Web Forms, the trick is to create a FormsAuthenticationTicket and encrypt it into a cookie once the user has been authenticated. This way, you only have to call the database once (or AD or whatever you are using to perform your authentication), and each subsequent request will authenticate based on the ticket stored in the cookie.

A good article on this: http://www.ondotnet.com/pub/a/dotnet/2004/02/02/effectiveformsauth.html (broken link)

Edit:

Since the link above is broken, I would recommend LukeP's solution in his answer above: https://stackoverflow.com/a/10524305 - I would also suggest that the accepted answer be changed to that one.

Edit 2: An alternative for the broken link: https://web.archive.org/web/20120422011422/http://ondotnet.com/pub/a/dotnet/2004/02/02/effectiveformsauth.html

@John Zumbrum 2012-04-24 12:54:31

Coming from PHP, I've always put the information like UserID and other pieces needed to grant restricted access in Session. Storing it client-side makes me nervous, can you comment on why that won't be a problem?

@John Rasch 2012-04-24 14:42:48

@JohnZ - the ticket itself is encrypted on the server before it's sent over the wire, so it's not like the client is going to have access to the data stored within the ticket. Note that session IDs are stored in a cookie as well, so it's not really all that different.

@Guillermo Gutiérrez 2012-08-28 17:29:37

@JohnZ - Session is also a cookie saved on the client side.

@mynkow 2013-04-26 07:59:19

If you are here you should look at LukeP's solution

@Red Taz 2013-05-08 15:14:45

I've always been concerned with the potential for exceeding the maximum cookie size (stackoverflow.com/questions/8706924/…) with this approach. I tend to use the Cache as a Session replacement to keep the data on the server. Can anyone tell me if this is a flawed approach?

@Geoffrey Hudik 2013-06-05 01:36:35

Nice approach. One potential problem with this is if your user object has more than a few properties (and especially if any nested objects), creating the cookie will fail silently once the encrypted value is over 4KB (much easier to hit then you might think). If you only store key data it's fine but then you'd have to hit DB still for the rest. Another consideration is "upgrading" cookie data when the user object has signature or logic changes.

@zacharydl 2013-08-08 03:09:32

Joe Stagner addresses the question of cookie vs. cache in his excellent video Use Custom Principal Objects. The examples are in Web Forms, but this was still the best 20 minutes I spent while working on FormsAuthentication.

@Reuel Ribeiro 2016-06-10 16:13:47

@qJake I've updated the post with an working link

@Sriwantha Attanayake 2009-11-20 10:55:35

Here is an example to get the job done. bool isValid is set by looking at some data store (lets say your user data base). UserID is just an ID i am maintaining. You can add aditional information like email address to user data.

protected void btnLogin_Click(object sender, EventArgs e)
{         
    //Hard Coded for the moment
    bool isValid=true;
    if (isValid) 
    {
         string userData = String.Empty;
         userData = userData + "UserID=" + userID;
         FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, username, DateTime.Now, DateTime.Now.AddMinutes(30), true, userData);
         string encTicket = FormsAuthentication.Encrypt(ticket);
         HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
         Response.Cookies.Add(faCookie);
         //And send the user where they were heading
         string redirectUrl = FormsAuthentication.GetRedirectUrl(username, false);
         Response.Redirect(redirectUrl);
     }
}

in the golbal asax add the following code to retrive your information

protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
    HttpCookie authCookie = Request.Cookies[
             FormsAuthentication.FormsCookieName];
    if(authCookie != null)
    {
        //Extract the forms authentication cookie
        FormsAuthenticationTicket authTicket = 
               FormsAuthentication.Decrypt(authCookie.Value);
        // Create an Identity object
        //CustomIdentity implements System.Web.Security.IIdentity
        CustomIdentity id = GetUserIdentity(authTicket.Name);
        //CustomPrincipal implements System.Web.Security.IPrincipal
        CustomPrincipal newUser = new CustomPrincipal();
        Context.User = newUser;
    }
}

When you are going to use the information later, you can access your custom principal as follows.

(CustomPrincipal)this.User
or 
(CustomPrincipal)this.Context.User

this will allow you to access custom user information.

@Dan Esparza 2010-05-20 04:27:40

FYI -- it's Request.Cookies[] (plural)

@Russ Cam 2010-05-31 09:07:43

Don't forget to set Thread.CurrentPrincipal as well as Context.User to the CustomPrincipal.

