Security :: Login Form Rejecting Valid Login With Forms Based Security And Membership Service
Jan 21, 2010
I've set up a system with forms based authentication and using the asp:Login control. When I put in an invalid password I get the approriate invalid password message. However when I put in a valid password, it does nothing...just returns to the login page again. I'm triple checked the login info. There is no error message, and the invalid attempts counter doesn't increment. When I put a break point in the Login_LoggedIn event of the Login form, it hits it, but User.Identity.IsAuthenticated is false. I'm not 100% sure it should be true at this point, as I'm pretty new to .NET but it seems kind of odd.
My user database is stored in a sqlserver 2005 db that already existed. I've added a new connection for it.In the authorization I have
<authorization>deny
users="?"/><authorization>
View 2 Replies
Similar Messages:
Jan 23, 2010
I am writing two ASP.NET apps. One is a web service that provides xml data and the other is a web client that will use the service to display and manipulate data. I would like for the web service to do the membership authentication and authorization. Is there any way to simply point the login controls in my client application to the web service instead of to a database. I assume I would have to provide the necesarry methods in my web service interface, which would then use the membership provider database I created and pass the results back through to the client.
Is this possible? I have seen many articles on security provisioin from a web service but none has really been what I am looking for. I was hoping that, since my service and my client are both written in ASP.NET, there might be some built functionality that would benefit me.
View 8 Replies
Jul 5, 2010
We have created a windows application which is distributed amongst our clients. The application uses SQL Server 2008 as the back end and each client uses their own database on their own server. The databases are all exactly the same but each clients data is specific only to them.
We would like to offer our clients the ability to log-in to our website which would then login to their own database so that when they are out in the field they can perform similar tasks to what they can do with the windows app.Each of the clients databases has a user table containing their login details, permissions etc.
Our server is running on IIS and has SQL Server 2008 installed but it only contains our data and nothing of the clients.How should we go about this?
What I mean is do we need to make each client have an additional login to our main server which would then hold each clients individual connection strings etc which would then be used to connect to there specific database and then they would need to login again?? Seems like a nightmare for the user.
View 13 Replies
Mar 24, 2011
I am doing a simple secured site using the login control. I would like users to be redirected to their dashboard page once they log in, but after that if they choose to browse I do NOT want them redirected based on their login status. I am using the generic template provided in VWD with the basic login setup in the template including the tabbed ASP menu control - nothing fancy, nothing custom. This is intended to be something very simple and quick. Here is the code I am using for the page load...
[Code]....
So if I do this code WITHOUT the "IsPostBack", logged in users are always redirected to their dashboard and cannot see the hompage. However with that IsPostBack test, the redirect after initial login doesn't work.
I know this is extremely basic and simple, but I am restarting with this stuff after a year away, and I need a nudge.
View 4 Replies
Apr 12, 2010
A Login.aspx has been created to enforce security on several forms of a web site.How can it be best called by each form at page load and return to that form after succesful login? How could that requirement be declared in web.config?
View 3 Replies
Mar 16, 2010
I'm new to ASP.NET. I have a custom login form on my web with login and password fields and OK button. I use my own MembershipProvider to authenticate user. The login control form is in the upper right corner of page and if user is successfully authenticated, I need to display his name and html link "Logout", instead of it.
How can I get programatically user status and use it in condition for displaying login form/login status?
View 3 Replies
Jun 7, 2010
I am using membership api in my project.I have customized all the controls.Now i want that user can login on only one machine from same username and password at the same time.If user is trying to login on any machine at that time if he is logged in from another machine.They should get message.They should not be able to log in using same username and password on same time on different machine.
View 2 Replies
Apr 15, 2010
How this line if (usrInfo! = null) add another variable that will be used to login.
This line (usrInfo! = null) works, but I have a database table "confirm". If I change in the Admin to "true", the user successfully logged on. If the base table "confirm" set to "false", the user will not be logged.
The following code works if (null! = & usrInfo & usrInfo. IsApproved), but instead of ' IsApproved ', I want to use table "confirm".
View 9 Replies
Mar 26, 2010
which i added one sitemap in whcih i added all the pages n i want to retrive that sitemap in masterpage based on login in whcih suppose admin hs login then display only admin pages with sitemap n if normal user hs login then it ll display only normal user pages with sitemap. here i didn't use login control but i create login page manually.
View 1 Replies
Nov 8, 2010
I have a site in which I'm intending to use multiple membership providers. I'm using my own custom membership provider to provide access to several data stores depending on the section in which the user's information resides.
The actual login functions correctly using the built-in ASP.NET Login component in which I've manually specified the membership provider it should validate against. When I run a trace on it's actions, I can see that it attempts the 'validateuser' against the correct data store and continues to redirect the user to their applicable section.
