As I mentioned, .Net profiles can be used for both authenticated and anonymous users. For an authenticated user, the profile is associated with the user identity that is stored in the User property of the current HttpContext. This identify will have been determined by the authentication mechanisms in use: ASP.Net forms authentication, Windows authentication, Passport authentication, or your own custom authentication scheme.

If you want to use profiles with anonymous users, you must define the profile properties to be managed for these users, as described in the previous section. Anonymous identification must be enabled for your application; it is not available by default. You do this by including an <anonymousIdentification> element in your application's configuration file. The various settings for anonymous identification permit you to define various aspects of how it is implemented; you can refer to the ASP.Net help for the details.

How exactly does anonymous identification work? It uses cookies — so I was not 100% accurate when I said that ASP.Net profiles let you do without cookies. But the fact is that you don't have to mess with them directly — the framework does it all for you — and they are not be needed at all if you are using profiles only for authenticated users.

Using Your Own Profile Provider

If, for any reason, you do not want to use the default SQL Server-based profile provider, you can define your own. Your profile provider class will be based on the abstract ProfileProvider class that defines the contract for ASP.Net profile providers. While not as easy as using the default provider, this base class greatly simplifies the task of creating your own profile provider that uses another data store such as XML or a database technology other than SQL Server.

The ProfileManager Class

You might think that profiles sometimes need managing — and you would be absolutely right. The ProfileManager class is provided for just this purpose. This is a static class so your apps can use it without creating an instance. One use for ProfileManager is deleting inactive profiles. The DeleteInactiveProfiles method can delete all profiles that have not been active since a specified date and time, letting you flush the profile data of previous site visitors who are no longer visiting the site. You can also retrieve information from inactive profiles, letting you perform actions such as sending "We haven't seen you in a while" reminders to inactive site visitors (assuming their e-mail address is part of the profile information).

Summing Up

The support for user profiles, which by the way is new in ASP.Net 2.0, is another example of thinking about what the programmer actually needs to do in real-world applications. Compared with the "roll your own" approach that was required in the past, using ASP.Net profiles is quite amazingly easy. It provides flexibility that older techniques lacked and, at least for authenticated users, avoids the need to store any data on the client machine. Sounds like a home run to me!