Wahlin on .NET

Authenticating Users with ASP.NET AJAX

Dan walks you through configuring this method as well as walks you through all the parameters.

• By Dan Wahlin
• 09/01/2007

However, each time a user logs in to your application, a postback operation occurs which, in some situations, may not be desirable. In cases where you'd like to log users into a Web site without performing a complete postback of a page, you can use the ASP.NET AJAX authentication service instead.

The authentication service consists of a service that lives on the Web server that accesses membership information from the database, as well as a client-side class named AuthenticationService (located in the Sys.Services namespace) that is built into the ASP.NET AJAX script library. The AuthenticationService class knows how to call the membership service using the XmlHttpRequest object behind the scenes.

To use the AuthenticationService class to log users in or out of a Web site, you must first enable the authentication service on the server. This is done by adding code into web.config as shown below.

<system.web.extensions>
 <scripting>
  <webServices>
   <authenticationService enabled="true" />
  </webServices>
 </scripting>
</system.web.extensions>

This code enables calls to a file named _AppService.axd to be made behind the scenes and allows membership credentials to be passed and validated. _AppService.axd doesn't actually exist as a physical file; it's really an alias for an HttpHandler named ScriptResourceHandler that's responsible for handling log-in and log-out functionality within ASP.NET AJAX applications. ScriptResourceHandler is configured automatically when you create an ASP.NET AJAX-enabled Web site in Visual Studio .NET 2005, as shown in the following code:

<httpHandlers>
  ...
 <add verb="*" path="*_AppService.axd" validate="false" 
  type="System.Web.Script.Services.ScriptHandlerFactory, 
  System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, 
  PublicKeyToken=31bf3856ad364e35"/>
 ...
</httpHandlers>

Once you've enabled the ASP.NET AJAX authentication service in web.config (as shown in Listing 1), you can use the client-side AuthenticationService class to log users into a Web site using an asynchronous postback operation. The AuthenticationService exposes login() and logout() methods, as well as several different properties. Each of the properties is described in the chart below.

The AuthenticationService's login() method performs an asynchronous postback operation that calls the ScriptHandlerFactory HttpHandler mentioned earlier to log a user into a Web site. The overall process still involves setting a cookie containing the ASP.NET membership authentication ticket in it as with standard ASP.NET applications, but the cookie is set without reloading the entire page. The login() method accepts several different parameters, as shown here:

You can see that login() takes quite a few parameters, although several of them are optional. The key parameters are userName, password and loginCompletedCallback.

Listing 1 shows an example of using the AuthenticationService's login() method to attempt to log a user into a Web site. The code first calls the AuthenticationService class's login() method and passes in the user name, password, log-in completed callback handler and failure handler. If the log-in attempt completes successfully, the method named OnLoginCompleted() is called. You know if the user successfully logged in or not by checking the isValid parameter. If the log-in attempt fails due to the service being unavailable or other circumstances, the OnLoginFailure() method is called, letting the user know that they're not able to log in at this time.

To log a user out of a Web site, you can call the AuthenticationService's logout() method. Be aware that this method will cause a full-page postback operation to occur to ensure that the authentication cookie is properly removed from the user's browser. This is standard behavior, so don't waste any time trying to figure out why an asynchronous postback isn't occurring.

Parameters that the logout() method accepts are shown here:

Listing 2 shows an example of calling the logout() method to remove the authentication cookie from the users browser and log them out of a Web site. It defines a log-out completed callback method, as well as a failure callback method.

In this article, you've been introduced to the fundamentals of using the ASP.NET AJAX authentication service and seen how the AuthenticationService class's login() and logout() methods can be used to access ASP.NET membership provider information. In the next article, I'll discuss another ASP.NET AJAX service called the profile service, and demonstrate how you can also access user profile information in AJAX applications.