using System;
using System.Collections.Generic;
using System.Configuration;
using System.Configuration.Provider;
using System.Data;
using System.Data.SqlClient;
using System.Web.Configuration;
using System.Web.Security;
using System.Xml.Linq;
using Neo.Afx.ComponentModel;
using Neo.Afx.Diagnostics;

namespace Neo.Afx.Security
{
    /// <summary>
    /// Manages storage of membership information for an RIA domain service application in a SQL Server database
    /// </summary>
    public class DomainMembershipProvider : MembershipProvider
    {
        const string EventSource = "DomainMembershipProvider";
        const string ExceptionMessage = "An exception occurred. Please check the log.";

        #region Overridden Properties

        #region ApplicationName

        /// <summary>
        /// The name of the application using the custom membership provider.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// The name of the application using the custom membership provider.
        /// </returns>
        public override string ApplicationName
        {
            get;
            set;
        }

        #endregion

        #region EnablePasswordReset

        bool _enablePasswordReset;
        /// <summary>
        /// Indicates whether the membership provider is configured to allow users to reset their passwords.
        /// </summary>
        /// <value></value>
        /// <returns>true if the membership provider supports password reset; otherwise, false. The default is true.
        /// </returns>
        public override bool EnablePasswordReset
        {
            get
            {
                return _enablePasswordReset;
            }
        }

        #endregion

        #region EnablePasswordRetrieval

        bool _enablePasswordRetrieval;
        /// <summary>
        /// Indicates whether the membership provider is configured to allow users to retrieve their passwords.
        /// </summary>
        /// <value></value>
        /// <returns>true if the membership provider is configured to support password retrieval; otherwise, false. The default is true.
        /// </returns>
        public override bool EnablePasswordRetrieval
        {
            get
            {
                return _enablePasswordRetrieval;
            }
        }

        #endregion

        #region MaxInvalidPasswordAttempts

        int _maxInvalidPasswordAttempts;
        /// <summary>
        /// Gets the number of invalid password or password-answer attempts allowed before the membership user is locked out.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// The number of invalid password or password-answer attempts allowed before the membership user is locked out.
        /// </returns>
        public override int MaxInvalidPasswordAttempts
        {
            get
            {
                return _maxInvalidPasswordAttempts;
            }
        }

        #endregion

        #region MinRequiredNonAlphanumericCharacters

        int _minRequiredNonAlphanumericCharacters;
        /// <summary>
        /// Gets the minimum number of special characters that must be present in a valid password.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// The minimum number of special characters that must be present in a valid password.
        /// </returns>
        public override int MinRequiredNonAlphanumericCharacters
        {
            get
            {
                return _minRequiredNonAlphanumericCharacters;
            }
        }

        #endregion

        #region MinRequiredPasswordLength

        int _minRequiredPasswordLength;
        /// <summary>
        /// Gets the minimum length required for a password.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// The minimum length required for a password.
        /// </returns>
        public override int MinRequiredPasswordLength
        {
            get
            {
                return _minRequiredPasswordLength;
            }
        }

        #endregion

        #region PasswordAttemptWindow

        int _passwordAttemptWindow;
        /// <summary>
        /// Gets the number of minutes in which a maximum number of invalid password or password-answer attempts are allowed before the membership user is locked out.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// The number of minutes in which a maximum number of invalid password or password-answer attempts are allowed before the membership user is locked out.
        /// </returns>
        public override int PasswordAttemptWindow
        {
            get
            {
                return _passwordAttemptWindow;
            }
        }

        #endregion

        #region PasswordFormat

        MembershipPasswordFormat _passwordFormat;
        /// <summary>
        /// Gets a value indicating the format for storing passwords in the membership data store.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// One of the <see cref="T:System.Web.Security.MembershipPasswordFormat"/> values indicating the format for storing passwords in the data store.
        /// </returns>
        public override MembershipPasswordFormat PasswordFormat
        {
            get
            {
                return _passwordFormat;
            }
        }

