User769259327 posted
tldr: when does the database actually get queried for functions like register user and login?
Hi,
I'm new to web development but somewhat familiar with object oriented programming and sql databases. I got a big project in mind, but right now just fiddling with things trying to figure them out.
I'm playing with the Identity namespace to handle user accounts and sessions. My project will be pretty heavy in database development so, I opened the database it created and started looking through the procedures that were generated. I'm really
wanting to know what procedures are called when so I know how the database is being altered as users interact with the website.
Here's what's tripping me up... on the C# side, I cannot figure out when the database procedures are executed. For example, creating a user.
Create User Stored Procured:
USE [CTMSasp]
GO
/****** Object: StoredProcedure [sys].[sp_adduser] Script Date: 5/28/2021 7:04:02 PM ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
ALTER procedure [sys].[sp_adduser]
@loginame sysname, -- user's login name in syslogins
@name_in_db sysname = NULL, -- user's name to add to current db
@grpname sysname = NULL -- role to which user should be added.
as
-- SETUP RUNTIME OPTIONS / DECLARE VARIABLES --
set nocount on
declare @ret int
-- LIMIT TO SQL/NT USERS IN SYSLOGINS (BCKWRD COMPAT ONLY!)
if not exists (select * from master.dbo.syslogins where loginname = @loginame
and (isntuser = 1 or isntname = 0))
and @loginame <> 'guest'
begin
raiserror(15007,-1,-1,@loginame)
return (1)
end
-- VALIDATE THE ROLENAME --
if @grpname is not null and
not exists (select * from sysusers where name = @grpname and issqlrole = 1)
begin
raiserror(15014,-1,-1,@grpname)
return (1)
end
if @name_in_db is null
select @name_in_db = @loginame
-- In Hydra only the user dbo can do this --
if (not is_member('dbo') = 1)
begin
-- AUDIT FAILED SECURITY CHECK --
dbcc auditevent (109, 1, 0, @loginame, @name_in_db, @grpname , NULL, NULL, NULL, NULL)
raiserror(15247,-1,-1)
return (1)
end
-- ADD THE USER TO THE DATABASE --
EXEC @ret = sys.sp_grantdbaccess @loginame, @name_in_db OUT
if (@ret <> 0)
return (1)
-- ADD USER TO ROLE IF GIVEN. NOP FOR 'public' --
if (@grpname is not null) and (@grpname <> 'public')
begin
EXEC @ret = sys.sp_addrolemember @grpname, @name_in_db
if @ret <> 0
begin
-- "ROLLBACK" THE ABOVE sp_grantdbaccess --
exec sys.sp_revokedbaccess @name_in_db
return (1)
end
end
-- RETURN SUCCESS --
return (0) -- sp_adduser
This seems pretty straightforward but there are a couple things I am not familiar with.
Register.cshtml.cs OnPostAsync
public async Task<IActionResult> OnPostAsync(string returnUrl = null)
{
returnUrl = returnUrl ?? Url.Content("~/");
ExternalLogins = (await _signInManager.GetExternalAuthenticationSchemesAsync()).ToList();
if (ModelState.IsValid)
{
var user = new IdentityUser { UserName = Input.Email, Email = Input.Email };
var result = await _userManager.CreateAsync(user, Input.Password);
if (result.Succeeded)
{
_logger.LogInformation("User created a new account with password.");
var code = await _userManager.GenerateEmailConfirmationTokenAsync(user);
code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
var callbackUrl = Url.Page(
"/Account/ConfirmEmail",
pageHandler: null,
values: new { area = "Identity", userId = user.Id, code = code, returnUrl = returnUrl },
protocol: Request.Scheme);
await _emailSender.SendEmailAsync(Input.Email, "Confirm your email",
$"Please confirm your account by <a href='{HtmlEncoder.Default.Encode(callbackUrl)}'>clicking here</a>.");
if (_userManager.Options.SignIn.RequireConfirmedAccount)
{
return RedirectToPage("RegisterConfirmation", new { email = Input.Email, returnUrl = returnUrl });
}
else
{
await _signInManager.SignInAsync(user, isPersistent: false);
return LocalRedirect(returnUrl);
}
}
foreach (var error in result.Errors)
{
ModelState.AddModelError(string.Empty, error.Description);
}
}
This looks to me like the method executed when a user submits the form for new user. Specifically, these seem like the important lines:
var user = new IdentityUser { UserName = Input.Email, Email = Input.Email };
var result = await _userManager.CreateAsync(user, Input.Password);
So we create a new user object and then pass it, along with a password, to the CreateAsync Method in the UserManager class. I'm tracking...
On the aspnet github:
public virtual async Task<IdentityResult> CreateAsync(TUser user, string password)
{
ThrowIfDisposed();
var passwordStore = GetPasswordStore();
if (user == null)
{
throw new ArgumentNullException("user");
}
if (password == null)
{
throw new ArgumentNullException("password");
}
var result = await UpdatePassword(passwordStore, user, password).WithCurrentCulture();
if (!result.Succeeded)
{
return result;
}
return await CreateAsync(user).WithCurrentCulture();
}
I don't really know what any of that means. But none of it looks like a command sent to a sql database. I went through the whole UserManager class and I can't figure out when exactly the database is sent a command. As I said,
it's important because I plan on customizing the database and really want to know exactly what the website will do when to it.
