Migrate from SQL membership to asp.net identity

If your EPiServer website is still on ASP.Net membership system, think the ASP.NET membership system was introduced with ASP.NET 2.0 back in 2005, and since then there have been many changes in the ways web applications typically handle authentication and authorization. Your organization may be looking for a multifactor authentication or want to move the responsibility for identification to some other party. Whatever the solution that your organization will be choosing, most probably, the first step that you will have to do is migrate your website to ASP.Net Identity and migrate existing membership users to Identity so they could log in without any hitch. The solution can be different for different infrastructures, under this post, I am collecting bits and pieces at one place that we will require doing this. Proposed solution is based on http://world.episerver.com/documentation/developer-guides/CMS/security/episerver-aspnetidentity/.

1. Install the following NuGet package, EPiServer.CMS.UI.AspNetIdentity

• This means Users, roles and access rights can be managed from admin view of episerver
• Implements the UIUsersManager, UIRoleManager, SecurityEntityProvider and SignInManager providers

2. Set the authentication mode in the system.web section of the web.config file as following

<authentication mode="None"></authentication>

3. Clear the membership and rolemanager providers from web.config as following

<membership><providers><clear /></providers></membership>
<roleManager enabled="false"><providers><clear /></providers></roleManager>

4. Prepare OWIN pipeline to use in a startup class to configure the application

https://gist.github.com/khurramkhang/08409560f9b04cb1520a1e6321220c18  

Alternatives: use default app.AddCmsAspNetIdentity<ApplicationUser>(); but we will not be able to add custom stuff that we will require e.g. password hashing.

5. Prepare SQL Hasher to allow migrated user login with their old password

https://gist.github.com/khurramkhang/f279284f2aecbed80ac1bbafe046c945 

6. Build OWIN pipeline in a startup class needed to configure the application

[assembly: OwinStartup(typeof(Startup))]

public void Configuration(IAppBuilder app)
{
   string loginPath = "/util/login.aspx";

            // Add CMS integration for ASP.NET Identity
            //https://gist.github.com/khurramkhang/08409560f9b04cb1520a1e6321220c18
            app.SetupAspNetIdentity<ApplicationUser>();

            // Use cookie authentication
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString(loginPath),
                Provider = new CookieAuthenticationProvider
                {
                    OnValidateIdentity =
                        SecurityStampValidator
                            .OnValidateIdentity<ApplicationUserManager<ApplicationUser>, ApplicationUser>(
                                validateInterval: TimeSpan.FromMinutes(30),
                                regenerateIdentity: (manager, user) => manager.GenerateUserIdentityAsync(user))
                }
            });
}

7. Compile and run your application, browse to episerver cms login page and try to use your existing login, This will result a login failure as you are required to migrate users from membership to asp.net identity tables. Till this stage following new tables would have been created in episerver db

• AspNetRoles
• AspNetUserClaims
• AspNetUserLogins
• AspNetUserRoles
• AspNetUsers

8. You can use following script to migrate users to ASP.Net Identity, Password hasher will resolve password with HMACSHA512 hashing
https://gist.github.com/khurramkhang/f9110994e6dd771db87e0e26a394c557 

References:

http://world.episerver.com/documentation/developer-guides/CMS/security/episerver-aspnetidentity/

http://sveinaandahl.blogspot.nl/2015/08/how-to-integrate-aspnet-identity-with.html

https://docs.microsoft.com/en-us/aspnet/identity/overview/getting-started/introduction-to-aspnet-identity

https://docs.microsoft.com/en-us/aspnet/identity/overview/migrations/migrating-an-existing-website-from-sql-membership-to-aspnet-identity

Alternative approach: http://sveinaandahl.blogspot.nl/2015/08/how-to-integrate-aspnet-identity-with.html