Imported Upstream version 4.6.0.125

Former-commit-id: a2155e9bd80020e49e72e86c44da02a8ac0e57a4

mcs/class/referencesource/System.Web.ApplicationServices/Security/DefaultMembershipAdapter.cs

@@ -0,0 +1,34 @@
+//------------------------------------------------------------------------------
+// <copyright file="DefaultMembershipAdapter.cs" company="Microsoft">
+//    Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using System;
+    
+    internal class DefaultMembershipAdapter : IMembershipAdapter {
+        public DefaultMembershipAdapter() {
+        }
+
+        public MembershipProviderCollection Providers {
+            get { throw new PlatformNotSupportedException(ApplicationServicesStrings.Platform_not_supported); }
+        }
+
+        public int UserIsOnlineTimeWindow {
+            get { throw new PlatformNotSupportedException(ApplicationServicesStrings.Platform_not_supported); }
+        }
+
+        public bool IsDecryptionKeyAutogenerated {
+            get { throw new PlatformNotSupportedException(ApplicationServicesStrings.Platform_not_supported); }
+        }
+
+        public bool UsingCustomEncryption {
+            get { throw new PlatformNotSupportedException(ApplicationServicesStrings.Platform_not_supported); }
+        }
+
+        public byte[] EncryptOrDecryptData(bool encrypt, byte[] buffer, bool useLegacyMode) {
+            throw new PlatformNotSupportedException(ApplicationServicesStrings.Platform_not_supported);
+        }
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/IMembershipAdapter.cs

@@ -0,0 +1,29 @@
+//------------------------------------------------------------------------------
+// <copyright file="IMembershipAdapter.cs" company="Microsoft">
+//    Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using System;
+    
+    internal interface IMembershipAdapter {
+        MembershipProviderCollection Providers {
+            get;
+        }
+
+        int UserIsOnlineTimeWindow {
+            get;
+        }
+
+        bool IsDecryptionKeyAutogenerated {
+            get;
+        }
+
+        bool UsingCustomEncryption {
+            get;
+        }
+
+        byte[] EncryptOrDecryptData(bool encrypt, byte[] buffer, bool useLegacyMode);
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipCreateStatus.cs

@@ -0,0 +1,39 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipCreateStatus.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>                                                                
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using System;
+    using System.Runtime.CompilerServices;
+
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public enum MembershipCreateStatus {
+
+        Success = 0,
+
+        InvalidUserName = 1,  // invalid user name
+
+        InvalidPassword = 2, // new password was not accepted (invalid format)
+
+        InvalidQuestion = 3, // new question was not accepted (invalid format)
+
+        InvalidAnswer = 4, // new passwordAnswer was not acceppted (invalid format)
+
+        InvalidEmail = 5, // new email was not accepted (invalid format)
+
+        DuplicateUserName = 6, // username already exists
+
+        DuplicateEmail = 7, // email already exists
+
+        UserRejected = 8, // provider rejected user (for some user-specific reason)
+
+        InvalidProviderUserKey = 9,  // new provider user key was not accepted (invalid format)
+
+        DuplicateProviderUserKey = 10, // provider user key already exists
+
+        ProviderError = 11  // provider-specific error (couldn't map onto this enumeration)
+    }
+
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipCreateUserException.cs

