source: branches/HeuristicLab.Services.Authentication Prototype/Service/Provider/HeuristicLabMembershipProvider.cs @ 3957

using System;
using System.Configuration.Provider;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Web.Configuration;
using System.Web.Security;
using Persistence;

namespace Service.Provider {
  class HeuristicLabMembershipProvider : MembershipProvider {

      private string pApplicationName;
      private bool pEnablePasswordReset;
      private bool pEnablePasswordRetrieval;
      private bool pRequiresQuestionAndAnswer;
      private bool pRequiresUniqueEmail;
      private int pMaxInvalidPasswordAttempts;
      private int pPasswordAttemptWindow;
      private MembershipPasswordFormat pPasswordFormat;
      private MachineKeySection machineKey;

      public override string ApplicationName {
      get {
        throw new NotImplementedException();
      }
      set {
        throw new NotImplementedException();
      }
    }

    public override bool ChangePassword(string username, string oldPassword, string newPassword) {
      using (DataClassesDataContext db = DatabaseUtil.createDataClassesDataContext()) {
        // check database connection
        if (db == null) {
          return false;
        }
        try {
          // try to get user
          HeuristicLabUser u = db.HeuristicLabUsers.Single(x => x.UserName == username);
          if (u.ChangePassword(oldPassword, newPassword)) {
            // save user to database only if needed
            db.SubmitChanges();
            return true;
          } else {
            return false;
          }
        }
        catch (Exception) {
          return false;
        }
      }
    }

    public override bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer) {
      using (DataClassesDataContext db = DatabaseUtil.createDataClassesDataContext()) {
        // check database connection
        if (db == null) {
          return false;
        }
        try {
          // try to get user
          HeuristicLabUser u = db.HeuristicLabUsers.Single(x => x.UserName == username);
          if (u.ChangePasswordQuestionAndAnswer(password, newPasswordQuestion, newPasswordAnswer)) {
            // save user to database only if needed
            db.SubmitChanges();
            return true;
          } else {
            return false;
          }
        }
        catch (Exception) {
          return false;
        }
      }
    }

    public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status) {
      using (DataClassesDataContext db = DatabaseUtil.createDataClassesDataContext()) {
        // check database connection
        if (db == null) {
          status = MembershipCreateStatus.ProviderError;
          return null;
        }
        try {
          // check for duplicate entries
          if (db.HeuristicLabUsers.Count(x => x.UserName == username) > 0) {
            status = MembershipCreateStatus.DuplicateUserName;
            return null;
          }
          if (db.HeuristicLabUsers.Count(x => x.Email == email) > 0) {
            status = MembershipCreateStatus.DuplicateEmail;
            return null;
          }

          // create new user
          HeuristicLabUser u = new HeuristicLabUser(username, email, passwordQuestion, "");
          u.ChangePassword("INIT", password);
          u.ChangePasswordQuestionAndAnswer(password, passwordQuestion, passwordAnswer);
          // save user into database
          db.HeuristicLabUsers.InsertOnSubmit(u);
          db.SubmitChanges();

          // success
          status = MembershipCreateStatus.Success;
          return u;
        }
        catch (Exception) {
          // error
          status = MembershipCreateStatus.ProviderError;
          return null;
        }
      }
    }

    public override bool DeleteUser(string username, bool deleteAllRelatedData) {
      using (DataClassesDataContext db = DatabaseUtil.createDataClassesDataContext()) {
        // check database connection
        if (db == null) {
          return false;
        }
        try {
          // try to get user
          HeuristicLabUser u = 
            db.HeuristicLabUsers.Single<HeuristicLabUser>(x => x.UserName == username);

          // optionally delete related data
          if (deleteAllRelatedData) {
            db.HeuristicLabUserRole.DeleteAllOnSubmit<HeuristicLabUserRole>(u.HeuristicLabUserRole);
          }
          
          // delete user
          db.HeuristicLabUsers.DeleteOnSubmit(u);
          db.SubmitChanges();
          return true;
        }
        catch (Exception) {
          return false;
        }
      }
    }

    public override bool EnablePasswordReset {
      get { throw new NotImplementedException(); }
    }

    public override bool EnablePasswordRetrieval {
      get { throw new NotImplementedException(); }
    }

    public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords) {
      throw new NotImplementedException();
    }

    public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords) {
      throw new NotImplementedException();
    }

    public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords) {
      throw new NotImplementedException();
    }

    public override int GetNumberOfUsersOnline() {
      throw new NotImplementedException();
    }

    public override string GetPassword(string username, string answer) {

      throw new NotImplementedException();
    }

    public override MembershipUser GetUser(string username, bool userIsOnline) {
      throw new NotImplementedException();
    }

