Security :: Encrypting Passwords With T-SQL That Will Be Decrypted By Asp.net Membership Provider

Mar 4, 2011

I have been killing myself over this for a couple weeks now and cannot find a viable solution. Here's my scenario:

I have a DTSX package that imports user data from an external database. It then creates user accounts and profiles in the local database. Users can also be created via a custom ASP.NET Membership Provider. The provider must be able to authenticate both types of users.

This was all fine and dandy during development because passwords were stored as clear text. However, now that we're ready for release the passwords format of the provider must be set to encrypted and so the users created via the DTSX must be created with an encrypted password. (I'd prefer the passwords were hashed but the client's requirements are that passwords be recoverable). The real problem seems to be creating an encrypted password within the DTSX that will be decryptable by the ASP.NET Membership Provider.

My original solution was to have the DTSX call a CLR stored procedure that had access to the same encryption logic as the provider. I got it working but our client wouldn't enable CLR integration. So that's out the window. Now I'm investigating alternatives. One alternative is to simply use the built-in encryption methods of T-SQL. But how do I share the keys used for the encryption/decryption?

My question is, is it possible to generate a password in T-SQL, say using EncryptByKey, that will also be decryptable by my provider? This means that the key in SQL must match the key in my machineKey configuration.

View 2 Replies


Similar Messages:

Security :: Encrypting Passwords On Client?

Nov 1, 2010

I want the login password to not be sent in plaintext (due to the risk of hijacking). I know that this can be achieved in principle using MD5 or the like, but is there a common implementation for use with Asp.Net? Of course, it's crucial that the resulting hash (?) isn't easy to decrypt. When I read various posts on this matter, some people say it's just to do a reverse on the encrypted string, so that in effect, this is totally useless.

View 6 Replies

Security :: Forms Authentication With AD Membership Provider And SQL Role Provider?

Jul 27, 2010

I am trying to build an application that

1. user can login by their AD account and password.

2. AD account can be assigned to different group.

I know there is a training video - [URL] to teach how to use the tool to provision the membership schema to SQL server for Forms authentication. but how can I use AD authentication with this?

View 1 Replies

Security :: Implement custom Role Provider And Membership Provider?

Dec 1, 2010

i have implemented custom role provider and membership provider .

login page : SignIn.aspx

on successful login it redirects to (index-Homepage.aspx)

now PROBLEM is when it successfully logged in ,and redirects to 'index-Homepage.aspx' it gives Anornymoustemplate ..while its verifying the role correctly in index-Homepage.aspx.cs

View 1 Replies

Security :: Difference Between Role Provider And Membership Provider?

Dec 1, 2010

1 - whats the difference between Role Provider and Membership provider ??

2- If we implement Custom Role Provider or Custom Membership provider then what does this means ? and which Provider do we use when we apply custom role provider or custom membership provider

View 4 Replies

Security :: Big Extension Of Membership Provider - Should Use A New Custom Provider

Mar 27, 2010

i'm building an application and i need to manage roles, users and more things so i tought to use the membership provider but i have some questions about it: can i full extend it and can i override the functions to use a database table to store infos about config or i need to build my own provider?

View 4 Replies

Encrypting Existing Passwords?

Aug 5, 2010

found while searching for help on my asp.net application.I have a small application with connected to a SQL database. As it was so small, and contained very little data of any importance, i had set it up with Clear passwords.Now i have been asked to expand the database considerably, and encrypted passwords are now required. I can easily modify the web.config so all future users are set up with encrypted passwords. But is there any way to change all existing users passwords to be stored encrypted?

View 10 Replies

Hashing Vs. Encrypting Passwords?

Feb 9, 2011

I'm using ASP.NET membership for a site that will serve primarily sophisticated users. I understand the difference between hashed and encrypted passwords, and I'm trying to decide between the two.After my last client complained bitterly about hashed passwords being a total PITA, I've started to favor encrypted passwords. But someone suggested this just isn't secure enough.So my question is: What, exactly are the risks of encrypting passwords? Any person with the ability to steal passwords by decrypting them from the database would surely have the ability to reset them if they were hashed, no? I'm having trouble seeing where someone could cause trouble with encrypted passwords but couldn't with hashed ones. Making it convenient for users is also important.