@@ -0,0 +1,88 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipCreateStatus.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>                                                                
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using System;
+    using System.Runtime.CompilerServices;
+    using System.Runtime.Serialization;
+    using System.Security.Permissions;
+
+    [Serializable]
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public class MembershipCreateUserException : Exception {
+
+        public MembershipCreateUserException(MembershipCreateStatus statusCode)
+            : base(GetMessageFromStatusCode(statusCode)) {
+            _StatusCode = statusCode;
+        }
+
+        public MembershipCreateUserException(String message)
+            : base(message) { }
+
+
+        protected MembershipCreateUserException(SerializationInfo info, StreamingContext context)
+            : base(info, context) {
+            _StatusCode = (MembershipCreateStatus)info.GetInt32("_StatusCode");
+        }
+
+        public MembershipCreateUserException() { }
+
+        public MembershipCreateUserException(String message, Exception innerException)
+            : base(message, innerException) { }
+
+        private MembershipCreateStatus _StatusCode = MembershipCreateStatus.ProviderError;
+
+        public MembershipCreateStatus StatusCode { get { return _StatusCode; } }
+
+        [PermissionSet(SecurityAction.LinkDemand, Unrestricted = true)]
+        // This is a Level 1 transparency assembly, so we can't use [SecurityCritical] directly as this public member
+        // will still be safe-critical. However, the [PermissionSet] above provides equivalent link-time protection
+        // as [SecurityCritical] does in a Level 2 transparency assembly.
+        public override void GetObjectData(SerializationInfo info, StreamingContext context) {
+            base.GetObjectData(info, context);
+            info.AddValue("_StatusCode", _StatusCode);
+        }
+
+        internal static string GetMessageFromStatusCode(MembershipCreateStatus statusCode) {
+            switch (statusCode) {
+                case MembershipCreateStatus.Success:
+                    return ApplicationServicesStrings.Membership_no_error;
+
+                case MembershipCreateStatus.InvalidUserName:
+                    return ApplicationServicesStrings.Membership_InvalidUserName;
+                    
+                case MembershipCreateStatus.InvalidPassword:
+                    return ApplicationServicesStrings.Membership_InvalidPassword;
+                    
+                case MembershipCreateStatus.InvalidQuestion:
+                    return ApplicationServicesStrings.Membership_InvalidQuestion;
+                    
+                case MembershipCreateStatus.InvalidAnswer:
+                    return ApplicationServicesStrings.Membership_InvalidAnswer;
+                    
+                case MembershipCreateStatus.InvalidEmail:
+                    return ApplicationServicesStrings.Membership_InvalidEmail;
+                    
+                case MembershipCreateStatus.InvalidProviderUserKey:
+                    return ApplicationServicesStrings.Membership_InvalidProviderUserKey;
+                    
+                case MembershipCreateStatus.DuplicateUserName:
+                    return ApplicationServicesStrings.Membership_DuplicateUserName;
+                    
+                case MembershipCreateStatus.DuplicateEmail:
+                    return ApplicationServicesStrings.Membership_DuplicateEmail;
+                    
+                case MembershipCreateStatus.DuplicateProviderUserKey:
+                    return ApplicationServicesStrings.Membership_DuplicateProviderUserKey;
+                    
+                case MembershipCreateStatus.UserRejected:
+                    return ApplicationServicesStrings.Membership_UserRejected;                    
+            }
+
+            return ApplicationServicesStrings.Provider_Error;
+        }
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipPasswordException.cs

@@ -0,0 +1,32 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipPasswordException.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>                                                                
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using System;
+    using System.Runtime.Serialization;
+    using System.Web;
+    using System.Runtime.CompilerServices;
+    using System.Security.Permissions;    
+
+    [Serializable]
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public class MembershipPasswordException : Exception
+    {
+
+        public MembershipPasswordException(String message) : base(message)
+        { }
+
+
+        protected MembershipPasswordException(SerializationInfo info, StreamingContext context) : base(info, context)
+        { }
+
+        public MembershipPasswordException() 
+        { }
+
+        public MembershipPasswordException(String message, Exception innerException) : base(message, innerException) 
+        { } 
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipPasswordFormat.cs

@@ -0,0 +1,24 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipPasswordFormat.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>                                                                
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using System;
+    using System.Runtime.CompilerServices;
+    
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public enum MembershipPasswordFormat {
+
+        // The password is stored in cleartext in the database.
+        Clear = 0, 
+
+        // The password is cryptographically hashed and stored in the database.
+        Hashed = 1, 
+
+        // The password is encrypted using reversible encryption (using <machineKey>) and stored in the database.
+        Encrypted = 2,
+
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipProvider.cs

