Trouble Deleting Users in SimpleMembership

I came across a question in StackOverflow the other day where someone was having trouble deleting a user in the SimpleMembership provider that is now the default provider in ASP.NET MVC 4 Internet Applications.  The problem he was having was that when he called SimpleMembershipProvider.DeleteUser it was deleting the data in the UserProfile table and not in the webpages_Membership table. First a little bit on what these two tables are about.

SimpleMembership is designed to put the user information in these two tables, which have a one-to-zero-or-one relationship.  The UserProfile table has a unique UserId and a UserName, and UserProfile can be customized by the developer.  This UserId is a foreign key for the webpages_Membership table, which contains the password and other security information in it.  The reason for keeping information in these table separate is that the data in webpages_Membership is not required if OAuth is being used. If OAuth is being used then the password and other security details will be on another system.

Now back to the problem. I found it hard to believe that using DeleteUser did not remove both tables because here is what the documentation says.

This method deletes the entry in the membership account table (by default, webpages_Membership). If deleteAllRelatedData is true, all user data that is stored in the user table is also deleted.

So here is the quick and dirty test I ran.

var roles = (SimpleRoleProvider)Roles.Provider;
var membership = (SimpleMembershipProvider)Membership.Provider;

if (membership.GetUser("test", false) == null)
{
    membership.CreateUserAndAccount("test", "test");
}

bool wasDeleted = membership.DeleteUser("test", true);

I stepped through with the debugger after the CreateUserAndAccount and saw an entry for the user in both tables. Then I stepped over DeleteUser and checked the database again. The entry in UserProfile was gone but the one in webpages_Membership was still there.  This was a far cry from what the documentation described as the behavior for this method and verified what the person asking the question in StackOverflow observed.

So I thought I would try something else to see if I could come up with a workaround for this issue. Here is the code I tried.

var roles = (SimpleRoleProvider)Roles.Provider;
var membership = (SimpleMembershipProvider)Membership.Provider;

if (membership.GetUser("test", false) == null)
{
    membership.CreateUserAndAccount("test", "test");
}

bool wasDeleted = membership.DeleteAccount("test");

wasDeleted = membership.DeleteUser("test", true);

Now when I stepped through with the debugger when I hit DeleteAccount the entry from webpages_Membership was removed and then when I hit DeleteUser the entry in UserProfile was removed. Now we do not have any orphans hanging around.  Not sure if and when Microsoft will fix this bug but at least there is a workaround.

I should also point out that if you have a user mapped to roles using DeleteUser will throw a foreign key exception. You have to remove any mapped roles before you can use it.

Comments

Post a Comment

Popular posts from this blog

Using Claims in ASP.NET Identity

Claims can simplify and increase the performance of authentication and authorization processes. I wrote about how you can use the roles stored as claims to eliminate back-end queries every time authorization takes place .  ASP.NET Identity has good support for claims-based identity and it creates several claims for you automatically when you create a new identity.  Here is how we create the identity for a new user during the log-in process UserManager<applicationuser> userManager = new UserManager<applicationuser>(new UserStore<applicationuser>(new SecurityContext())); ClaimsIdentity identity = userManager.CreateIdentity(user, DefaultAuthenticationTypes.ApplicationCookie); If you inspect the Claims property of ClaimsIdentity after calling CreateIdentity you will see that there are there are three or more claims. There is a claim for the user ID, user name, identity provider and one for each role assigned. So what if you want to add some more claims? Here is an ex
Keep reading

Customizing Claims for Authorization in ASP.NET Core 2.0

Image
There have been some major changes to ASP.NET Identity with the release of Core 2.0, which you can read about here .  One of the major changes is that it does not rely on using middleware anymore to customize it.  Instead dependency injection is used by configuring via services in the ConfigureServices method of StartUp.cs .   There is not much documentation or examples on how to do this so I am going to explore how to customize ASP.NET Identity and publish some examples in this blog.  First I wanted to look at how you would add custom claims to the identity and then use those claims for authorization. To begin create a new ASP.NET Core Web Application  project in Visual Studio 2017.  Be sure to select . NET Core and ASP.NET Core 2.0 in the two drop downs at the top.  Select the template for Web Application (Model-View-Controller) and Change the Authentication to Individual User Accounts .  When the project is created you are ready to add some code. For this example we are s
Keep reading

Seeding & Customizing ASP.NET MVC SimpleMembership

Image
In ASP.NET MVC 4 Microsoft introduced a new membership provider that is referred to as SimpleMembership.  SimpleMembership makes it easier to customize user profiles and incorporates  OAuth support.  I have seen a lot of questions on StackOverflow on how to customize SimpleMembership and seed it with data and in this post I will discuss some methods for achieving both . SimpleMembership uses Entity Framework (EF) 5 and the code-first model. To initialize the database that contains the users and roles a filter is used called  InitializeSimpleMembershipAttribute.   This attribute is decorated on the AccountController as shown here: [Authorize] [InitializeSimpleMembership] public class AccountController : Controller { ... } This is setup this way so that the initialization code is only called when accessing the actions on the AccountController .  If you look at the code for  InitializeSimpleMembershipAttribute you will see a lot of code to setup initialization which is basically
Keep reading