        #endregion

        #region PasswordStrengthRegularExpression

        string _passwordStrengthRegularExpression;
        /// <summary>
        /// Gets the regular expression used to evaluate a password.
        /// </summary>
        /// <value></value>
        /// <returns>
        /// A regular expression used to evaluate a password.
        /// </returns>
        public override string PasswordStrengthRegularExpression
        {
            get
            {
                return _passwordStrengthRegularExpression;
            }
        }

        #endregion

        #region RequiresQuestionAndAnswer

        bool _requiresQuestionAndAnswer;
        /// <summary>
        /// Gets a value indicating whether the membership provider is configured to require the user to answer a password question for password reset and retrieval.
        /// </summary>
        /// <value></value>
        /// <returns>true if a password answer is required for password reset and retrieval; otherwise, false. The default is true.
        /// </returns>
        public override bool RequiresQuestionAndAnswer
        {
            get
            {
                return _requiresQuestionAndAnswer;
            }
        }

        #endregion

        #region RequiresUniqueEmail

        bool _requiresUniqueEmail;
        /// <summary>
        /// Gets a value indicating whether the membership provider is configured to require a unique e-mail address for each user name.
        /// </summary>
        /// <value></value>
        /// <returns>true if the membership provider requires a unique e-mail address; otherwise, false. The default is true.
        /// </returns>
        public override bool RequiresUniqueEmail
        {
            get
            {
                return _requiresUniqueEmail;
            }
        }

        #endregion

        #region WriteExceptionsToEventLog

        /// <summary>
        /// Gets or sets a value indicating whether to write exceptions to the event log.
        /// </summary>
        public bool WriteExceptionsToEventLog
        {
            get;
            set;
        }

        #endregion

        #endregion

        string _connectionString;
        string _rsaKey;

        #region Initialize

        /// <summary>
        /// Initializes the provider.
        /// </summary>
        /// <param name="name">The friendly name of the provider.</param>
        /// <param name="config">A collection of the name/value pairs representing the provider-specific attributes specified in the configuration for this provider.</param>
        /// <exception cref="T:System.ArgumentNullException">
        /// The name of the provider is null.
        /// </exception>
        /// <exception cref="T:System.ArgumentException">
        /// The name of the provider has a length of zero.
        /// </exception>
        /// <exception cref="T:System.InvalidOperationException">
        /// An attempt is made to call <see cref="M:System.Configuration.Provider.ProviderBase.Initialize(System.String,System.Collections.Specialized.NameValueCollection)"/> on a provider after the provider has already been initialized.
        /// </exception>
        public override void Initialize(string name, System.Collections.Specialized.NameValueCollection config)
        {
            #region Initialize values from web.config

            if(config == null)
            {
                throw new ArgumentNullException("config");
            }
            if(String.IsNullOrEmpty(name))
            {
                name = "DomainMembershipProvider";
            }
            if(String.IsNullOrEmpty(config["description"]))
            {
                config.Remove("description");
                config.Add("description", "Domain Membership provider");
            }

            #endregion

            // Initialize the abstract base class.
            base.Initialize(name, config);

            ApplicationName = GetConfigValue(config["applicationName"], System.Web.Hosting.HostingEnvironment.ApplicationVirtualPath);
            _maxInvalidPasswordAttempts = Convert.ToInt32(GetConfigValue(config["maxInvalidPasswordAttempts"], "5"));
            _passwordAttemptWindow = Convert.ToInt32(GetConfigValue(config["passwordAttemptWindow"], "10"));
            _minRequiredNonAlphanumericCharacters = Convert.ToInt32(GetConfigValue(config["minRequiredNonAlphanumericCharacters"], "1"));
            _minRequiredPasswordLength = Convert.ToInt32(GetConfigValue(config["minRequiredPasswordLength"], "7"));
            _passwordStrengthRegularExpression = Convert.ToString(GetConfigValue(config["passwordStrengthRegularExpression"], ""));
            _enablePasswordReset = Convert.ToBoolean(GetConfigValue(config["enablePasswordReset"], "true"));
            _enablePasswordRetrieval = Convert.ToBoolean(GetConfigValue(config["enablePasswordRetrieval"], "true"));
            _requiresQuestionAndAnswer = Convert.ToBoolean(GetConfigValue(config["requiresQuestionAndAnswer"], "true"));
            _requiresUniqueEmail = Convert.ToBoolean(GetConfigValue(config["requiresUniqueEmail"], "true"));
            WriteExceptionsToEventLog = Convert.ToBoolean(GetConfigValue(config["writeExceptionsToEventLog"], "true"));