View 4 Replies

WebMatrix :: Encrypting Passwords When Registering A New User?

Mar 9, 2011

I seem to be having some difficulty working out how to encrypt the user's password at the time they register for an account. To ensure that I am storing the password securely, I would like to be able to encrypt the password before it is inserted into the database.

When the user logs in I can then encrypt their password at log in time and compare this to the encrypted password in the database, meaning that the password in the database never needs decrpyting.

View 2 Replies

Security :: Reset Passwords / Create User / Recover Passwords On An Intranet

Aug 4, 2010

My issue today is that i have a MySQL Database and am using the security framework provided by the ASP.NET Membership and Role Providers...I override the default methods with my own MySQL.

Now the issue comes in when i someone would like to have their password reset. My application is running entirely on an Intranet so i cannot have their passwords emailed to them. Is there a way i can have this information displayed in any way so that the user can use it to Log Reset, Create Accounts or Recover their lost passwords on an intranet without the administrators intervention?

Recently i had an approach as follows. In my web.config<system.net><mailSettings><smtp deliveryMethod="pickupDirectoryLocation" and my location was a folder on C drive as c:/SavedPasswords. Now i understand this was such a big security threat and thats why i am looking for a better option.

I would have that folder created using my System.IO and then the Mail is dropped into that folder. Then after the process is successful, i tell the user to check into that location and Read its content.

Then there is a global variable that is set to true...meaning that the folder at c:/ has been created. then there is a Method in a certain class that once it sees this variable True, it reads the readers c:/ and deletes that folder "save" if it exists;

View 2 Replies

Security :: Change Existing Clear Passwords To Encrypted Passwords?

Aug 4, 2010

I have a small database, with a very small number of users. The passwords were stored as clear as the database was so small and held no sensitive data. The database is now to be expanded and passwords are required to be encrypted. I can change the Password Format in the web.config, but is there a way to change the existing passwords from clear to encrypted?

View 1 Replies

Security :: SQL Membership Provider Using .NET 3.5 C#?

Dec 13, 2010

I am using SQL Membership Provider to create user accounts for my web site and for some reason, the CreateDate and LastLoginDate fields are NOT saving the current time of my machine when I add a new user to the website. It is showing the previous day's date and the time is displayed as PM when it's AM and vise-versa in the CreateDate and LastLoginDate fields in aspnet_Membership table. I am developing and running the website via localhost on my laptop using IIS 7 (Windows 7). Does this have anything to do with my laptop's clock settings or is there something I need to configure in the web.config file or in IIS.

View 4 Replies

Security :: Lastlogindate - .NET 2 Membership Provider?

Feb 18, 2010

to allow admin to log into a members account in the ASP.NET 2 Membership provider and not change the lastlogindate field?

View 3 Replies

Security :: How To Customize Membership Provider In .net 3.5

Sep 1, 2010

I have more problem in costomize membership provider, i did download the code in c# from videos tutorial, that code have Membership provider class. but i am unable to use that class. how i will use it.

View 7 Replies

Security :: Extending .NET Membership Provider

Feb 23, 2011

am having an argument at work on the asp.net membership provider.One of my colleagues says we should modify the tables and add our own custom columns, and i prefer we create additional tables and add relationships.

View 1 Replies

Security :: Configuring Membership Provider To Use SSL?

Jan 4, 2010

Im learning how to use the SqlMembershipProvider. I want to use my google mail account to send the automatic mail message like for example to recover passwords.

I have this in my web-config

<system.net>

View 6 Replies

Security :: Default Membership Provider Must Be Specified

Mar 16, 2010

Server Error in '/' Application. Default Membership Provider must be specified. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.Configuration.Provider.ProviderException: Default Membership Provider must be specified. Source Error:

[Code]....

Stack Trace:

[Code]....

