ASP.NET Identity is Microsoft’s fourth and by far its best iteration of an authentication/authorization system that’s built right into ASP.NET. It’s super flexible and extensible, yet easy to use and ready to go right out of the box.

That ease of use is achieved in part thanks to a default backing store provider based on Entity Framework that comes already set up in the template. That’s fine and dandy for quickly and painlessly getting from File -> New Project to a web application with a fully operational membership system. However, as you begin to develop that web application you might find yourself wanting that ASP.NET Identity goodness without the baggage that comes with Entity Framework.

Now, I’m not knocking Entity Framework. It’s a fine ORM that has plenty of good uses. More often than not however, whether building small websites or large-scale web applications, I find myself choosing a Micro ORM like Dapper or Massive over a more traditional ORM like Entity Framework or NHibernate to power my data layer.

Getting Started

Let’s start by opening up Visual Studio 2013 and creating a new project of type “ASP.NET Web Application” and choosing to use the standard MVC template with “Individual User Accounts” as the authentication type.

This will start us off with a fully functioning ASP.NET MVC5 web application including all of the models, views and controllers needed to manage user accounts with ASP.NET Identity. This also includes Entity Framework’s Identity providers that provide a backing store for ASP.NET Identity to store all of the data it needs to operate in an EF code-first-generated local database.

You can hit F5 right here and launch a completely functional website without writing a single line of code. But where’s the fun in that?

Database

Out of the box, Entity Framework was kind enough to provide us with a database that we don’t have to design, configure or implement. Pretty nice. So without Entity Framework, we’re going to need to create our own database the old fashioned way. Like cavemen.

For this demo, I created a very simple database with just two tables:

CREATE TABLE [dbo].[Users]
(
    [UserId] UNIQUEIDENTIFIER NOT NULL PRIMARY KEY, 
    [UserName] VARCHAR(MAX) NOT NULL, 
    [PasswordHash] VARCHAR(MAX) NULL, 
    [SecurityStamp] VARCHAR(MAX) NULL 
)

CREATE TABLE [dbo].[ExternalLogins]
(
    [ExternalLoginId] UNIQUEIDENTIFIER NOT NULL PRIMARY KEY, 
    [UserId] UNIQUEIDENTIFIER NOT NULL, 
    [LoginProvider] VARCHAR(MAX) NOT NULL, 
    [ProviderKey] VARCHAR(MAX) NOT NULL, 
    CONSTRAINT [FK_ExternalLogins_Users] FOREIGN KEY ([UserId]) REFERENCES [Users]([UserId])
)

These tables have the minimum set of columns required to support the ASP.NET Identity functionality included by default in the template we chose, which is user authentication that uses local usernames/passwords and/or third-party accounts like Google or Facebook.

Models

For user info, ASP.NET Identity has a very generous BYOP policy (bring your own POCO). All it asks is that our POCO implements its IUser interface. I created one that matches my Users table:

public class User : IUser
{
    public Guid UserId { get; set; }
    public string UserName { get; set; }
    public string PasswordHash { get; set; }
    public string SecurityStamp { get; set; }

    string IUser.Id
    {
        get { return UserId.ToString(); }
    }
}

The IUser interface only requires two properties. The first is “string UserName { get; set; }”, which fits my database table perfectly. It also requires a “string Id { get; }” and that doesn’t quite fit. The primary keys in my database are uniqueidentifiers that follow my own naming convention. So I made the primary key in my POCO match my database and then explicitly implemented a wrapper property to satisfy the needs of the IUser interface.

UserStore Provider

Ah, and now the fun part. ASP.NET Identity needs a way to interact with our POCOs and talk to our database. To do this, we need to provide a class that wires everything up. There are four interfaces that we’ll implement in the process.

IUserStore

This interface is used by ASP.NET Identity to persist and retrieve user accounts to and from our database. For my implementation I used Dapper, an open source micro ORM created by the smart folks over at StackOverflow. It provides some handy extensions on any IDbConnections that make interacting with your database using models or dynamic objects super easy.

IUserLoginStore

Because our demo includes support for logging in without a username and password (using a third party like Google or Facebook), we need to give Identity a way to persist external login information in addition to user accounts. We do that through the IUserLoginStore interface, which I implemented using Dapper again.

IUserPasswordStore and IUserSecurityStampStore

One of the nice things about ASP.NET Identity is that it doesn’t make any assumptions about the way in which your solution handles the storage and retrieval of any user account information. This includes the password hash and security stamp, which I chose to store right in my Users table. So the implementation of these interfaces was simple: I just access the password hash and security stamp properties on my User POCO and let Dapper do the rest.

public class UserStore : IUserStore<User>, IUserLoginStore<User>, IUserPasswordStore<User>, IUserSecurityStampStore<User>
{
    private readonly string connectionString;

    public UserStore(string connectionString)
    {
        if (string.IsNullOrWhiteSpace(connectionString))
            throw new ArgumentNullException("connectionString");

        this.connectionString = connectionString;
    }

    public UserStore()
    {
        this.connectionString = ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString;
    }

    public void Dispose()
    {

    }

    #region IUserStore
    public virtual Task CreateAsync(User user)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        return Task.Factory.StartNew(() => {
            user.UserId = Guid.NewGuid();
            using (SqlConnection connection = new SqlConnection(connectionString))
                connection.Execute("insert into Users(UserId, UserName, PasswordHash, SecurityStamp) values(@userId, @userName, @passwordHash, @securityStamp)", user);
        });
    }

    public virtual Task DeleteAsync(User user)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                connection.Execute("delete from Users where UserId = @userId", new { user.UserId });
        });
    }

    public virtual Task<User> FindByIdAsync(string userId)
    {
        if (string.IsNullOrWhiteSpace(userId))
            throw new ArgumentNullException("userId");