@@ -0,0 +1,183 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipProvider.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using  System.Web;
+    using  System.Security.Principal;
+    using  System.Collections.Specialized;
+    using  System.Security.Permissions;
+    using  System.Globalization;
+    using  System.Security.Cryptography;
+    using  System.Runtime.CompilerServices;
+    using  System.Runtime.Serialization;
+    using  System.Configuration.Provider;
+    using  System.Text;
+    using  System.Web.Configuration;
+    using  System.Web.Util;
+    using  System.Diagnostics.CodeAnalysis;
+   
+    /// <devdoc>
+    ///    <para>[To be supplied.]</para>
+    /// </devdoc>
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public abstract class MembershipProvider : ProviderBase
+    {
+        //
+        // Property Section
+        //
+
+
+        // Public properties
+        public abstract bool EnablePasswordRetrieval { get; }
+
+        public abstract bool EnablePasswordReset { get; }
+
+        public abstract bool RequiresQuestionAndAnswer { get; }
+
+        public abstract string ApplicationName { get; set; }
+
+        public abstract int MaxInvalidPasswordAttempts { get; }
+
+        public abstract int PasswordAttemptWindow { get; }
+
+        public abstract bool RequiresUniqueEmail { get; }
+
+        public abstract MembershipPasswordFormat PasswordFormat { get; }
+
+        public abstract int MinRequiredPasswordLength { get; }
+
+        public abstract int MinRequiredNonAlphanumericCharacters { get; }
+
+        public abstract string PasswordStrengthRegularExpression { get; }
+
+        //
+        // Method Section
+        //
+
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract MembershipUser CreateUser( string username,
+                                                   string password,
+                                                   string email,
+                                                   string passwordQuestion,
+                                                   string passwordAnswer,
+                                                   bool   isApproved,
+                                                   object providerUserKey,
+                                                   out    MembershipCreateStatus status );
+
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer);
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract string GetPassword(string username, string answer);
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract bool ChangePassword(string username, string oldPassword, string newPassword);
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract string ResetPassword(string username, string answer);
+
+        public abstract void UpdateUser(MembershipUser user);
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract bool ValidateUser(string username, string password);
+
+
+        public abstract bool UnlockUser( string userName );
+
+        public abstract MembershipUser GetUser( object providerUserKey, bool userIsOnline );
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract MembershipUser GetUser(string username, bool userIsOnline);
+
+        // GetUser() can throw 1 type of exception:
+        // 1. ArgumentException is thrown if:
+        //    A. Username is null, is empty, contains commas, or is longer than 256 characters
+        internal MembershipUser GetUser(string username, bool userIsOnline, bool throwOnError) {
+            MembershipUser user = null;
+
+            try {
+                user = GetUser(username, userIsOnline);
+            }
+            catch (ArgumentException) {
+                if (throwOnError) throw;
+            }
+
+            return user;
+        }
+
+        public abstract string GetUserNameByEmail(string email);
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract bool DeleteUser(string username, bool deleteAllRelatedData);
+
+
+        public abstract MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords);
+
+
+        public abstract int GetNumberOfUsersOnline();
+
+
+        [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+        public abstract MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords);
+
+        public abstract MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords);
+
+        protected virtual byte[] EncryptPassword( byte[] password)
+        {
+            return EncryptPassword(password, MembershipPasswordCompatibilityMode.Framework20);
+        }
+
+        protected virtual byte[] EncryptPassword( byte[] password, MembershipPasswordCompatibilityMode legacyPasswordCompatibilityMode)
+        {
+            if (SystemWebProxy.Membership.IsDecryptionKeyAutogenerated)
+                throw new ProviderException(ApplicationServicesStrings.Can_not_use_encrypted_passwords_with_autogen_keys);
+
+            return SystemWebProxy.Membership.EncryptOrDecryptData(true, password, legacyPasswordCompatibilityMode == MembershipPasswordCompatibilityMode.Framework20);
+        }
+
+        protected virtual byte[] DecryptPassword( byte[] encodedPassword )
+        {
+            if (SystemWebProxy.Membership.IsDecryptionKeyAutogenerated)
+                throw new ProviderException(ApplicationServicesStrings.Can_not_use_encrypted_passwords_with_autogen_keys);
+
+            try {
+                return SystemWebProxy.Membership.EncryptOrDecryptData(false, encodedPassword, false);
+            } catch {
+                if (!SystemWebProxy.Membership.UsingCustomEncryption)
+                    throw;
+            }
+            return SystemWebProxy.Membership.EncryptOrDecryptData(false, encodedPassword, true);
+        }
+
+        //
+        // Event Section
+        //
+
+        public event MembershipValidatePasswordEventHandler ValidatingPassword
+        {
+            add
+            {
+                _EventHandler += value;
+            }
+            remove
+            {
+                _EventHandler -= value;
+            }
+        }
+
+        protected virtual void OnValidatingPassword( ValidatePasswordEventArgs e )
+        {
+            if( _EventHandler != null )
+            {
+                _EventHandler( this, e );
+            }
+        }
+
+        private MembershipValidatePasswordEventHandler _EventHandler;
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipProviderCollection.cs

