public UserResult CreateUser(string userName, string displayName, string emailAddress, string password, string twitterUserName) { Contract.Requires <ArgumentException>(!string.IsNullOrWhiteSpace(userName)); Contract.Requires <ArgumentException>(!string.IsNullOrWhiteSpace(displayName)); Contract.Requires <ArgumentException>(!string.IsNullOrWhiteSpace(emailAddress)); Contract.Requires <ArgumentException>(!string.IsNullOrWhiteSpace(password)); var userNameExistsCommand = new SqlCommand("security.UserNameExists") { CommandType = CommandType.StoredProcedure, Connection = _securitySqlConnectionWrapper.SqlConnection }; userNameExistsCommand.Parameters.AddWithValue("userName", userName); var userNameExists = Convert.ToBoolean(userNameExistsCommand.ExecuteScalar()); var emailAddressExistsCommand = new SqlCommand("security.EmailAddressExists") { CommandType = CommandType.StoredProcedure, Connection = _securitySqlConnectionWrapper.SqlConnection }; emailAddressExistsCommand.Parameters.AddWithValue("emailAddress", emailAddress); var emailExists = Convert.ToBoolean(emailAddressExistsCommand.ExecuteScalar()); if (userNameExists || emailExists) { var result = new UserResult(false); if (userNameExists) { result.AddValidationMessage("UserName", _stringLocalizer.GetString("UsernameInUse")); } if (emailExists) { result.AddValidationMessage("EmailAddress", _stringLocalizer.GetString("EmailAddressInUse")); // Nb - This is proof of concept code, production systems should probably include email // validation as part of the process and email the address provided to state the address // is already in use to prevent enumeration attacks. } return(result); } var defaultIdentityVersionCommand = new SqlCommand("security.GetDefaultIdentityVersion") { CommandType = CommandType.StoredProcedure, Connection = _securitySqlConnectionWrapper.SqlConnection }; var identityId = 1; var hashIterations = 2500; using (var defaultIdentityVersion = defaultIdentityVersionCommand.ExecuteReader()) { if (defaultIdentityVersion.Read()) { var identityVersionIndex = defaultIdentityVersion.GetOrdinal("IdentityVersion"); identityId = defaultIdentityVersion.GetInt32(identityVersionIndex); var hashIterationsIndex = defaultIdentityVersion.GetOrdinal("HashIterations"); hashIterations = defaultIdentityVersion.GetInt32(hashIterationsIndex); } } var salt = UserExtensions.GenerateSalt(); var passwordHash = UserExtensions.HashPassword(Encoding.UTF8.GetBytes(password), salt, hashIterations); var createUserCommand = new SqlCommand("security.CreateUser") { CommandType = CommandType.StoredProcedure, Connection = _securitySqlConnectionWrapper.SqlConnection }; createUserCommand.Parameters.AddWithValue("userName", userName); createUserCommand.Parameters.AddWithValue("displayName", displayName); createUserCommand.Parameters.AddWithValue("emailAddress", emailAddress); createUserCommand.Parameters.AddWithValue("passwordHash", Convert.ToBase64String(passwordHash)); createUserCommand.Parameters.AddWithValue("passwordSalt", Convert.ToBase64String(salt)); createUserCommand.Parameters.AddWithValue("twitterUserName", twitterUserName); createUserCommand.Parameters.AddWithValue("userIdentityVersion", identityId); createUserCommand.ExecuteNonQuery(); return(new UserResult(true)); }