Using AppHarbor, Bitbucket and Mercurial with ASP.NET and Silverlight - Part 3 Membership and Role Provider in SQL Server

Now that we have an ASP.NET application that uses Silverlight, a WCF Web Service and a CouchDB database on AppHarbor, it would be nice to provide the application with Role and Membership management so we can control who has access to our web application.

1. First provision the application on AppHarbor with SQL Server support by goining to the application’s page on AppHarbor, clicking “View Available add-ons” and then selecting “SQL Server”
2. Then select the Yocto version, 20MB should be more than enough to keep track of our users:
   
3. Under the application’s Variables page you will see the connection strings.
   
   The full connection string can be found by clicking “Go to SQL Server” on the application’s page. Keep in mind that this connection string can be changed at any given point in time by AppHarbor or the SQL Server provider (Sequelizer) but we need it right now for the next step.
4. Run the aspnet_regsql.exe tool and use the values from the connection string to install the the tables and procedures in the database. Note: if the tool can’t connect to the database you are probably behind a firewall that blocks out the port the tool uses to connect to the server.
5. To use the same database when testing locally you could copy the connection string to the web.config file and configure the membership, role and profile providers:

   <!--?xml version=&quot;1.0&quot;?-->
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   

6. Now let’s protect the web service from being used by anonymous users of the web site. To do that create a folder in the web application’s project. I named mine WebServices and drag/drop the the DemoService.svc file into this folder.
7. Open the ServiceReferences.ClientConfigin the Silverlight project and add the extra folder to the endpoint addresses:

8. Now you can add roles and users using the asp.net configuration tool in Visual Studio.
   
9. On the Security tab page, select Forms authentication.
10. You can check the selected providers on the Provider tab page by clicking the second link:
    
11. In the Security page I enabled roles and added two roles (Admin and User) and a single user (in both roles)
12. Next I created some access rules. I selected the WebServices folder and denied Anonymous Users access. After that I allowed All Users access.
13. The access rules of a folder are added to a web.config that is placed in that folder. Unfortunately Visual Studio does NOT automatically add this new config file to the project and therefore it will not be deployed. So make sure you include any web.config files that are added by the tool to the project. If these files are not deployed your site will not be secured. Click “Show All Files”, right-click web.config and select “Include In Project”:
    
14. If you test the application you will not be able to call the web service because there is no way to login yet. So let’s add that first.
15. Open the default.aspx and wrap the Silverlight control in a LoginView. I added a LoginStatus to be able to log out and a Login control to be able to login:

    </pre>
    <form id=&quot;form1&quot; style=&quot;height: 100%;&quot;>
    
    
    
    
    
    
    <div id=&quot;silverlightControlHost&quot;><object width=&quot;100%&quot; height=&quot;100%&quot; classid=&quot;clsid:dfeaf541-f3e1-4c24-acac-99c30715084a&quot;><param name=&quot;src&quot; value=&quot;data:application/x-silverlight-2,&quot; /><embed width=&quot;100%&quot; height=&quot;100%&quot; type=&quot;application/x-silverlight-2&quot; src=&quot;data:application/x-silverlight-2,&quot; />  </object>
     <iframe id=&quot;_sl_historyFrame&quot; style=&quot;visibility: hidden; height: 0px; width: 0px; border: 0px;&quot; width=&quot;320&quot; height=&quot;240&quot;></iframe></div>
    
     </form>
    <pre>
    
    

16. Note that you could also add access rules to the ClientBin folder where the Silverlight XAP resides. That way you’d be securing the XAP as well.
17. Now you are ready to deploy. Just commit the last version to version control and push to BitBucket.