Understanding SimpleMembership

Question

I would like to find out more about the SimpleMembershipProvider in the context of an ASP.NET MVC 4 web application using the VS 2012 Internet template.

Q1. Where is the module configured? In the ASP.NET web form version, it can be seen in web.config. In the MVC 4 version, the default web.config is void of any references to the membership provider.

Q2. In machine.config, there is a configured SqlMembershipProvider. Where/when is this overridden?

Q3. What triggers SimpleMembershipInitializer() to be called? It is not in Globals.asax. When I have a user who is already logged in and I restart the web application (or if azurewebsites wakes the app up after being dormant for a while), the user will get into trouble with

You must call the "WebSecurity.InitializeDatabaseConnection" method before you call any other method of the "WebSecurity" class

when he next clicks a link on my site. Is it ok to call this method more than once?

Answer 1

A1. The Internet template should create entries in your web.config that look like this.

<roleManager enabled="true" defaultProvider="SimpleRoleProvider">
  <providers>
    <clear/>
    <add name="SimpleRoleProvider" type="WebMatrix.WebData.SimpleRoleProvider, WebMatrix.WebData"/>
  </providers>
</roleManager>
<membership defaultProvider="SimpleMembershipProvider">
  <providers>
    <clear/>
    <add name="SimpleMembershipProvider" type="WebMatrix.WebData.SimpleMembershipProvider, WebMatrix.WebData" />
  </providers>
</membership>

This configures the role and membership providers used by SimpleMembership. When I create an Internet template for MVC4 on my machine with VS 2012 they are always there. Make sure you are looking at the web.config in the root directory for your application, not the one in the Views directory. This information should be in the root web.config. If it is not there you need to add it for SimpleMembership to work correctly.

A2. The other providers are overridden when you put the information in your web.config, as shown in A1. Notice that the clear element is used first to clear out any previously defined providers.

A3. The InitializeSimpleMembershipAttribute is adorned on your AccountController to perform a lazy initialization of SimpleMembership. It is only called if you try to access AcccountController actions. For example, as soon as the user goes to log in it will initialize the database. This method of initialization was done so that an application created with the Internet template would still work if forms authentication is not used. I do not like this method of initialization and prefer to do it in the Global.asax Application_Start method if I am doing forms authentication. You can read how to change your app to use this initialization in this article.

If you call WebSecurity.InitializeDatabaseConnection more than once it will throw an exception. It is always a good practice to wrap it in an if statement that checks WebSecurity.Initialized.