            #region Get password format

            string tempFormat = config["passwordFormat"] ?? "Hashed";
            switch(tempFormat)
            {
                case "Hashed":
                    _passwordFormat = MembershipPasswordFormat.Hashed;
                    break;
                case "Encrypted":
                    _passwordFormat = MembershipPasswordFormat.Encrypted;
                    break;
                case "Clear":
                    _passwordFormat = MembershipPasswordFormat.Clear;
                    break;
                default:
                    throw new ProviderException("Password format not supported.");
            }

            #endregion

            #region Initialize connection string

            ConnectionStringSettings connectionStringSettings =
                ConfigurationManager.ConnectionStrings[config["connectionStringName"]];
            if(connectionStringSettings == null || connectionStringSettings.ConnectionString.Trim() == "")
            {
                throw new ProviderException("Connection string cannot be blank.");
            }
            _connectionString = connectionStringSettings.ConnectionString;

            #endregion

            var rsaSettings = RsaSettings.GetSection();
            if(rsaSettings != null)
            {
                _rsaKey = rsaSettings.Key;
            }

            #region Get encryption and decryption key information from the configuration

            var cfg = WebConfigurationManager.OpenWebConfiguration(System.Web.Hosting.HostingEnvironment.ApplicationVirtualPath);
            var machineKey = (MachineKeySection)cfg.GetSection("system.web/machineKey");
            if(machineKey.ValidationKey.Contains("AutoGenerate"))
            {
                if(PasswordFormat != MembershipPasswordFormat.Clear)
                {
                    throw new ProviderException("Hashed or Encrypted passwords are not supported with auto-generated keys.");
                }
            }

            #endregion
        }

        #endregion

        #region GetConfigValue

        static string GetConfigValue(string configValue, string defaultValue)
        {
            return String.IsNullOrEmpty(configValue) ? defaultValue : configValue;
        }

        #endregion

        /////////////////////////////////////////////////////////////////////
        // Overridden methods
        /////////////////////////////////////////////////////////////////////

        #region ChangePassword

        /// <summary>
        /// Changes the password.
        /// </summary>
        /// <param name="userName">Name of the user.</param>
        /// <param name="oldPassword">The old password - obfuscated.</param>
        /// <param name="newPassword">The new password - encrypted.</param>
        /// <returns><code>true</code> if successful; <code>false</code> otherwise.</returns>
        public override bool ChangePassword(string userName, string oldPassword, string newPassword)
        {
            if(!ValidateUser(userName, oldPassword))
            {
                return false;
            }

            var thePassword = (_rsaKey != null)
                                  ? RsaProvider.Decrypt(_rsaKey, newPassword)
                                  : newPassword;

            var args = new ValidatePasswordEventArgs(userName, thePassword, false);
            OnValidatingPassword(args);

            if(args.Cancel)
            {
                if(args.FailureInformation != null)
                {
                    throw args.FailureInformation;
                }
                throw new MembershipPasswordException("Change password canceled due to new password validation failure.");
            }

            bool success;
            try
            {
                DbSavePassword(userName, thePassword, false);
                success = true;
            }
            catch(Exception e)
            {
                success = false;
                if(WriteExceptionsToEventLog)
                {
                    LogUtility.WriteApplicationEventLog(e);
                    throw new ProviderException(ExceptionMessage);
                }
            }