        Guid parsedUserId;
        if (!Guid.TryParse(userId, out parsedUserId))
            throw new ArgumentOutOfRangeException("userId", string.Format("'{0}' is not a valid GUID.", new { userId }));

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                return connection.Query<User>("select * from Users where UserId = @userId", new { userId = parsedUserId }).SingleOrDefault();
        });
    }

    public virtual Task<User> FindByNameAsync(string userName)
    {
        if (string.IsNullOrWhiteSpace(userName))
            throw new ArgumentNullException("userName");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                return connection.Query<User>("select * from Users where lower(UserName) = lower(@userName)", new { userName }).SingleOrDefault();
        });
    }

    public virtual Task UpdateAsync(User user)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                connection.Execute("update Users set UserName = @userName, PasswordHash = @passwordHash, SecurityStamp = @securityStamp where UserId = @userId", user);
        });
    }
    #endregion

    #region IUserLoginStore
    public virtual Task AddLoginAsync(User user, UserLoginInfo login)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        if (login == null)
            throw new ArgumentNullException("login");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                connection.Execute("insert into ExternalLogins(ExternalLoginId, UserId, LoginProvider, ProviderKey) values(@externalLoginId, @userId, @loginProvider, @providerKey)",
                    new { externalLoginId = Guid.NewGuid(), userId = user.UserId, loginProvider = login.LoginProvider, providerKey = login.ProviderKey });
        });
    }

    public virtual Task<User> FindAsync(UserLoginInfo login)
    {
        if (login == null)
            throw new ArgumentNullException("login");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                return connection.Query<User>("select u.* from Users u inner join ExternalLogins l on l.UserId = u.UserId where l.LoginProvider = @loginProvider and l.ProviderKey = @providerKey",
                    login).SingleOrDefault();
        });
    }

    public virtual Task<IList<UserLoginInfo>> GetLoginsAsync(User user)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                return (IList<UserLoginInfo>)connection.Query<UserLoginInfo>("select LoginProvider, ProviderKey from ExternalLogins where UserId = @userId", new { user.UserId }).ToList();
        });
    }

    public virtual Task RemoveLoginAsync(User user, UserLoginInfo login)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        if (login == null)
            throw new ArgumentNullException("login");

        return Task.Factory.StartNew(() =>
        {
            using (SqlConnection connection = new SqlConnection(connectionString))
                connection.Execute("delete from ExternalLogins where UserId = @userId and LoginProvider = @loginProvider and ProviderKey = @providerKey",
                    new { user.UserId, login.LoginProvider, login.ProviderKey });
        });
    }
    #endregion

    #region IUserPasswordStore
    public virtual Task<string> GetPasswordHashAsync(User user)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        return Task.FromResult(user.PasswordHash);
    }

    public virtual Task<bool> HasPasswordAsync(User user)
    {
        return Task.FromResult(!string.IsNullOrEmpty(user.PasswordHash));
    }

    public virtual Task SetPasswordHashAsync(User user, string passwordHash)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        user.PasswordHash = passwordHash;

        return Task.FromResult(0);
    }

    #endregion

    #region IUserSecurityStampStore
    public virtual Task<string> GetSecurityStampAsync(User user)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        return Task.FromResult(user.SecurityStamp);
    }

    public virtual Task SetSecurityStampAsync(User user, string stamp)
    {
        if (user == null)
            throw new ArgumentNullException("user");

        user.SecurityStamp = stamp;

        return Task.FromResult(0);
    }

    #endregion
}

What’s with “connection.Execute” and “connection.Query”?

If you copied and pasted the class above into your project you may have noticed that the “Execute” and “Query” extensions I call on the “connection” object in several methods are not found. These are extensions provided by Dapper, the micro ORM I mentioned earlier. It’s free, open source and very well supported. You can get it on NuGet just by typing “Dapper” in the search box. Don’t forget to include the “using Dapper;” directive at the top of your class file.

If you don’t want to use Dapper, this solution will work just fine. However you’ll need to replace my Dapper method calls with straight-up ADO.NET or your favorite ORM.

Goodbye Entity Framework

We’re now ready to remove Entity Framework from our project. You can start by removing the “ApplicationUser” and “ApplicationDbContext” classes. We’ve got our own user model now and have no need for an Entity Framework DbContext.

Next, we have just a few changes to make to the Account Controller. First, because we’re not using the provided “ApplicationUser” model instead using our “User” model, we need to replace all references in the Account Controller to the ApplicationUser class with references to our new User class.

We also need to modify the parameterless constructor to instantiate our newly created UserStore instead of Entity Framework’s UserStore. It should look like this:

public AccountController()
    : this(new UserManager<User>(new UserStore()))
{
}
public AccountController(UserManager<User> userManager)
{
    UserManager = userManager;
}

And finally, we can remove the references to EntityFramework and EntityFramework.Identity from our project.

If you’d like to see a working example of this technique, I’ve uploaded a solution complete with database to a GitHub project here: https://github.com/mark-j/DapperIdentityDemo