I’m working with a colleague on a new ASP.NET MVC web application, and for various reasons he needed to implement some login security for the public.  So he decided to use the built in security provider that was built on top of the ASP.NET provided IMembershipProvider.

Now I have written my own implementation of a IMembershipProvider, and so I totally understand how it works (along with the role provider and the personalization provider); so my colleague asks me to explain how it all works (he is a fairly new programmer in the asp.net sphere)…

and that’s where I say “Oy Vay, do you have about a week to read, study, run tutorials and make hello world test beds?  because that is the only way you will really come to understand how it all works together.”

Because let’s face it folks its a MESS.  of all the things that is in DESPERATE need of being rebuilt from the ground up, using best lessons of all the things we now need security to do / support, the I<Security> framework needs it the most.

What’s worse, because it is so fundamental to what is used out there, we might as well forget ever seeing it updated.  The database structure itself is bad and needs to be better normalized.

I’m not going to hold my breath for the day it get’s changed.