            return success;
        }

        #endregion

        #region ChangePasswordQuestionAndAnswer

        /// <summary>
        /// Processes a request to update the password question and answer for a membership user.
        /// </summary>
        /// <param name="userName">The user to change the password question and answer for.</param>
        /// <param name="password">The password for the specified user.</param>
        /// <param name="newPasswordQuestion">The new password question for the specified user.</param>
        /// <param name="newPasswordAnswer">The new password answer for the specified user.</param>
        /// <returns>
        /// true if the password question and answer are updated successfully; otherwise, false.
        /// </returns>
        public override bool ChangePasswordQuestionAndAnswer(string userName, string password, string newPasswordQuestion, string newPasswordAnswer)
        {
            if(!ValidateUser(userName, password))
            {
                return false;
            }

            var theAnswer = (_rsaKey != null)
                                  ? RsaProvider.Decrypt(_rsaKey, newPasswordAnswer)
                                  : newPasswordAnswer;

            bool success;
            try
            {
                DbSavePasswordQuestionAndAnswer(userName, newPasswordQuestion, theAnswer);
                success = true;
            }
            catch(Exception e)
            {
                success = false;
                if(WriteExceptionsToEventLog)
                {
                    LogUtility.WriteApplicationEventLog(e);
                    throw new ProviderException(ExceptionMessage);
                }
            }

            return success;
        }

        #endregion

        #region ResetPassword

        /// <summary>
        /// Resets a user's password to a new, automatically generated password.
        /// </summary>
        /// <param name="userName">The user to reset the password for.</param>
        /// <param name="answer">The password answer for the specified user.</param>
        /// <returns>The new password for the specified user.</returns>
        public override string ResetPassword(string userName, string answer)
        {
            bool isValid;
            try
            {
                isValid = ValidateAnswer(userName, answer);
            }
            catch(Exception e)
            {
                if(WriteExceptionsToEventLog)
                {
                    LogUtility.WriteApplicationEventLog(e);
                    throw new ProviderException(ExceptionMessage);
                }
                throw;
            }

            if(!isValid)
            {
                throw new ProviderException("Invalid user and/or answer.");
            }

            return ResetPassword(userName);
        }

        /// <summary>
        /// Resets a user's password to a new, automatically generated password.
        /// </summary>
        /// <param name="userName">The user to reset the password for.</param>
        /// <returns>The new password for the specified user.</returns>
        public string ResetPassword(string userName)
        {
            var newPassword = Membership.GeneratePassword(11, 0);
            DbSavePassword(userName, newPassword, true);
            return newPassword;
        }

        #endregion  

        #region ValidateUser

        /// <summary>
        /// Validates the user.
        /// </summary>
        /// <param name="userName">The name of the user to be validated.</param>
        /// <param name="password">The password to be validated.</param>
        /// <returns><code>true</code> if authentication succeeded; <code>false</code> otherwise.</returns>
        public override bool ValidateUser(string userName, string password)
        {
            bool isValid;
            try
            {
                isValid = ValidateCredentials(userName, password);
            }
            catch(Exception e)
            {
                if(WriteExceptionsToEventLog)
                {
                    LogUtility.WriteApplicationEventLog(e);
                    throw new ProviderException(ExceptionMessage);
                }
                throw;
            }

