We have a client who uses SSN as their username (we have told them how bad of an idea this is).   We need to mask their SSN and then encrypt it in the DB.

We decided to create a custom membership provider, but use the DNN membership provider as a template. 

We have modified the aspnet SP to encrypt the username when creating the user.  It isn't authenticating properly on login because the DB username is encrypted and the passed in username isn't.  We couldn't find a SP that was used for login?  How does this work?  For login we were hoping to find a SP where we could encrypt the incoming username and compare to what was in the DB.

Thanks for your time.

Chad

Brandon,

Thank you for your reply.  I think what you are trying to say is encrypt it before going into the DB?  Either way works for us.

I have been looking all over the web for something similiar to what you have suggested.  I understand the concept but I just need a start in the right direction.

The entire site will be https, so that isn't an issue.

Thanks again for your help.

Chad

Hi Chad,

Looks like that's the basic idea.  The general pattern will read something like:

Public Class MyMembershipProvider : SqlMembershipProvider

Public Overrides Sub UpdateUser(ByVal user As MembershipUser)

user.Username = EncryptUserName(user.Username)

MyBase.UpdateUser(user)

End Sub

Public Overrides Function GetUser(ByVal providerUserKey As Object, ByVal userIsOnline As Boolean) As MembershipUser

Dim user As MembershipUser = MyBase.GetUser(providerUserKey, userIsOnline)

user.UserName = DecryptUserName(user.UserName)

Return user

End Function

... the rest of the functions that deal with MembershipUsers or UserNames ...

Private Function EncryptUserName(ByVal username As String) As String

...

End Function

Private Function DecryptUserName(ByVal encryptedUsername As String) As String ...

End Class

Deploy this class as a compiled assembly to your bin directory, update your web.config, and you should be more or less ready to go.

Note that there is probably a better implementation that utilizes decoration to accept and return decorated (and undecorated) MembershipUsers, but since that is a bit more complex to implement I went with the straightforward method.

You also could probably gain some additional security by hooking into the EncryptPassword and DecryptPassword implementations for your username encryption/decryption.  Doing so would require conversion to and from byte arrays, but you would gain the already solid encryption implementation.

Hope this helps!

Brandon