@@ -0,0 +1,40 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipProviderCollection.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+
+    using System;
+    using System.Configuration.Provider;
+    using System.Globalization;
+    using System.Runtime.CompilerServices;
+
+    // This has no hosting permission demands because of DevDiv Bugs 31461: ClientAppSvcs: ASP.net Provider support
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public sealed class MembershipProviderCollection : ProviderCollection {
+
+        public override void Add(ProviderBase provider) {
+            if (provider == null) {
+                throw new ArgumentNullException("provider");
+            }
+
+            if (!(provider is MembershipProvider)) {
+                throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, ApplicationServicesStrings.Provider_must_implement_type, typeof(MembershipProvider).ToString()), "provider");
+            }
+
+            base.Add(provider);
+        }
+
+        new public MembershipProvider this[string name] {
+            get {
+                return (MembershipProvider)base[name];
+            }
+        }
+
+        public void CopyTo(MembershipProvider[] array, int index) {
+            base.CopyTo(array, index);
+        }
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipUser.cs

@@ -0,0 +1,391 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipUser.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+    using  System.Web;
+    using  System.Configuration.Provider;
+    using  System.Security.Principal;
+    using  System.Security.Permissions;
+    using  System.Globalization;
+    using  System.Runtime.CompilerServices;
+    using  System.Runtime.Serialization;
+    using  System.Web.Util;
+    
+    /// <devdoc>
+    ///    <para>[To be supplied.]</para>
+    /// </devdoc>
+    [Serializable]
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public class MembershipUser
+    {
+        ////////////////////////////////////////////////////////////
+        // Public methods
+
+        public virtual string UserName{
+            get { return _UserName;}}
+
+        public virtual object ProviderUserKey{
+            get { return _ProviderUserKey;}}
+
+
+        public virtual string Email{
+            get { return _Email;}
+            set { _Email = value; }}
+
+
+        public virtual string PasswordQuestion{
+            get { return _PasswordQuestion;}}
+
+
+        public virtual string Comment{
+            get { return _Comment;}
+            set { _Comment = value;}}
+
+
+        public virtual bool IsApproved{
+            get { return _IsApproved;}
+            set { _IsApproved = value; } }
+
+        public virtual bool IsLockedOut
+        {
+            get { return _IsLockedOut; }
+        }
+
+        public virtual DateTime LastLockoutDate
+        {
+            get { return _LastLockoutDate.ToLocalTime(); }
+        }
+
+        public virtual DateTime CreationDate {
+            get { return _CreationDate.ToLocalTime(); }
+        }
+
+        public virtual DateTime LastLoginDate {
+            get { return _LastLoginDate.ToLocalTime(); }
+            set { _LastLoginDate = value.ToUniversalTime(); } }
+
+
+        public virtual DateTime LastActivityDate {
+            get { return _LastActivityDate.ToLocalTime(); }
+            set { _LastActivityDate = value.ToUniversalTime(); } }
+
+
+        public virtual DateTime LastPasswordChangedDate {
+            get { return _LastPasswordChangedDate.ToLocalTime(); }
+        }
+
+        public virtual bool IsOnline {
+            get {
+                TimeSpan   ts  = new TimeSpan(0, SystemWebProxy.Membership.UserIsOnlineTimeWindow, 0);
+                DateTime   dt  = DateTime.UtcNow.Subtract(ts);
+                return LastActivityDate.ToUniversalTime() > dt;
+            }
+        }
+
+        public override string ToString()
+        {
+            return UserName;
+        }
+
+        public virtual string ProviderName
+        {
+            get { return _ProviderName; }
+        }
+
+        ////////////////////////////////////////////////////////////
+        // CTor
+
+        public MembershipUser(
+            string        providerName,
+            string        name,
+            object        providerUserKey,
+            string        email,
+            string        passwordQuestion,
+            string        comment,
+            bool          isApproved,
+            bool          isLockedOut,
+            DateTime      creationDate,
+            DateTime      lastLoginDate,
+            DateTime      lastActivityDate,
+            DateTime      lastPasswordChangedDate,
+            DateTime      lastLockoutDate )
+        {
+            if ( providerName == null || SystemWebProxy.Membership.Providers[providerName] == null )
+            {
+                throw new ArgumentException(String.Format(CultureInfo.CurrentCulture, ApplicationServicesStrings.Membership_provider_name_invalid), "providerName" );
+            }
+
+            if( name != null )
+            {
+                name = name.Trim();
+            }
+
+            if( email != null )
+            {
+                email = email.Trim();
+            }
+
+            if( passwordQuestion != null )
+            {
+                passwordQuestion = passwordQuestion.Trim();
+            }
+
+            _ProviderName = providerName;
+            _UserName = name;
+            _ProviderUserKey = providerUserKey;
+            _Email = email;