            return isValid;
        }

        #endregion

        #region Not Implemented

        /// <summary>
        /// Adds a new membership user to the data source.
        /// </summary>
        /// <param name="username">The user name for the new user.</param>
        /// <param name="password">The password for the new user.</param>
        /// <param name="email">The e-mail address for the new user.</param>
        /// <param name="passwordQuestion">The password question for the new user.</param>
        /// <param name="passwordAnswer">The password answer for the new user</param>
        /// <param name="isApproved">Whether or not the new user is approved to be validated.</param>
        /// <param name="providerUserKey">The unique identifier from the membership data source for the user.</param>
        /// <param name="status">A <see cref="T:System.Web.Security.MembershipCreateStatus"/> enumeration value indicating whether the user was created successfully.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUser"/> object populated with the information for the newly created user.
        /// </returns>
        public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Removes a user from the membership data source.
        /// </summary>
        /// <param name="username">The name of the user to delete.</param>
        /// <param name="deleteAllRelatedData">true to delete data related to the user from the database; false to leave data related to the user in the database.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// true if the user was successfully deleted; otherwise, false.
        /// </returns>
        public override bool DeleteUser(string username, bool deleteAllRelatedData)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets a collection of membership users where the e-mail address contains the specified e-mail address to match.
        /// </summary>
        /// <param name="emailToMatch">The e-mail address to search for.</param>
        /// <param name="pageIndex">The index of the page of results to return. <paramref name="pageIndex"/> is zero-based.</param>
        /// <param name="pageSize">The size of the page of results to return.</param>
        /// <param name="totalRecords">The total number of matched users.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUserCollection"/> collection that contains a page of <paramref name="pageSize"/><see cref="T:System.Web.Security.MembershipUser"/> objects beginning at the page specified by <paramref name="pageIndex"/>.
        /// </returns>
        public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets a collection of membership users where the user name contains the specified user name to match.
        /// </summary>
        /// <param name="usernameToMatch">The user name to search for.</param>
        /// <param name="pageIndex">The index of the page of results to return. <paramref name="pageIndex"/> is zero-based.</param>
        /// <param name="pageSize">The size of the page of results to return.</param>
        /// <param name="totalRecords">The total number of matched users.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUserCollection"/> collection that contains a page of <paramref name="pageSize"/><see cref="T:System.Web.Security.MembershipUser"/> objects beginning at the page specified by <paramref name="pageIndex"/>.
        /// </returns>
        public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets a collection of all the users in the data source in pages of data.
        /// </summary>
        /// <param name="pageIndex">The index of the page of results to return. <paramref name="pageIndex"/> is zero-based.</param>
        /// <param name="pageSize">The size of the page of results to return.</param>
        /// <param name="totalRecords">The total number of matched users.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUserCollection"/> collection that contains a page of <paramref name="pageSize"/><see cref="T:System.Web.Security.MembershipUser"/> objects beginning at the page specified by <paramref name="pageIndex"/>.
        /// </returns>
        public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets the number of users currently accessing the application.
        /// </summary>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// The number of users currently accessing the application.
        /// </returns>
        public override int GetNumberOfUsersOnline()
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets the password for the specified user name from the data source.
        /// </summary>
        /// <param name="username">The user to retrieve the password for.</param>
        /// <param name="answer">The password answer for the user.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// The password for the specified user name.
        /// </returns>
        public override string GetPassword(string username, string answer)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets information from the data source for a user. Provides an option to update the last-activity date/time stamp for the user.
        /// </summary>
        /// <param name="username">The name of the user to get information for.</param>
        /// <param name="userIsOnline">true to update the last-activity date/time stamp for the user; false to return user information without updating the last-activity date/time stamp for the user.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUser"/> object populated with the specified user's information from the data source.
        /// </returns>
        public override MembershipUser GetUser(string username, bool userIsOnline)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets user information from the data source based on the unique identifier for the membership user. Provides an option to update the last-activity date/time stamp for the user.
        /// </summary>
        /// <param name="providerUserKey">The unique identifier for the membership user to get information for.</param>
        /// <param name="userIsOnline">true to update the last-activity date/time stamp for the user; false to return user information without updating the last-activity date/time stamp for the user.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// A <see cref="T:System.Web.Security.MembershipUser"/> object populated with the specified user's information from the data source.
        /// </returns>
        public override MembershipUser GetUser(object providerUserKey, bool userIsOnline)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Gets the user name associated with the specified e-mail address.
        /// </summary>
        /// <param name="email">The e-mail address to search for.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// The user name associated with the specified e-mail address. If no match is found, return null.
        /// </returns>
        public override string GetUserNameByEmail(string email)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Clears a lock so that the membership user can be validated.
        /// </summary>
        /// <param name="userName">The membership user whose lock status you want to clear.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        /// <returns>
        /// true if the membership user was successfully unlocked; otherwise, false.
        /// </returns>
        public override bool UnlockUser(string userName)
        {
            throw new NotImplementedException();
        }

