How to lock/unlock a user in MVC SimpleMembership

Question

In SimpleMembership there isn't any column in the database for a user to be locked/unlocked. I basically need my administrator to enable or disable any user in my application. Is there any alternatives to that?

Answer 1

I find it easiest to use Roles to do this. Have a ActiveUser role and tag your controllers or actions with a Authorize attribute.

[Authorize(Roles = "ActiveUser")]

Then some simple admin to add or remove users from the role to unlock and lock their access to everything protected with that roles attribute.

Roles.AddUserToRole(user.Username, "ActiveUser");

Roles.RemoveUserFromRole(user.Username, "ActiveUser");

Answer 2

I haven't tried simplemembership yet, but this sound great for some of the small projects I am working on. Here are some options:

Option 1 : Add a custom field to the table like shown here - http://www.dwdmbi.com/2012/10/adding-custom-fields-to-vs2012-mvc4.html

Option 2 Create a new table with a foreign key back to User. Do an additional check on this value.

Either way your are going to something extra for the check. You can customize the 'Authorize' attribute to include your check (instructions here - Override Authorize Attribute in ASP.NET MVC ).

Answer 3

Probably not the "approved" way of doing things, but this is how I do it.

There is a field within the webpages_Membership table called IsConfirmed . Typically, this is for when you want a 2-stage registeration process: sign-up then activate via a link within an email. By nature though, this field has the same affect as IsApproved within the former aspnet_Membership table: if set to true, a user can login; if false they can't. So I just use plain old SQL to set to true or false:

// If using EntityFramework
// 1. Setup my params
var params = new List<SqlParameter>() { 
      new SqlParameter("@UserID", 1),
      new SqlParameter("@Activate", true) // or false
};

SqlParameter[] paramArray = params.ToArray();

// 2. Update the database
myDbContext.Database.ExecuteSqlCommand("UPDATE webpages_Membership SET IsConfirmed = @Activate WHERE UserId = @UserID", paramArray);

Answer 4

try this approach. It uses IsApproved rather than the IsLockedOut. If your implementation does not already use IsAproved, this would be a good solution.

MembershipUser user = Membership.GetUser(username);
user.IsApproved = false;
Membership.UpdateUser(user);

This is not exactly locking the user. Technically this call is taking approved status from the user and leaving them unable to log-in.

Answer 5

I dont know the technology you are using but either you have to give column in the table with lock unlock as you specified or siply add one table in the database(Say tlbDisable) where you can delete the entries in original table and insert it in new table(tlbDisable).

When you again want to enable that user then simple delete the entry from tlbDisable and insert it into original user table.