Security :: Trouble Authenticating From Non-SSL To SSL?
Mar 21, 2010
I have an ASP.NET 3.5 Web Application using the Default membership provide provided by .NET - I have created a login page and create user page, etc. etc... The problem is, if you're on the site and you are authenticated, and then you go to a link on the same authenticated folder (Called MemberPages) but you go to a SSL location, it asks you to enter your username and password again! Is there anyway to fix this bug.HomePage -> Login.aspx -> Enter your username and password -> Access MemberPages/Default.aspx -> Then a link called Purchase a Product -> suppose to take you to[URL]
Does anyone have an example of authenticating through a webservice ?I have a website that allows users to login in using the <asp:Login> control.After they are authenticated I want them to use a webservice to add records, modify records. (The web service will be used later by external sites).I have a webservice up and running which the aspx page "authenticates" to using Profile.UserName.Is there a way to get the aspx page to send the username and password used at log on without having the user enter it each time ?And then how do I authenticate them ? (maybe using Membership.ValidateUser ?)
I have a asp.net (3.5) web-app that will be used in an intranet. I need to enforce that users type in their network credentials (windows credentials) before they can log into this application. I intentionally need to disallow Integrated Windows Authentication. I need to authenticate these users against my company's Active Directory, that is obviously on the same network as my .net web app.
I have been reading a bit about Forms Authentication using ActiveDirectoryMembershipProvider - [URL]. I also stumbled upon this - [URL]. Based on what I can tell, both seem to do what I need to get done. Could somebody tell me what are the major differences, pros/cons and when you would use which method? Or are these exactly identical, and both achieve the exact same results?
From the security perspective...what do I need to watch for? I am assuming if I use SSL that will cover me for when I pass the username/pwd to AD for verification?
I have a website that requires users to login, but I am having problems when authenticating a users.I create a user which works fine, I then test the login on the development machine and everything works fine the user is logged in.But if a try to login the user in via the live website (same database) I get errors stating that the login attempt has failed.I don't understand why it would work on the development machine but won't work with the live version of the website.
I am using Login control and validationg the user against SQL datasource. below is the code:
Protected Sub Login1_Authenticate(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.AuthenticateEventArgs) Handles Login1.Authenticate e.Authenticated = IsValidUser()If IsValidUser() = True Then Response.Redirect("Orders.aspx")End If End Sub Here is IsValidUser Private Function IsValidUser() As Boolean Try Dim sql As String = String.Empty Dim RecCount As Integer = 0 sql = "Select count(*) from UserLogins where UserName='" & clsDB.RemoveQuote(Me.Login1.UserName.Trim) & "'" sql = sql & " AND UserPass='" & Me.Login1.Password.Trim & "'" RecCount = clsDB.ExeScalar(sql) 'If Invalid ==> 0 means no record is being returned by Query If RecCount = 0 Then IsValidUser = False 'MessageBox.Show("Invalid User Name/Password.", "Invalid", MessageBoxButtons.OK, MessageBoxIcon.Stop) Exit Function End If If RecCount = 1 Then IsValidUser = True Exit Function End If 'Error handler Catch ex As Exception End Try End Function
Here comes the problem validation code is working fine and it validates the user and redirects the user to the "Order.aspx" page
For example: I type Login Name: Nashy Password: 1234
Order.aspx page has a textbox which supposed to display the current user login name and i am usiong the following code for that
when i test it on my local PC it shows the current user like this DOMAIN ashyMastrew.. what i want that the textbox should disply "nashy" not my current windows login name. and when i deploy it to the server and access it from other pc textbox does not show anything.
For my current project I am using form authentication.What occasionally will happen is a user will timeout (unbeknownst to them),they try navigating to a different page (call it Page B) and they get kicked back to the login screen.This is fine and I have no problems with this.
However,after they enter their credentials and are authenticated they are redirected back to "Page B" and an error is produced because a session variable wasn't loaded. This is due to the fact that they were redirected to "Page B" instead of the page they would normally hit after a login (call it Page A).Is there anyway to force the user to go to Page A instead of Page B in these situation to avoid these errors?