        /// <summary>
        /// Updates information about a user in the data source.
        /// </summary>
        /// <param name="user">A <see cref="T:System.Web.Security.MembershipUser"/> object that represents the user to update and the updated information for the user.</param>
        /// <exception cref="NotImplementedException">This method is not implemented.</exception>
        public override void UpdateUser(MembershipUser user)
        {
            throw new NotImplementedException();
        }

        #endregion


        /////////////////////////////////////////////////////////////////////
        // Custom methods
        /////////////////////////////////////////////////////////////////////

        #region GetToken

        /// <summary>
        /// Initializes the login/password change process by retrieving the user's password salt and a random challenge salt.
        /// </summary>
        /// <param name="userName">The user name to be queried.</param>
        /// <returns>The user's authentication token if the user was found; <code>null</code> otherwise.</returns>
        public string GetToken(string userName)
        {
            return GetChallengeXmlToken("GetToken", userName, DbGetPasswordSalt, DbSavePasswordChallenge);
        }

        #endregion

        #region GetPasswordQuestion

        /// <summary>
        /// Initializes the password reset process by retrieving the user's password answer salt and a random challenge salt.
        /// </summary>
        /// <param name="userName">The user name to be queried.</param>
        /// <returns>The user's password answer token if the user was found; <code>null</code> otherwise.</returns>
        public string GetPasswordQuestion(string userName)
        {
            return DbGetPasswordQuestion(userName);
        }

        #endregion

        #region GetResetToken

        /// <summary>
        /// Initializes the password reset process by retrieving the user's password answer salt and a random challenge salt.
        /// </summary>
        /// <param name="userName">The user name to be queried.</param>
        /// <returns>The user's authentication token if the user was found; <code>null</code> otherwise.</returns>
        public string GetResetToken(string userName)
        {
            return GetChallengeXmlToken("GetPasswordQuestion", userName, DbGetPasswordAnswerSalt, DbSavePasswordAnswerChallenge, DbGetPasswordQuestion);
        }

        #endregion

        #region GetPasswordQuestions

        /// <summary>
        /// Gets a list of security questions.
        /// </summary>
        /// <returns>A list of security questions.</returns>
        public IEnumerable<string> GetPasswordQuestions()
        {
            return DbGetPasswordQuestions();
        }

        #endregion

        #region GetUserFingerprintTemplates

        /// <summary>
        /// Gets a list of security questions.
        /// </summary>
        /// <returns>A datatable containing userid, name and fingerprinttemplate.</returns>
        public DataTable GetUserFingerprintTemplates()
        {
            return DbGetUserFingerprintTemplates();
        }

        #endregion

        /////////////////////////////////////////////////////////////////////
        // Database access methods
        /////////////////////////////////////////////////////////////////////

        #region GetUserID

        /// <summary>
        /// Gets the user ID.
        /// </summary>
        /// <param name="userName">The name of the user to retrieved.</param>
        /// <param name="authenticationMode">The authentication mode.</param>
        /// <returns>The ID of the user; -1 if not found.</returns>
        public long GetUserID(string userName, AuthenticationMode authenticationMode)
        {
            long? result;
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserID";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", authenticationMode.ToString());
                    cmd.Connection.Open();
                    result = cmd.ExecuteScalar().ToInt64();
                }
            }
            return result.HasValue ? result.Value : -1;
        }

        #endregion

        #region GetUserName

        /// <summary>
        /// Gets the user name.
        /// </summary>
        /// <param name="ntAccount">The NT account of the user to retrieved.</param>
        /// <returns>The name of the user; <code>null</code> if not found.</returns>
        public string GetUserName(string ntAccount)
        {
            string result;
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserName";
                    cmd.Parameters.AddWithValue("@NTAccount", ntAccount);
                    cmd.Connection.Open();
                    result = cmd.ExecuteScalar().ToStringSafe();
                }
            }
            return string.IsNullOrEmpty(result) ? null : result;
        }

