ASP.NET MVC Custom Membership Provider "CreateUser"

I've implemented some basic, custom membership provider for my ASP.NET MVC application so I thought that all validation will be done in my custom code.

Unfortunately when I'm trying to create new user by calling function:

Membership.CreateUser(user.UserName, user.Password, user.Email, null, null, true, Guid.NewGuid(), out status);

which should eventually throw an exception with all validation errors I'm getting a status like "InvalidUserName" or "InvalidPassword" instead... That means that my custom CreateUser function isn't call directly, it's used after some basic validation which I would wish to skip.

My CreateUser function (in my custom provider):

public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
{
    try
    {

        User user = new User();
        user.UserKey = Guid.NewGuid();
        user.UserName = username;
        user.passwordSalt = string.Empty;
        user.Password = this.TransformPassword(password, ref user.passwordSalt);
        user.Email = email;
        user.PasswordQuestion = passwordQuestion;
        user.PasswordAnswer = passwordAnswer;
        user.CreationDate = DateTime.Now;
        user.LastActivityDate = DateTime.Now;
        user.LastLoginDate = DateTime.MinValue;
        user.LastPasswordChangeDate = DateTime.Now;

        this._UsersRepository.SaveUser(user);

        status = MembershipCreateStatus.Success;
        return CreateMembershipFromInternalUser(user);


    }
    catch(RuleException ex)
    {
        throw ex;
    }
}

Do you know how to enforce direct usage of custom CreateUser function !?

---

But I'm not using a default ASP.NET MVC project's AccountController...

Just take a look:

[AcceptVerbs(HttpVerbs.Post)]
public ViewResult Register(User user, string password_confirm, bool acceptsTerms)
{
    if (!acceptsTerms)
        ModelState.AddModelError("acceptsTerms", "Musisz zaakceptować regu开发者_如何学Golamin");

    if (ModelState.IsValid)
    {
        try
        {
            MembershipCreateStatus status = new MembershipCreateStatus();
            Membership.CreateUser(user.UserName, user.Password, user.Email, null, null, true, Guid.NewGuid(), out status);
        }
        catch (RuleException ex){
            ex.CopyToModelState(ModelState,"user");
        }
    }

    return View();
}

The point is that I'm getting a status instead of RuleException ex when user.UserName or user.Password is empty. My custom RuleException ex would give me back such informations as well. Where a status value is assigned right now !? Bacouse it's not done in my implementation of CreateUser...

---

I am using this (MVC3) and I have no issues:

[HttpPost]
public ActionResult Register(RegisterModel model)
{
    if (ModelState.IsValid)
    {
        MembershipCreateStatus status;
        Membership.Provider.CreateUser(model.UserName, model.Password, model.Email, "", "", true, Guid.NewGuid(), out status);

        if (status == MembershipCreateStatus.Success)
        {
            FormsService.SignIn(model.UserName, false);
            return RedirectToAction("Index", "Home");
        }
        else
        {
            ModelState.AddModelError("", AccountValidation.ErrorCodeToString(status));
        }
    }

    // If we got this far, something failed, redisplay form
    ViewBag.PasswordLength = MembershipService.MinPasswordLength;
    return View(model);
}

---

Using ILSpy to view the static method Membership.CreateUser, you will find it performs validation on

• Username (trim whitespace + not null, not empty)
• Password (trim whitespace + not null, not empty, length checks)
• Email (trim whitespace)
• Password Question (trim whitespace + not empty)
• Password Answer (trim whitespace + not empty)

It then calls the custom provider.

The key here is to not call the static method CreateUser

Membership.CreateUser(...)

Rather, call the custom provider directly by using:

Membership.Provider.CreateUser(...)

Tested and verified working, as of .NET 4

While my site recommends having a password, we support openid. So forcing a user to have a password just seemed counter to what openid is good for.

---

Complete rewrite

The ASP.NET Membership system always does some initial validation of the inputs when APIs such as CreateUser are called.

I don't know of any way around this aside from not going directly to the ASP.NET membership APIs.