The problem is that once they are logged in and the site (or I) call 'GetUser' to get the users information or permissions, the membership provider reverts to the site's default provider.
In my custom membership provider I'm only overriding the methods for GetUser and Validate user which is working perfectly fine for a singular membership provider, but not when using a different provider.
How can I ensure that the correct membership provider is retained with the user's membership details? Is there a method that I need to override/append in order to achieve what I'm looking for?
View 1 Replies
Sep 30, 2010
I have a web app that uses the Membership Provider to authenticate users.Everything worked fine until today... when I tryed to log in it failed. I looked in the database if something went wrong there and the user is deleted but everything looks fine there.I tryed to recover the password using the user name and i got an error that the user is not recognized.I tyed to recover the password (even though I am sure what the password is) but still no luck... (I get an error that hased passwords can not be decrypted)I triyed it in local host and guess what ... still the same... this is the provider section in my web config
[Code]....
View 6 Replies
Jul 25, 2010
we use forms authentication for a community website with about 200k users with a simple login like this:
Private Sub btnLogIn_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogIn.Click
If CheckPassword(txtEmail.Text, txtPassword.Text)
FormsAuthentication.RedirectFromLoginPage(txtEmail.Text, chkRememberMe.Checked)
End If
End Sub
which checkPassword reads from a MS SQL users table. it has worked without major problems for 3 years but we need to store the login date of users in a table, both when they login explicitly and when they had selected "remember me" and come back (we store login once per session)
since we have a complicated profile system and database it will be practically impossible to switch to membership API. last time I was told we could user an auditing system to do that but I have no idea how to do that.
View 2 Replies
Oct 28, 2010
I am currently working in an ASP.Net application where i need to implement ASP.Net Membership and Roles. I have used Login controls in my pages. Also I am using a menu in the master page, which is getting data bindings from database. For data bindings I am using XMLDatasource and a transform file (.xslt file). I need to bind the data to the Menu based on the user roles.
My issue is that the generated Menu is not behaving consistently. Sometimes it will show the correct menu for a particular role and some times it will show previously loaded data.Providing my code here:
masterpage.master.cs
private void LoadMenuItems() {
System.Security.Principal.IPrincipal User;
User = System.Web.HttpContext.Current.User;[code]....
View 7 Replies
Apr 12, 2010
After reading a book I brought on ASP.net I fould the login controls to be very nice.I have set it up in my application so that customers can login using the standaard login controls and things were going smooth.But in my schema for my application I also have a table for customers (firstName, LastName, DOB, etc).And of course the customersID is used as a foreign key to tables such as Orders, Addresses (Home, Work, Postal).
The thing is how to i associate an asp.net login to a customer name in my table so that the CustomerID can be used through the application by knowing who is logged in.
View 7 Replies
Jan 6, 2011
I have a problem with a login module in my website.
I use a membership provider custom on my website.
My login page is the default page. When I go in [URL](the root) I see my login page.
When I try to connect with my user and password, I'm not redirect to my url destination and reload the login page.
BUT if I go in the url : [URL] (my login page), I'm correctly redirect to my secure page.
Are you a idea of my problem ?
I use Visual Studio 2010 with framework 4.0, and IIS 7.5
my web.config :
[Code]....
View 5 Replies
Oct 16, 2010
I have an Employee class in my App_Code folder. On my login page I am trying to create an Employee using the asp.net username as a parameter in my Employee constructor.
I have tried creating the employee in the page load event when it is a post back. I have tried doing it in the Login1_LoggedIn event. For some reason I cannot pull the username in either one of these places, but if I redirect after logging in and do the same thing on another page, it works.
How can I get it done on the login page?
[Code]....
View 3 Replies
Jun 23, 2010
I have a business site that I want to use to show clients their projects I am working on. I don't want these projects to be visible to anyone but the clients, so I give them a user ID and password. I want to use asp.net membership to manage the login IDs and passwords, but I want to use jquery to submit the login form (it's lighter and leaner than the login control). Here is what I have: Page with an html form for login .js file with the jquery calls & code in it httpHandler to process the information from the formI have the user to entering their ID and password, I am using jquery.forms.js to process the form, which calls the httpHandler and passes the form values to the handler. I have the handler check to see if the user ID and password are correct, if not, it passes back a message to be displayed to the user. If the user is valid, then I have it passing back the role of the user, which also happens to be the name of the folder the client needs to view. I have the page redirecting via javascript to the client's folder once they are authenticated. I have the location of the client folder setup in my web.config.
The problem I'm having is the page just redirects back to the login page, with the return url included (?ReturnUrl=%2fCTS%2f2010+Design%2fLasmer%2findex.aspx). I want it to go to the client folder (Lasmer in this case) once the user has been authenticated. Shouldn't it send me to the folder's default page once it knows the user is authenticated? Do I have a problem in the way my web.config is wired up, and do I need anything in the client folder's web.config?Here is the code for the web.config:
[Code]....