        #endregion

        #region DbGetPasswordSalt

        string DbGetPasswordSalt(string userName)
        {
            string result;
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserPasswordSalt";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Connection.Open();
                    result = cmd.ExecuteScalar().ToStringSafe();
                }
            }
            return result;
        }

        #endregion

        #region DbGetPasswordHash

        void DbGetPasswordHash(string userName, out string passwordHash, out string passwordSalt, out string challenge)
        {
            passwordHash = string.Empty;
            passwordSalt = string.Empty;
            challenge = string.Empty;

            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserPasswordHash";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Connection.Open();
                    using(var reader = cmd.ExecuteReader(CommandBehavior.CloseConnection))
                    {
                        if(reader.HasRows && reader.Read())
                        {
                            passwordHash = reader["PasswordHash"].ToStringSafe();
                            passwordSalt = reader["PasswordSalt"].ToStringSafe();
                            challenge = reader["PasswordChallenge"].ToStringSafe();
                        }
                    }
                }
            }
        }

        #endregion

        #region DbSavePasswordChallenge

        void DbSavePasswordChallenge(string userName, string challenge)
        {
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_SaveUserPasswordChallenge";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Parameters.AddWithValue("@PasswordChallenge", challenge);
                    cmd.Connection.Open();
                    cmd.ExecuteNonQuery();
                }
            }
        }

        #endregion

        #region DbGetPasswordQuestion

        string DbGetPasswordQuestion(string userName)
        {
            string result;
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserPasswordQuestion";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Connection.Open();
                    result = cmd.ExecuteScalar().ToStringSafe();
                }
            }
            return result;
        }

        #endregion

        #region DbGetPasswordQuestions

        IEnumerable<string> DbGetPasswordQuestions()
        {
            var questions = new List<string>();
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetPasswordQuestions";
                    cmd.Connection.Open();
                    using(var reader = cmd.ExecuteReader(CommandBehavior.CloseConnection))
                    {
                        while(reader.Read())
                        {
                            questions.Add(reader[0].ToStringSafe());
                        }
                    }
                }
            }
            return questions;
        }

        #endregion

        #region DbGetPasswordAnswerSalt

        string DbGetPasswordAnswerSalt(string userName)
        {
            string result;
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserPasswordAnswerSalt";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Connection.Open();
                    result = cmd.ExecuteScalar().ToStringSafe();
                }
            }
            return result;
        }

        #endregion

        #region DbGetPasswordAnswerHash

        void DbGetPasswordAnswerHash(string userName, out string passwordAnswerHash, out string passwordAnswerSalt, out string challenge)
        {
            passwordAnswerHash = string.Empty;
            passwordAnswerSalt = string.Empty;
            challenge = string.Empty;

            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserPasswordAnswerHash";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Connection.Open();
                    using(var reader = cmd.ExecuteReader(CommandBehavior.CloseConnection))
                    {
                        if(reader.HasRows && reader.Read())
                        {
                            passwordAnswerHash = reader["PasswordAnswerHash"].ToStringSafe();
                            passwordAnswerSalt = reader["PasswordAnswerSalt"].ToStringSafe();
                            challenge = reader["PasswordAnswerChallenge"].ToStringSafe();
                        }
                    }
                }
            }
        }

        #endregion

        #region DbSavePasswordAnswerChallenge

        void DbSavePasswordAnswerChallenge(string userName, string challenge)
        {
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_SaveUserPasswordAnswerChallenge";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Parameters.AddWithValue("@PasswordAnswerChallenge", challenge);
                    cmd.Connection.Open();
                    cmd.ExecuteNonQuery();
                }
            }
        }

        #endregion

        #region DbSavePassword

        void DbSavePassword(string userName, string newPassword, bool isPasswordReset)
        {
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_SaveUserPassword";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Parameters.AddWithValue("@NewPassword", newPassword);
                    cmd.Parameters.AddWithValue("@IsPasswordReset", isPasswordReset);
                    cmd.Connection.Open();
                    cmd.ExecuteNonQuery();
                }
            }
        }

