I need to realize for administrator ability to block/unblock user. I do it by following way:
[Code]....
but if this user is already logged that these changes will be only during next login. I need to throw this user to login page in next his request. I have 2 way:
1. Add to verification to each request
2. remove his session
How can I realize second way? I try to do it:
[Code]....
Im working on a website where users can log into a members area, inside this area they will be able to communicate with other members.
In order to keep an accurate list of who is online and who is not, I would need to update a IsOnline field in my database when they log on and when they exit my website..
The login part is easy, but how can I determine if someone is leaving my website to go to another, or closing the browser.
I am getting a "System.NullReferenceException" when I call
View 3 Repliesis there a way to set code that automatically signs out the logged in user if they are redirected away from any file or directory under the main url?
View 2 RepliesI have a Default(contains the sign-out button) and Login page, once the user is not authenticated, it will always redirect the user to login page.
So the scenario is when the user hit the sign-out button it will redirect him to the login page which is good. My problem is, when the user hits theprevious or back button from the login page,it will still read the authorization cookies and redirect him to the default page. which should not be the case. the user should be redirected to login page when authentication is invalid.
I've read some solutions on the net, but still it doesn't work for me. below are the codes I've used for my sign-out function
[Code]....
By the way, when the user is authenticated, the previous or back button is available/enable for the user.
I used the Create User Control to make a new user.
Is there a similar tool (I did not see one) that allows the user to edit their own profile?
If not what is the best way to do it? I have created user tables in AWAT.
I am using the ASP.NET default users database (Memebership) , I need two things Limit Users , I need to make limitation of creating new user , like maximum 10 users Same user name can't be used in other computer , and will signout or give error msg that somebody using same error without allowing user to login.
View 6 Repliesi have three types of users and i want each one of them to reach only its pages not the othersi want to know what to do in database and the code
View 9 RepliesHow to make a secure login page using sql database by matching a user name and password and redirect them to differnt page as admin and user
View 2 Repliesi have a doubt on how to show a popup???`
f (machineID.Count != 0)
{
checkMachineGrpState(machineID);
}
else
[code]...
yes, I know these are 2 different things
I am trying to "marry" them up together. so lets say if session timeout is 2 minutes and same with forms authentication.
I want the ability to redirect the user to a page. (no, not using meta tags or anything to refresh the page) on any navigation after the time out.
Sure, create a control and drop it in the master page. All good
but there doesnt seem to be a way to determine if a user was logged in and if so... do what I need to do (i.e Signout and redirect) but it should not impact users who have not logged in.
The only time objects are being added to the session is when the User has logged in. infact the only object in session is a Custom User object.
i am working in asp.net and csharp, we have 10 user, but certain user only need to put dataentry. how to enable and disable based on the user to access certain form ,like add, modify view options.
View 1 RepliesIs it possible to validate a user's Username + Password without logging them in? I understand a usual login block will look like this:
[code]....
With the Membership.ValidateUser() call setting the cookie for the response.
However, there are some additional checks I'd like to perform after the password is confirmed. (Pulling out an expiry date for that user, for example).
Is there a way to do it without just calling FormsAuthentication.SignOut(); after invalidating the page?
I have an MVC app that uses [Authorize] to protect the private bits. When I select the SignOut() URL it signs me out but if I hit the back button on my browser the it goes to the secure page and even lets me use the form. The action takes place and then it shows that I'm signed out. The problem is that it performs the secured action (inserting a row into my database). Then I can use the back button again and do it all over. If I use the back button after logging out and hit the browser refresh it does show I'm logged out and refuses me access to the secure page. Am I missing something important? It seems like it could be a really big security issue.
public ActionResult LogOff(string ReturnUrl)
{
FormsAuth.SignOut();
if (!String.IsNullOrEmpty(ReturnUrl))
{
return Redirect(ReturnUrl);
}
else
{
return RedirectToAction("Index", "Page");
}
}
Created in VS2008
The login page is created with the masterpage and it has the header picture.
After Logout or run FormsAuthentication.SignOut();
The login page is not showing correctly with the header (from master page).
And the setting on the web.config as below:
<authentication mode="Forms">
<forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH">
</forms>
</authentication>
<authorization>
<deny users="?" />
</authorization>
Is there any reason why the header from masterpage can not be viewed from the login page?
can we make our own SSL or SSL macanism in SSL? Or please advice if there is any way that we can provide such security to web applicaiton without getting services from other companies ?
View 1 RepliesWe are using membership provider for LDAP authentication. It is working as it should.
But what all configuration settings I have to do so that
all the future requests to this application run under the security context of the Logged in user account not through the some default user set in IIS.