+            _PasswordQuestion = passwordQuestion;
+            _Comment = comment;
+            _IsApproved = isApproved;
+            _IsLockedOut = isLockedOut;
+
+            // VSWhidbey 451539: We should use UTC internally for all dates, and return local for public apis
+            _CreationDate = creationDate.ToUniversalTime();
+            _LastLoginDate = lastLoginDate.ToUniversalTime();
+            _LastActivityDate = lastActivityDate.ToUniversalTime();
+            _LastPasswordChangedDate = lastPasswordChangedDate.ToUniversalTime();
+            _LastLockoutDate = lastLockoutDate.ToUniversalTime();
+        }
+
+
+        protected MembershipUser() { } // Default CTor: Callable by derived class only.
+
+        internal virtual void Update()
+        {
+            SystemWebProxy.Membership.Providers[ProviderName].UpdateUser(this);
+            UpdateSelf();
+        }
+
+        public virtual string GetPassword()
+        {
+            return SystemWebProxy.Membership.Providers[ProviderName].GetPassword(UserName, null);
+        }
+
+        public virtual string GetPassword(string passwordAnswer)
+        {
+            return SystemWebProxy.Membership.Providers[ProviderName].GetPassword(UserName, passwordAnswer);
+        }
+
+        internal string GetPassword(bool throwOnError) {
+            return GetPassword(null, /* useAnswer */ false, throwOnError);
+        }
+
+        internal string GetPassword(string answer, bool throwOnError) {
+            return GetPassword(answer, /* useAnswer */ true, throwOnError);
+        }
+
+        // GetPassword() can throw 3 types of exception:
+        // 1. ArgumentException is thrown if:
+        //    A. Answer is null, empty, or longer than 128 characters
+        // 2. ProviderException is thrown if the user does not exist when the stored procedure
+        //    is run.  The only way this could happen is in a race condition, where the user
+        //    is deleted in the middle of the MembershipProvider.ChangePassword() method.
+        // 3. MembershipPasswordException is thrown if the user is locked out, or the answer
+        //    is incorrect.
+        private string GetPassword(string answer, bool useAnswer, bool throwOnError) {
+            string password = null;
+
+            try {
+                if (useAnswer) {
+                    password = GetPassword(answer);
+                }
+                else {
+                    password = GetPassword();
+                }
+            }
+            catch (ArgumentException) {
+                if (throwOnError) throw;
+            }
+            catch (MembershipPasswordException) {
+                if (throwOnError) throw;
+            }
+            catch (ProviderException) {
+                if (throwOnError) throw;
+            }
+
+            return password;
+        }
+
+        public virtual bool ChangePassword(string oldPassword, string newPassword)
+        {
+            SecurityServices.CheckPasswordParameter(oldPassword, "oldPassword");
+            SecurityServices.CheckPasswordParameter(newPassword, "newPassword");
+
+            if (!SystemWebProxy.Membership.Providers[ProviderName].ChangePassword(UserName, oldPassword, newPassword))
+                return false;
+            UpdateSelf();
+            //_LastPasswordChangedDate = Membership.Providers[ ProviderName ].GetUser( UserName, false ).LastPasswordChangedDate;
+            return true;
+        }
+
+        // ChangePassword() can throw 3 types of exception:
+        // 1. ArgumentException is thrown if:
+        //    A. OldPassword or NewPassword is null, empty, or longer than 128 characters
+        //    B. NewPassword shorter than MinRequiredPasswordLength, or NewPassword contains
+        //       less non-alphanumeric characters than MinRequiredNonAlphanumericCharacters,
+        //       or NewPassword does not match PasswordStrengthRegularExpression.
+        //    C. A developer adds a listener to the MembershipProvider.ValidatingPassword event,
+        //       and sets e.Cancel to true, and e.FailureInformation is null.
+        // 2. ProviderException is thrown if the user does not exist when the stored procedure
+        //    is run.  The only way this could happen is in a race condition, where the user
+        //    is deleted in the middle of the MembershipProvider.ChangePassword() method.
+        // 3. It appears that MembershipProviderException currently cannot be thrown, but
+        //    there is a codepath that throws this exception, so we should catch it here anyway.
+        internal bool ChangePassword(string oldPassword, string newPassword, bool throwOnError) {
+            bool passwordChanged = false;
+
+            try {
+                passwordChanged = ChangePassword(oldPassword, newPassword);
+            }
+            catch (ArgumentException) {
+                if (throwOnError) throw;
+            }
+            catch (MembershipPasswordException) {
+                if (throwOnError) throw;
+            }
+            catch (ProviderException) {
+                if (throwOnError) throw;
+            }
+
+            return passwordChanged;
+        }
+
+        public virtual bool ChangePasswordQuestionAndAnswer(string password, string newPasswordQuestion, string newPasswordAnswer)
+        {
+            SecurityServices.CheckPasswordParameter(password, "password");
+            SecurityServices.CheckForEmptyOrWhiteSpaceParameter(ref newPasswordQuestion, "newPasswordQuestion");