View 1 Replies

Security :: Integrating YAF To .net Membership Provider?

Jul 3, 2010

I have a website with asp.net membership, and its fully working.. today .. I installed YAF -yet another asp.net forum- version 1.9.4 to a subdirectory in my website.

the problem is .. both of them are working independently, and i need to integrate them to work with one login system.

View 1 Replies

Security :: MVC With Custom Membership-Provider?

Oct 27, 2010

i'm new to the mvc framework but i used forms authentification in an asp.net webapplication. Because im forced to use Sybase SQL Anywhere server i use membership / profile / role provider from sybase.Why i can't login in the MVC Application? When i create a user via mvc web control i'm logged in. But when i logout and try to login i get a error that username or password is not correct.Maybe someone has an idea? Could it be a problem with the application name? Both have the applicationname " / " ?Both applications has these web.config entries:

[Code]....

View 3 Replies

Security :: Get The PasswordAnswer From Membership Provider?

Mar 22, 2011

How do i get the PasswordAnswer for a particular user from Membership provider??

View 4 Replies

Security :: Choosing The Provider For Security Membership?

Feb 9, 2010

I have started to implement asp membership. I go the administration page and click provider. I have a database on a server on the local network that i want to install my members tables in. When i run the

aspnet_regsq.exe it doesn't ask me what SQL database i want to use and seems to default to my local SQL Server 2005 installation. How I change this to use my SQL Express database on a local server?

View 6 Replies

Security :: Webshop Security - Membership Provider Useful?

Aug 10, 2010

I have to implement a small webshop. Basically it's just a website with a huge backend ERP System and with the possibility to sell one (yap, really only one!) product on the website. The only requirement is a MySQL Server. The backend is almost finished (about 95%) and is secured with the .net MemberShip Provider for MySQL (the one in MySql.Web from the MySql Connector .NET).

Now to my question: I can set up the membership system easily but I do not need such things like username or password-question but I would need a reference to an address table to store the users home address. So, it is possible to change or customize the membership system to for eg. a unique customer id instead of the username column and set this in codebehind when the user is creating a new account? And is it possible to insert new users/customers from codebehind in an easy way? (I mean without checking each foreign key and inserting the customer reference to the userinrole table and so on...)

View 10 Replies

Security :: Can Use The Membership Provider Api On A Hosted Service

Oct 16, 2010

Can I use the membership provider api on a hosted service? I can create mssql databases but have no control over iis. Will I be able to use the membership admin webpage on the hosted service?

Am I correct in stating that the api uses ASPNETDB.MDF in the app_data folder as it's database?

View 2 Replies

Security :: Membership Provider Changes After Successful Login?

Nov 8, 2010

I have a site in which I'm intending to use multiple membership providers. I'm using my own custom membership provider to provide access to several data stores depending on the section in which the user's information resides.

The actual login functions correctly using the built-in ASP.NET Login component in which I've manually specified the membership provider it should validate against. When I run a trace on it's actions, I can see that it attempts the 'validateuser' against the correct data store and continues to redirect the user to their applicable section.

The problem is that once they are logged in and the site (or I) call 'GetUser' to get the users information or permissions, the membership provider reverts to the site's default provider.

In my custom membership provider I'm only overriding the methods for GetUser and Validate user which is working perfectly fine for a singular membership provider, but not when using a different provider.

How can I ensure that the correct membership provider is retained with the user's membership details? Is there a method that I need to override/append in order to achieve what I'm looking for?

View 1 Replies

Security :: Using Membership Provider With Database Design?

Mar 18, 2010

I've just finished my database design and now i'm going to start implementing it in SQL Server 2008. Since i'm creating an ASP.NET Web Application i would like to use Membership Provider to manage user access to the application. In other projects (more simpler) i used Membership but always with its default parameters.

In this recent application i need to use custom user data for it to work properly.

So, what i would like to know is, how can i use my 'Users' table in my DB with .NET Membership Provider?

View 4 Replies







Copyrights 2005-15 www.BigResource.com, All rights reserved