        #endregion

        #region DbSavePasswordQuestionAndAnswer

        void DbSavePasswordQuestionAndAnswer(string userName, string question, string answer)
        {
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_SaveUserPasswordQuestionAnswer";
                    cmd.Parameters.AddWithValue("@UserName", userName);
                    cmd.Parameters.AddWithValue("@AuthMode", DomainAuthenticationProvider.AuthenticationMode.ToString());
                    cmd.Parameters.AddWithValue("@PasswordQuestion", question);
                    cmd.Parameters.AddWithValue("@PasswordAnswer", answer);
                    cmd.Connection.Open();
                    cmd.ExecuteNonQuery();
                }
            }
        }

        #endregion

        #region DbGetUserFingerprintTemplates
        DataTable DbGetUserFingerprintTemplates()
        {
            var fingerprints = new DataTable();
            using(var conn = new SqlConnection(_connectionString))
            {
                using(var cmd = conn.CreateCommand())
                {
                    cmd.CommandType = CommandType.StoredProcedure;
                    cmd.CommandText = "Security.Pr_GetUserFingerprintTemplates";
                    cmd.Connection.Open();
                    using(var reader = cmd.ExecuteReader(CommandBehavior.CloseConnection))
                    {
                        fingerprints.Load(reader);
                    }
                }
            }
            return fingerprints;
        }
        #endregion

        ///////////////////////////////////////////////////////////////////
        // Helper methods
        ///////////////////////////////////////////////////////////////////

        #region ValidateCredentials

        /// <summary>
        /// Validates the user's credentials against the database.
        /// </summary>
        /// <param name="userName">The user name to be validated.</param>
        /// <param name="credential">The credential to be validated.</param>
        /// <returns><code>true</code> if the credentials are valid; <code>false</code> otherwise.</returns>
        bool ValidateCredentials(string userName, string credential)
        {
            string challenge;
            string password;
            string salt;
            DbGetPasswordHash(userName, out password, out salt, out challenge);

            var dbCredential = SecurePassword.Obfuscate(password, salt, challenge);

            return credential == dbCredential;
        }

        #endregion

        #region ValidateAnswer

        /// <summary>
        /// Validates the user's credentials against the database.
        /// </summary>
        /// <param name="userName">The user name to be validated.</param>
        /// <param name="answer">The answer to be validated.</param>
        /// <returns><code>true</code> if the answer is valid; <code>false</code> otherwise.</returns>
        bool ValidateAnswer(string userName, string answer)
        {
            string challenge;
            string answerHash;
            string salt;
            DbGetPasswordAnswerHash(userName, out answerHash, out salt, out challenge);

            var dbAnswer = SecurePassword.Obfuscate(answerHash, salt, challenge);

            return answer == dbAnswer;
        }

        #endregion

        #region GetChallengeXmlToken

        string GetChallengeXmlToken(string tokenType, string userName, Func<string, string> getSalt, Action<string, string> saveChallenge, Func<string, string> getContent = null)
        {
            if(!String.IsNullOrEmpty(userName))
            {
                try
                {
                    // returns null if userName does not exist
                    string content = null;
                    if(getContent != null)
                    {
                        content = getContent(userName);
                    }
                    var salt = getSalt(userName);

                    if(!String.IsNullOrEmpty(salt))
                    {
                        var challenge = SecurePassword.CreateSalt();
                        saveChallenge(userName, challenge);

                        var token = new XElement("Token",
                            new XAttribute("Salt", salt),
                            new XAttribute("Challenge", challenge)
                            );
                        if(content != null)
                        {
                            token.Value = content;
                        }
                        return token.ToString();
                    }
                }
                catch(Exception e)
                {
                    if(WriteExceptionsToEventLog)
                    {
                        LogUtility.WriteApplicationEventLog(e);
                        throw new ProviderException(ExceptionMessage);
                    }
                    throw;
                }
            }
            return null;
        }

        #endregion
    }
}