+            SecurityServices.CheckForEmptyOrWhiteSpaceParameter(ref newPasswordAnswer, "newPasswordAnswer");
+
+            if (!SystemWebProxy.Membership.Providers[ProviderName].ChangePasswordQuestionAndAnswer(UserName, password, newPasswordQuestion, newPasswordAnswer))
+                return false;
+            UpdateSelf();
+            return true;
+        }
+
+        public virtual string ResetPassword(string passwordAnswer)
+        {
+            string pass = SystemWebProxy.Membership.Providers[ProviderName].ResetPassword(UserName, passwordAnswer);
+            if (!String.IsNullOrEmpty(pass)) {
+                UpdateSelf();
+                //_LastPasswordChangedDate = Membership.Providers[ProviderName].GetUser(UserName, false).LastPasswordChangedDate;
+            }
+            return pass;
+        }
+
+        public virtual string ResetPassword()
+        {
+            return ResetPassword(null);
+        }
+
+        internal string ResetPassword(bool throwOnError) {
+            return ResetPassword(null, /* useAnswer */ false, throwOnError);
+        }
+
+        internal string ResetPassword(string passwordAnswer, bool throwOnError) {
+            return ResetPassword(passwordAnswer, /* useAnswer */ true, throwOnError);
+        }
+
+        // MembershipProvider.ResetPassword() can throw 3 types of exception:
+        // 1. ArgumentException is thrown if:
+        //    A. Answer is null, empty, or longer than 128 characters
+        // 2. ProviderException is thrown if:
+        //    A. The user does not exist when the stored procedure is run.  The only way
+        //       this could happen is in a race condition, where the user is deleted in
+        //       the middle of the MembershipProvider.ChangePassword() method.
+        //    B. A developer adds a listener to the MembershipProvider.ValidatingPassword event,
+        //       and sets e.Cancel to true, and e.FailureInformation is null.
+        // 3. MembershipPasswordException is thrown if the user is locked out, or the answer
+        //    is incorrect.
+        private string ResetPassword(string passwordAnswer, bool useAnswer, bool throwOnError) {
+            string password = null;
+
+            try {
+                if (useAnswer) {
+                    password = ResetPassword(passwordAnswer);
+                }
+                else {
+                    password = ResetPassword();
+                }
+            }
+            catch (ArgumentException) {
+                if (throwOnError) throw;
+            }
+            catch (MembershipPasswordException) {
+                if (throwOnError) throw;
+            }
+            catch (ProviderException) {
+                if (throwOnError) throw;
+            }
+
+            return password;
+        }
+
+        public virtual bool UnlockUser()
+        {
+            if (SystemWebProxy.Membership.Providers[ProviderName].UnlockUser(UserName))
+            {
+                UpdateSelf();
+                return !IsLockedOut;
+            }
+
+            return false;
+        }
+        private void UpdateSelf()
+        {
+            MembershipUser mu = SystemWebProxy.Membership.Providers[ProviderName].GetUser(UserName, false);
+            if (mu != null) {
+                try {
+                    _LastPasswordChangedDate = mu.LastPasswordChangedDate.ToUniversalTime();
+                } catch (NotSupportedException) {}
+                try {
+                    LastActivityDate = mu.LastActivityDate;
+                } catch (NotSupportedException) {}
+                try {
+                    LastLoginDate = mu.LastLoginDate;
+                } catch (NotSupportedException) {}
+                try {
+                    _CreationDate = mu.CreationDate.ToUniversalTime();
+                } catch (NotSupportedException) { }
+                try {
+                    _LastLockoutDate = mu.LastLockoutDate.ToUniversalTime();
+                } catch (NotSupportedException) { }
+                try {
+                    _IsLockedOut = mu.IsLockedOut;
+                } catch (NotSupportedException) { }
+                try {
+                    IsApproved = mu.IsApproved;
+                } catch (NotSupportedException) { }
+                try {
+                    Comment = mu.Comment;
+                } catch (NotSupportedException) { }
+                try {
+                    _PasswordQuestion = mu.PasswordQuestion;
+                } catch (NotSupportedException) { }
+                try {
+                    Email = mu.Email;
+                } catch (NotSupportedException) { }
+                try {
+                    _ProviderUserKey = mu.ProviderUserKey;
+                } catch (NotSupportedException) { }
+            }
+        }
+        ////////////////////////////////////////////////////////////
+        // private Data
+        private  string      _UserName;
+        private  object      _ProviderUserKey;
+        private  string      _Email;
+        private  string      _PasswordQuestion;
+        private  string      _Comment;
+        private  bool        _IsApproved;
+        private  bool        _IsLockedOut;
+        private  DateTime    _LastLockoutDate;
+        private  DateTime    _CreationDate;
+        private  DateTime    _LastLoginDate;
+        private  DateTime    _LastActivityDate;
+        private  DateTime    _LastPasswordChangedDate;
+        private  string      _ProviderName;
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipUserCollection.cs