I have a form that allows a user to import a spreadsheet. This spreadsheet is generally static when it comes to column headers, but now the users want to be able to include an optional column (called Notes). My code crashes when I try to read the column from the spreadsheet if it doesn't exist.
I have a project who build in MVC 1 and i make a new fresh project to migrate them in MVC 3. so it's work fine. but whenever it's come to done or complete we hear that not make changes in Admin panel.so i copy paste the model [logic module] from MVC 1 to MVC3 and now many of code was not worked. they used dll to use logic. when i try to use them in my project who is new version that's not worked.now i thing to migrate the MVC 1 project to MVC 3 and the taks and changes i do last days i integrated in old one.well tell me the way i can use to migrate the MVC 1 project to MVC 3 razor without making new project. means changes in old and make them work fine in razor.
Edit: I solved my problem but if you have anything to add do. Note: I did not create the DB it was created by Wordpress hosted on GoDaddy with my site I have a MySql Database called "wordpress" (for clarity). I want to be able to grab the most recent post from my blog and show it on the landing page for my url. So my thought is this: connect to the MySql DB, run a query to grab the most recent post, display the post.
I built a class to handle the connection and process the request:
public class DAL { private string connectionString = "DRIVER={MySQL ODBC 3.51 Driver}; SERVER=[server here]; PORT=[port]; DATABASE=wordpress; USER=[user name here]; PASSWORD=[password here];"; private OdbcConnection blogConnection;
having trouble defining bindings using ninject.I am in a standard ASP.NET WebForms application. I have defined an http handler to Inject dependencies in pages and controls (Property injection).Here is what I am trying to do:I am creating a custom combobox usercontrol. Based on the value of an enum on that combobox, I want to be able to Inject a different object in a property (What I am trying to do is a bit more involved than that, but answer to this should be enough to get me going).
Having trouble putting together a good solid newsletter.Can some of you experts help me with this problem. Either with code or link tutorials.everything!
We are working with a vendor to develop a mobile app and plan on using WCF services to handle operations. What are some types of authentication I can use with a WCF service? Would we send a user name and password through the SOAP header? How can we accomplish this securely?
Also, this will be authenticated against our .NET membership database using the Membership classes.
I've noticed that it is possible SQL Server 2005/2008 to authenticate replication accounts using certificates. Is it possible to authenticate .NET SqlConnection in the same manor?
Ideally, I'd like to do away with password authentication completely and have the aspnet user connect using a certificate stored against its account.
I have a website that requires a login. I'm used the login wizard in asp.net 2008. The site is in vesion 2.0 as that is what the hosting company allows. The login scipt apprears to work appropriately in that if the the wrong username or password is entered the error appears and the url for the login page doesn't work. Once the correct identification info is entered, the user is taken to the correct url.
The problem is that the username does not seem to "stick" for lack of a better word. The site is used to order wedding photos. The user selects the photos and all the required date EXCEPT the user name is entered into the database. This is a problem since there is no way to filter the order when the person goes to the shopping cart therefore the shopping cart opens with no product in it. To make matters more frustrating, IT USED TO WORK! I don't understand why its not working now.
The hosting company, 1and1.com has looked over the code and can't find anything wrong with it. Their one suggestion was to add the following "patch" code to the web.config file as a "work around", and if that didn't work to try using vwd 2010. I'm hesitant to do that since I've not used it before and don't want to make matters worse.
I'm including my web.config page as well as a sample of the code behind to see
I have a repeater that retrieves questions from a database and displays them on the screen along with a group of radiobuttons. The radiobuttons display correctly and seem to work (only one can be selected per question), but I'm having trouble referencing the buttons from code-behind (C#) to see which button has been checked. So far I've been trying to access the radio buttons this way:here "current" references the index of the current question,
Things like .Checked (after the code above) do not work since the code does not recognize the returned item as being of type Radiobutton. The radio buttons are grouped, so if there is a way to find out via the groupname
I have a table that could look like the left table in the following picture, but i want to present it as the right table in the picture. http://pici.se/549963/?size=fullsize
So i've found out that i could use pivots to do this, but am having some trouble getting it to work, so if you know how to do this.