    public override MembershipUser GetUser(object providerUserKey, bool userIsOnline) {
      throw new NotImplementedException();
    }

    public override string GetUserNameByEmail(string email) {
      throw new NotImplementedException();
    }

    public override int MaxInvalidPasswordAttempts {
      get { throw new NotImplementedException(); }
    }

    public override int MinRequiredNonAlphanumericCharacters {
      get { throw new NotImplementedException(); }
    }

    public override int MinRequiredPasswordLength {
      get { throw new NotImplementedException(); }
    }

    public override int PasswordAttemptWindow {
      get { throw new NotImplementedException(); }
    }

    public override MembershipPasswordFormat PasswordFormat {
      get { throw new NotImplementedException(); }
    }

    public override string PasswordStrengthRegularExpression {
      get { throw new NotImplementedException(); }
    }

    public override bool RequiresQuestionAndAnswer {
      get { throw new NotImplementedException(); }
    }

    public override bool RequiresUniqueEmail {
      get { throw new NotImplementedException(); }
    }

    public override string ResetPassword(string username, string answer) {
      throw new NotImplementedException();
    }

    public override bool UnlockUser(string userName) {
      throw new NotImplementedException();
    }

    public override void UpdateUser(MembershipUser user) {
      throw new NotImplementedException();
    }
    /// <summary>
    /// Validates a user
    /// </summary>
    /// <param name="username"></param>
    /// <param name="password"></param>
    /// <returns></returns>
    public override bool ValidateUser(string username, string password)
    {
        bool isValid = false;
        using (DataClassesDataContext db = DatabaseUtil.createDataClassesDataContext())
        {
            if (db == null)
            {
                return false;
            }
            HeuristicLabUser u = db.HeuristicLabUsers.Single(x => x.UserName == username);
            isValid = CheckPassword(password, u.GetPassword());
        }
        return isValid;
    }
    
    /// <summary>
    /// compaiers to passwords
    /// </summary>
    /// <param name="password"></param>
    /// <param name="dbpassword"></param>
    /// <returns></returns>
    private bool CheckPassword(string password, string dbpassword)
    {
        string pass1 = password;
        string pass2 = dbpassword;

        switch (PasswordFormat)
        {
            case MembershipPasswordFormat.Encrypted:
                pass2 = DecodePassword(dbpassword);
                break;
            case MembershipPasswordFormat.Hashed:
                pass1 = EncodePassword(password);
                break;
            default:
                break;
        }

        if (pass1 == pass2)
        {
            return true;
        }

        return false;
    }


   /// <summary>
   /// Encodes a password
   /// </summary>
   /// <param name="password"></param>
   /// <returns></returns>
   private string EncodePassword(string password)
    {
        string encodedPassword = password;

        switch (PasswordFormat)
        {
            case MembershipPasswordFormat.Clear:
                break;
            case MembershipPasswordFormat.Encrypted:
                encodedPassword =
                  Convert.ToBase64String(EncryptPassword(Encoding.Unicode.GetBytes(password)));
                break;
            case MembershipPasswordFormat.Hashed:
                HMACSHA1 hash = new HMACSHA1();
                hash.Key = HexToByte(machineKey.ValidationKey);
                encodedPassword =
                  Convert.ToBase64String(hash.ComputeHash(Encoding.Unicode.GetBytes(password)));
                break;
            default:
                throw new ProviderException("Unsupported password format.");
        }

        return encodedPassword;
    }


    /// <summary>
    /// Decodes a encoded Password
    /// </summary>
    /// <param name="encodedPassword"></param>
    /// <returns></returns>
    private string DecodePassword(string encodedPassword)
    {
        string password = encodedPassword;

        switch (PasswordFormat)
        {
            case MembershipPasswordFormat.Clear:
                break;
            case MembershipPasswordFormat.Encrypted:
                password =
                  Encoding.Unicode.GetString(DecryptPassword(Convert.FromBase64String(password)));
                break;
            case MembershipPasswordFormat.Hashed:
                throw new ProviderException("Cannot unencode a hashed password.");
            default:
                throw new ProviderException("Unsupported password format.");
        }

        return password;
    }

    /// <summary>
    /// returns byte array  of an HexString
    /// </summary>
    /// <param name="hexString"></param>
    /// <returns></returns>
    private static byte[] HexToByte(string hexString)
    {
        byte[] returnBytes = new byte[hexString.Length / 2];
        for (int i = 0; i < returnBytes.Length; i++)
            returnBytes[i] = Convert.ToByte(hexString.Substring(i * 2, 2), 16);
        return returnBytes;
    }
  }
}