Using Sharepoint 2010 user profiles to store user information for a public facing website?

Question

We're planning to use Sharepoint 2010 as a CMS for a website we're building. This site will also have login functionality; and my boss suggested we use Sharepoint's user profile features to store user info (username, password, contact info, etc.) for the site. How is this better then say using a standard list or a database table somewhere? I'm looking into how this could possibly work; but has anyone here tried something similar? Any anecdotes about it you could share? Any constructive input is greatly appreciated.

Thanks, Frank

Answer 1

What you'll want to look into is Forms Based Authentication (FBA) with the SQL Server provider. There is a provider for SharePoint that will actually store the credentials in SQL Server via a IIS Access Control List functionality. Using this method, the users do not have to be set up in Active Directory, yet they are still safely encrypted in the database. The provider works natively with SharePoint so you don't have to worry about authenticating the user in your code, etc.

Answer 2

In SharePoint 2010, Claim Based authentication is the way to go. Even if this is a big step from MOSS 2007, still it misses the most important feature, such as "User Registration". You can however specify your own login page, and that is a great addition as that would be the best place to add links to your registration page.

So in few lines: 1. Your external site should be configured already with Claim-based auth (that means that once you do that you can use any FBA provider, such as OOTB ASP.NET SQL based providers) - very easy to setup and you can find configuration examples anywhere on the web. Make sure you can login with users pre-created (and given permissions already). Once this is done, proceed and configure User Profiles and syncronization. 2. Create a feature to deploy your registration pages. 3. Setup a BCS to your ASP.NET SQL Registration database and exposed additional properties you want added already to your User Profile (this way you can see custom properties too).

That should do it, C. Marius

Answer 3

The User Profiles have a lot of value for storing information about the users, but I have not seen and would not look to use it to store the actual password information.