User/Password Database

• To authenticate users, the developer must either create a database with authorized user names and passwords or allow visitors to create their own. The free Microsoft Visual Web Developer includes a step to do this. Download the Developer through the Resources link.
  
  Open the Developer and create a new website by clicking on "File," "New Website" and selecting an ASP.NET website from the options. Pick a new name and file location in the input box on this page. When the working menu appears, click on "Website" and select "ASP.NET configuration" in the drop-down menu. This opens a website administration tool. Among the options is that the developer chooses between Windows and forms-based authentication. Under a "Security" tab will be a section to either add users and passwords or allow people to create their own. The Web Developer software automatically creates the database.
  
  

Authentication Setup

• Creating the actual screens for Windows and forms-based authentication uses exactly the same process. The only real difference is that for security in a Windows authentication environment, which runs in conjunction with Internet Information Services, it is a good idea to use the security protections of the NTFS files system and User Access Control. Another approach is to use the ASP.NET Role Management system, which assigns users to various levels that control their access to aspects of the application. This happens during the initial setup described above. An example of this kind of authentication is the use in the Windows system itself to create roles for Administrators, Users, Power Users or Guests.
  
  

Authentication Web Pages

• You build a Web page to hold the authentication input in the Visual Web Developer by clicking on "File," "New File" and "Web Form." Name this form something like "Logon" with an .aspx extension (assigned automatically). In the "Design" view (selected at the bottom of the screen) on the left is a Toolbox. When you expand the section headed "Login" you will see "CreateUserWizard." Double-click on this and the wizard finishes the basic process of building an authentication page. The screen is customizable with options, such as setting controls on the format of a password or display properties---fonts, borders, colors---as well as adding special pop-up error messages. The image shows on one screen the use of multiple tools to create pages to let the user create a new account, simply log in with her own user name and password, retrieve a forgotten password or change a password. Normally, these would be on separate pages.
  
  

Warning

• Testing the logon pages described above on your own PC may require changes in how the security and firewall are set up on the computer, for example, to allow access to the required port on the computer. To test on a Web server, change the authentication method from Windows to forms-based, as described, and upload the application.