@@ -0,0 +1,107 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipUserCollection.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+
+    using System;
+    using System.Collections;
+    using System.Configuration.Provider;
+    using System.Runtime.CompilerServices;    
+
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    [Serializable]
+    public sealed class MembershipUserCollection : IEnumerable, ICollection {
+        private Hashtable _Indices = null;
+        private ArrayList _Values = null;
+        private bool _ReadOnly = false;
+
+        public MembershipUserCollection() {
+            _Indices = new Hashtable(10, StringComparer.CurrentCultureIgnoreCase);
+            _Values = new ArrayList();
+        }
+
+        public void Add(MembershipUser user) {
+            if (user == null) {
+                throw new ArgumentNullException("user");
+            }
+
+            if (_ReadOnly)
+                throw new NotSupportedException();
+
+            int pos = _Values.Add(user);
+            try {
+                _Indices.Add(user.UserName, pos);
+            }
+            catch {
+                _Values.RemoveAt(pos);
+                throw;
+            }
+        }
+
+        public void Remove(string name) {
+            if (_ReadOnly)
+                throw new NotSupportedException();
+
+            object pos = _Indices[name];
+            if (pos == null || !(pos is int))
+                return;
+            int ipos = (int)pos;
+            if (ipos >= _Values.Count)
+                return;
+            _Values.RemoveAt(ipos);
+            _Indices.Remove(name);
+            ArrayList al = new ArrayList();
+            foreach (DictionaryEntry de in _Indices)
+                if ((int)de.Value > ipos)
+                    al.Add(de.Key);
+            foreach (string key in al)
+                _Indices[key] = ((int)_Indices[key]) - 1;
+        }
+
+        public MembershipUser this[string name] {
+            get {
+                object pos = _Indices[name];
+                if (pos == null || !(pos is int))
+                    return null;
+                int ipos = (int)pos;
+                if (ipos >= _Values.Count)
+                    return null;
+                return (MembershipUser)_Values[ipos];
+            }
+        }
+
+        public IEnumerator GetEnumerator() {
+            return _Values.GetEnumerator();
+        }
+
+        public void SetReadOnly() {
+            if (_ReadOnly)
+                return;
+            _ReadOnly = true;
+            _Values = ArrayList.ReadOnly(_Values);
+        }
+
+        public void Clear() {
+            _Values.Clear();
+            _Indices.Clear();
+        }
+
+        public int Count { get { return _Values.Count; } }
+
+        public bool IsSynchronized { get { return false; } }
+
+        public object SyncRoot { get { return this; } }
+
+
+        void ICollection.CopyTo(Array array, int index) {
+            _Values.CopyTo(array, index);
+        }
+
+        public void CopyTo(MembershipUser[] array, int index) {
+            _Values.CopyTo(array, index);
+        }
+    }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/MembershipValidatePasswordEventHandler.cs