We need to have this working because all the permissions on the database are based on the logged in user.
We are using form authentication for LDAP authentication. And having impersonation = true in web.config.
I have identity impersonate = true in the Web.config file. I have integrated security = true in the DB connection string in the Web.config file.Before identity impersonate was true,users were able to access the DB through the web service account (seemingly).Now I get an error which says " Login failed for ... " because I am aware there is no specific account for that user in the permissions for that DB instance.I needed to set identity impersonate = true because the web service does not have access to the Active Directory,which I need to retrieve certain user information.
My question is,does identity impersonate = true override the integrated security and attempt to user the authenticated user's account to connect to the DB? Is there a simple way to prevent this in the Web.config itself?If not,would programatically impersonating the user within the Active Directory query functions and setting identity impersonate = false do the trick here?
I have created user web control library project and these controls i'm using in my web application. These User controls just works fine in my local machine but when i moved this project(including Library) to our Local server , it is throwing security exception
Error 1 Cannot register assembly "LocalServerLibraryDemoLibraryDemoLibraryinDebugLibrary.dll". Request for the permission of type 'System.Web.AspNetHostingPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed. Library
Anybody knows why this error occuring...?
I simply want to know how to manually check if the value a user has provided for the answer to their security question matches their current answer on record. I want to use the build in support of the membership and membershipuser objects.
I see that via the passwordrecovery control that the actual answer can be returned. However I am currently not using this control and it would take a good bit to integrate it as it does not meet our user's requirements.
In a worst case scenario, getting the actual answer (like the passwordrecovery control does) and manually checking it in our application would be acceptable.
A best case scenario is some sort of API where I can pass in the user name and the answer to their security question that was provided and simply get an indication of whether answer was correct or not.
I'm trying to allow logged user who are in department XYZ to perform some task for my third party App. I have two SQL tables named Users & UserList. The third party app (GoldMine) graps the USERNAME from the Users table and store it as UserID which I then referecnce SessionID. The UserList table has two columns (GM_UserName & Department) which I'm interested in. When a user login into the 3rd party app (GoldMine), i then compare the USERNAME (from Users table) to GM_UserName (from UserList table) and see whether GM_UserName is in = 'Dept XYZ'. Take a look at the SQL query below.
sqlDept = "SELECT USERNAME FROM Users LEFT JOIN UserList ON UserList.GM_UserName=Users.UserName WHERE UserList.Department ='Dept XYZ'"
I'm able to do this.
If Session("Userid") = "TestUser1" Or Session("UserID") = "TestUser2" Then Do this Else Do that End If
BUT unable to do this...
If user's Department = 'Department XYZ' Then
Do This
Else
Do that
End IF
I have implemented Forms authentication in an ASP.NET MVC 2 website
By using <%: Page.User.Identity.Name %> on the Site.Master page I can display the userid of the logged in user.
I would like to use this value and display other information about the user that is stored in a User table in a MsSQL database, like:
<%: GetFirstname(Page.User.Identity.Name) %>
I Have Question : Can I Edit Create User Wizard To Save Info To My Project Sql ? And Where Normal Create User Wizard Save Info Of Register?
View 5 RepliesI deployed a website where a logged user or an anonymous user can select data and download a XML file. The website generate the XML file in the server and then deliver it.
It works fine in my development environment, but after deployment, the anonymous user can download the file, but the logged user receive this error:
System.UnauthorizedAccessException: Access to the path 'd:HostsLocalUserheringerwebsiteUpload20110107094051.xml' is denied.
It is weird that as anonymous i can do it.
The website server help states this:
"Grant write, modify, delete access rights on website's folder
Your website executes under unique user account that by default has full control over the website's folder.
So your application can create, open, read, write and delete files and folders inside of your root folder.
There is no need and no way to change this permissions.
If, when running ASP.Net application, you still unable to create file or update it, you have to check your Web.Config file for "<Identity impersonate..." tag and remove it.
The only exception is when the application tries to modify a file or folder in "Application_Start" event of Global.asax file. This is by design that user authenticated only after the Application_Start even. Before the user is authenticated your website runs under an identity of Application Pool which is "Network services". That account doesn't have access to the folder of your website.
To make it work you eather have to move the code that tries to modify files or folders out of the "Application_Start" event of the Global.asax file or inside the event you'll need to impersonate your user by code."
But i am not using impersonate and the tag is not in my web.config.
I am createing user dynamially with the below code; string MyPassword = Membership.GeneratePassword(8,0).ToString(); Membership.CreateUser(TextBox7.Text, MyPassword, TextBox8.Text); but before I start creating, I would like to check if the user name is used before or not.
View 2 Replies