Here is the code for the handler:
[Code]....
Here is the code for the .js file:
[Code]....
Here is the code for the page:
[Code]....
View 8 Replies
Oct 11, 2010
I am working on implementing a custom membership provider that works against an existing schema in my database and have a few thoughts/question.The login control will automatically call the ValidateUser method of the membership provider, so no matter how I implement the provider the only thing the login control cares about the bool value returned by this method. What I am confused about is there could be numerous reasons why a login attempt failed; user is locked out, too many tries in a period of time, etc. There is no way that I see to convey that to the control so it could display the proper message. Other properties of the membership provider such as PasswordStrengthRegularExpression have absolutely no effect on the login control as well (out of the box), I would have hoped that it would automatically somehow translate into regular expression validators, but that doesn't seem to be the case. So it seems that I need to initialize the login control properties with these settings out of the provider configuration if I want them to take on the control itself.
If the only thing that the Login control does out of the box (without manually handling events and doing the initialization as described above) is call the ValidateUser method on the membership provider, I see no way to convey back to the Login control why the validation failed or even doing things like throttling the validation requests based on a certain time window. Ultimately my question is why would I even use the membership provider then in conjunction with the login control? It seems like it was only designed for a Yes/No type response, which is very restrictive. If I want to build in logic with different messages back to the user I need to handle the login control events and call my own authentication classes that will handle all of my business requirements as well as return a custom error message back to the Login control to display to the user so they know why their attempt is invalid.
Unless I am wrong in my assumptions, it seems that the interface between the Login control as the membership API is too restrictive to be useful. Perhaps the API works better for other auth controls like ChangePassword better but for the actual Login control I don't see the point.
View 1 Replies
Mar 22, 2010
How can I transfer the login session of a user into a Cookie that would expire in 12 hours? I have a problem with Internet Explorer where whenever the user closes the window it would log them out automatically (which is by default what it is supposed to do). I am using VB.NET
View 4 Replies
Feb 1, 2010
I am using manual Login using asp membership provider. which is working fine
Here is the code
[Code]....
1. Remember me check box
2. Exception handling incase account is locked or was the id and passwod incorrect how do i find that out.
View 4 Replies
Apr 26, 2010
WARNING - Absolute beginner here with VS. I'm expecting a steep learning curve, but I'm up to it! I'm trying to create a website with membership/login. Followed the above walkthrough MANY time, and been very careful with the username and password entered, but I keep getting the message that the loging failed. The asp application name is "Membership" This is the whole thing, automatically created following the walkthrough, apart from adding 2 members - yes, did go to the memberpages folder at the set rules page.
Solution Explorer:
Solution 'membership' (1 project)
- //localhost/membership/
- App_Data
- ASPNETDB.MDF
aspnetdb_lpg.LDF
- MemberPages
web.config
- Default.aspx
Default.aspx.vb
- Login.aspx
Login.aspx.vb
webconfig
aspnet_Membership: (2 members)
PasswordFormat = 1
The ApplicationId for the 2 members is different - should it be?..........
View 2 Replies
Jan 26, 2010
i am using asp.net membership. when users arrive at my sight they can enter user name and password.
I then want to redirect them to a page called "MyAccountPage.aspx" which is unique to them. could someone post the c sharp code that I can use to capture the Unique Id of the user is it best to then pass this as a parameter to a control on the aspx page that displays data for that user. am I correct in thinking that I need a UserId column in my data table as well.
View 1 Replies
Jun 23, 2010
I need to secure access to all pages in a .NET webapp - EXCEPT requests from:
local network (the network IIS is running on) IPs listed/netmasks listed in a database all other requesets should be redirected to a login form I was thinking in the direction of a HttpModule - but never wrote one.
View 4 Replies
Dec 9, 2010
i have created loing form and create user form. then how to apply login rights..? i have 2 types of user. admin and normal user admin can move and use all pages while normal user can acces limited pages.
View 4 Replies
Mar 18, 2010
I just like to know how can i create my own authentication(calling the ASP .net membership, role) page with the same function as the LOGIN Control. Your wondering, why not use the Login control instead. I have my own design and i don't know how to pattern my design to the built in Login Control. I tried editing the login template, but it's pretty hard to pattern it to my design.
This is my design
Basically what would like to know how the Login Control calls for the authentication, and when authenticated, it will pass the user(full name) to my LoginView Control without any coding. Or is it possible that I remove default login button in the LOGIN Control then create my own button and trigger the authentication or validation? But if you have other suggestion that can follow my design and call the authentication, i would be happy to know.
View 3 Replies