@Ryan 2011-03-12 07:03:13

Where does GetUserIdentity() come from?

@Sriwantha Attanayake 2012-01-29 15:05:55

As I have mentioned in the comment, it's gives an implementation of System.Web.Security.IIdentity. Google about that interface

@brady gaster 2011-06-23 12:21:43

MVC provides you with the OnAuthorize method that hangs from your controller classes. Or, you could use a custom action filter to perform authorization. MVC makes it pretty easy to do. I posted a blog post about this here. http://www.bradygaster.com/post/custom-authentication-with-mvc-3.0

@Dragouf 2011-08-18 12:46:32

But session can be lost and user still authenticate. No ?

@RayLoveless 2016-04-11 18:01:26

@brady gaster, I read your blog post(thanks!), Why would someone use the override "OnAuthorize()" as mentioned on your post over the global.asax entry "...AuthenticateRequest(..)" mentioned by the other answers? Is one preferred over the other in setting the principle user?

@Manight 2012-12-24 18:32:33

As an addition to LukeP code for Web Forms users (not MVC) if you want to simplify the access in the code behind of your pages, just add the code below to a base page and derive the base page in all your pages:

Public Overridable Shadows ReadOnly Property User() As CustomPrincipal
    Get
        Return DirectCast(MyBase.User, CustomPrincipal)
    End Get
End Property

So in your code behind you can simply access:

User.FirstName or User.LastName

What I'm missing in a Web Form scenario, is how to obtain the same behaviour in code not tied to the page, for example in httpmodules should I always add a cast in each class or is there a smarter way to obtain this?

Thanks for your answers and thank to LukeP since I used your examples as a base for my custom user (which now has User.Roles, User.Tasks, User.HasPath(int) , User.Settings.Timeout and many other nice things)

@AechoLiu 2013-04-23 09:58:38

Based on LukeP's answer, and add some methods to setup timeout and requireSSL cooperated with Web.config.

The references links

Modified Codes of LukeP

1, Set timeout based on Web.Config. The FormsAuthentication.Timeout will get the timeout value, which is defined in web.config. I wrapped the followings to be a function, which return a ticket back.

int version = 1;
DateTime now = DateTime.Now;

// respect to the `timeout` in Web.config.
TimeSpan timeout = FormsAuthentication.Timeout;
DateTime expire = now.Add(timeout);
bool isPersist = false;

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
     version,          
     name,
     now,
     expire,
     isPersist,
     userData);

2, Configure the cookie to be secure or not, based on the RequireSSL configuration.

HttpCookie faCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
// respect to `RequreSSL` in `Web.Config`
bool bSSL = FormsAuthentication.RequireSSL;
faCookie.Secure = bSSL;

@Base 2013-03-09 23:10:04

Here is a solution if you need to hook up some methods to @User for use in your views. No solution for any serious membership customization, but if the original question was needed for views alone then this perhaps would be enough. The below was used for checking a variable returned from a authorizefilter, used to verify if some links wehere to be presented or not(not for any kind of authorization logic or access granting).

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using System.Security.Principal;

    namespace SomeSite.Web.Helpers
    {
        public static class UserHelpers
        {
            public static bool IsEditor(this IPrincipal user)
            {
                return null; //Do some stuff
            }
        }
    }

Then just add a reference in the areas web.config, and call it like below in the view.

@User.IsEditor()

@oneNiceFriend 2016-06-05 08:36:36

In your solution, We again need to do database calls every time. Because user object doesn't have custom properties. It only has Name and IsAuthanticated

@Base 2016-06-05 14:03:42

That depends entirely on your implementation and desired behavior. My sample contains 0 lines of database, or role, logic. If one use the IsInRole it could in turn be cached in cookie i believe. Or you implement your own caching logic.

Related Questions

Sponsored Content

35 Answered Questions

21 Answered Questions

[SOLVED] File Upload ASP.NET MVC 3.0

36 Answered Questions

[SOLVED] How do you create a dropdownlist from an enum in ASP.NET MVC?

8 Answered Questions

[SOLVED] Compile Views in ASP.NET MVC

1 Answered Questions

2 Answered Questions

2 Answered Questions

[SOLVED] Where to create custom IPrincipal object?

1 Answered Questions

3 Answered Questions

[SOLVED] MembershipProvider, IPrincipal, IIdentity?

Sponsored Content