@@ -0,0 +1,18 @@
+//------------------------------------------------------------------------------
+// <copyright file="MembershipValidatePasswordEventHandler.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>                                                                
+//------------------------------------------------------------------------------
+
+/*
+ * MembershipValidatePasswordEventHandler class
+ * 
+ * Copyright (c) 1999 Microsoft Corporation
+ */
+namespace System.Web.Security 
+{
+    using System.Runtime.CompilerServices;
+
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public delegate void MembershipValidatePasswordEventHandler( Object sender,  ValidatePasswordEventArgs e );
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/RoleProvider.cs

@@ -0,0 +1,54 @@
+//------------------------------------------------------------------------------
+// <copyright file="RoleProvider.cs" company="Microsoft">
+//    Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//------------------------------------------------------------------------------
+
+namespace System.Web.Security {
+   using  System.Web;
+   using  System.Security.Principal;
+   using  System.Security.Permissions;
+   using  System.Globalization;
+   using  System.Runtime.CompilerServices;
+   using  System.Runtime.Serialization;
+   using  System.Collections;
+   using  System.Collections.Specialized;
+   using  System.Configuration.Provider;
+   using System.Diagnostics.CodeAnalysis;
+
+   /// <devdoc>
+   ///   <para>[To be supplied.]</para>
+   /// </devdoc>
+   [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+   public abstract class RoleProvider : ProviderBase
+   {
+
+       public abstract string ApplicationName { get; set; }
+
+
+       [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+       public abstract bool IsUserInRole(string username, string roleName);
+
+       [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+       public abstract string[] GetRolesForUser(string username);
+
+       public abstract void CreateRole(string roleName);
+
+       public abstract bool DeleteRole(string roleName, bool throwOnPopulatedRole);
+
+       public abstract bool RoleExists(string roleName);
+
+       [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "usernames", Justification="This version is required to maintain backwards binary compatibility")]
+       public abstract void AddUsersToRoles(string[] usernames, string[] roleNames);
+
+       [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "usernames", Justification="This version is required to maintain backwards binary compatibility")]
+       public abstract void RemoveUsersFromRoles(string[] usernames, string[] roleNames);
+
+       public abstract string[] GetUsersInRole(string roleName);
+
+       public abstract string[] GetAllRoles();
+
+       [SuppressMessage("Microsoft.Naming", "CA1702:CompoundWordsShouldBeCasedCorrectly", MessageId = "username", Justification="This version is required to maintain backwards binary compatibility")]
+       public abstract string[] FindUsersInRole(string roleName, string usernameToMatch);
+   }
+}

mcs/class/referencesource/System.Web.ApplicationServices/Security/ValidatePasswordEventArgs.cs

@@ -0,0 +1,63 @@
+//------------------------------------------------------------------------------
+// <copyright file="ValidatePasswordEventArgs.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>                                                                
+//------------------------------------------------------------------------------
+
+/*
+ * ValidatePasswordEventArgs class
+ * 
+ * Copyright (c) 1999 Microsoft Corporation
+ */
+namespace System.Web.Security 
+{
+    using System.Runtime.CompilerServices;
+
+    [TypeForwardedFrom("System.Web, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a")]
+    public sealed class ValidatePasswordEventArgs : EventArgs 
+    {
+        private string    _userName;
+        private string    _password;
+        private bool      _isNewUser;
+        private bool      _cancel;
+        private Exception _failureInformation;
+        
+        public ValidatePasswordEventArgs(
+            string userName,
+            string password,
+            bool   isNewUser ) 
+        {
+            _userName = userName;
+            _password = password;
+            _isNewUser = isNewUser;
+            _cancel = false;
+        }
+
+        public string UserName
+        {
+            get{ return _userName; }
+        }
+
+        public string Password
+        {
+            get{ return _password; }
+        }
+
+        public bool IsNewUser
+        {
+            get{ return _isNewUser; }
+        }
+
+        public bool Cancel
+        {
+            get{ return _cancel; }            
+            set{ _cancel = value; }
+        }
+
+        public Exception FailureInformation
+        {
+            get{ return _failureInformation; }
+            set{ _failureInformation = value; }
+        }
+    }
+}