I have a panel on my page called pnlLogin.In the code behind I have the following line.pnlLogin.Visible = FalseThis errors out when run everytime with the "Object reference not set to an instance of an object." I have done these a million times before, but this page is giving me all sorts of trouble.How could an existing control give this error?
I used your url...to read mail and I downloaded your project when I run project I filled my gmail credential : smtp.gmail.com, uid, password and port=995 and checked SSL but I gor error.You cannot get the message count without authenticating yourself towards the server first.
I'd like to pull several NewValues from a FormView and write them to a database as part of the Update command.For some reason, I am unable to do this using the following code. Is there something I am missing?
I have a SqlMembershipProvider store with Roles enabled. This is configured and has the user "devtest" in the roles "xxUser" and "xxAdmin".
I also have a WCF service, which I want to authenticate and authorize against. My problem is that:
the authorisation is not happening, code just executes despite the policy attribute I don't get any identity or security context so do not know who is calling the service I need: to know which user is calling the method some degree of rejecting users if permissions don't match (ideally this should be performed within the RoleProvider/MembershipProvider/WCF but can do it myself if I have to) SSL in transport
I have my service contract set up thus:
[ServiceContract] public interface ISupportService { [OperationContract] [PrincipalPermission(SecurityAction.Demand, Role = "ThisRoleDoesNotExist")] List<BaseInterestRate> GetAllBaseInterestRates(); } the code is simple enough: public class SupportService : ISupportService { public List<BaseInterestRate> GetAllBaseInterestRates() { OperationContext operationContext = OperationContext.Current; ServiceSecurityContext serviceSecurityContext = ServiceSecurityContext.Current; // is always null using (xxxEntities entities = new xxxEntities()) { return new List<BaseInterestRate>(entities.BaseInterestRates); } }} My service configuration is thus: --> <behaviors> <serviceBehaviors> <behavior name="SupportServiceBehavior"> <serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" /> <serviceDebug includeExceptionDetailInFaults="false" /> <serviceAuthorization principalPermissionMode="UseAspNetRoles" roleProviderName="AspNetSqlRoleProvider" /> <serviceCredentials> <userNameAuthentication userNamePasswordValidationMode="MembershipProvider" membershipProviderName="SqlMembershipProvider" /> </serviceCredentials> </behavior> <behavior> <serviceMetadata httpGetEnabled="true"/> <serviceDebug includeExceptionDetailInFaults="false"/> </behavior> </serviceBehaviors> </behaviors> <serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
I have followed the instructions at these pages to the letter:
How to: Use the SQL Server Role Provider with Windows Authentication in WCF Calling from Windows Forms (MSDN) How to: Create and Install Temporary Client Certificates in WCF During Development (MSDN) How to: Use wsHttpBinding with Username Authentication and TransportWithMessageCredentials in WCF Calling from Windows Forms (MSDN) Also quite useful found via SO: Use Asp.Net Membership provider with a WCF .svc service (Alkampfer's Place)
I would at lest expect an issue with certificates/transport/etc. to fail with exceptions, but I can debug right in and over the WCF call. I have no security context/ user context available to me and when I use a user not in the two mentioned roles (which I do in the code example above), I don't get "kicked out".
My client app is currently a Web App, but will ultimately also serve a Windows Forms app and Test suite. I'm currently using the ASP.NET WebDev server and am running .NET 4.0.
trying to create a stored procedure to authenticate users, if users are authenticated their data like userid, first name, etc are returned in a cursor. However, if users are not authenticated an error is returned or something that indicates users were not authenticated.
But I don't know how to do this in a stored procedure.
