Security

Re: Troubleshooting the login control?

yrleu — Mon, 10 Nov 2008 13:39:41 GMT

This great article, "Always set the "applicationName" property when configuring ASP.NET 2.0 Membership and other Providers," gives the answer!

Re: Troubleshooting the login control?

yrleu — Mon, 10 Nov 2008 11:47:49 GMT

John Sinclair:

I've just had a battle with the login control, and I eventualy found the problem was the application path, similar to cdmlb's post above.

I played around with the Membership class in the immediate window while my login page was on a breakpoint, and realised that Membership.GetAllUsers().Count returned 0. I created a user from this class, and then dug into the DB a bit (standard SqlMembershipProvider provider) and discovered that the user I created from the immediate window had a different application to the users I had set up from the "ASP.Net configuration" web page. I changed the web project's properties to give a virtual path (it was /) and then the users I had entered from config matched up with the users available to the app. No idea why the config site thought it was using a different application, but it works now.

This info helps me a lot. When I attach the Visual Studio 2008 debugger to IIS (w3wp.exe) and break the execution of my Web application, I can see the value of Membership.ApplicationName is "/<ProjectName>" rather than "/". If I set Membership.ApplicationName to "/" within the Watch window, ASP.NET authentication works fine in IIS afterwards.

Therefore, I think the safest way to avoid this authenticaiton problem with Login Control and IIS is to explicitly assign "/" to Membership.ApplicationName in the code.

Re: Troubleshooting the login control?

John Sinclair — Tue, 10 Oct 2006 23:11:33 GMT

I've just had a battle with the login control, and I eventualy found the problem was the application path, similar to cdmlb's post above.

I played around with the Membership class in the immediate window while my login page was on a breakpoint, and realised that Membership.GetAllUsers().Count returned 0. I created a user from this class, and then dug into the DB a bit (standard SqlMembershipProvider provider) and discovered that the user I created from the immediate window had a different application to the users I had set up from the "ASP.Net configuration" web page. I changed the web project's properties to give a virtual path (it was /) and then the users I had entered from config matched up with the users available to the app. No idea why the config site thought it was using a different application, but it works now.

Re: Troubleshooting the login control?

cdmlb — Fri, 15 Sep 2006 00:12:03 GMT

My friend had the same problem, my above fix did not work for him, when I helped him out, I was also able to fix my problem with the application name.

Now I can call the iis application name the exact same as the projects folder name, so just ignore the fact of / since it actualy will contact the name of you application to the end of the / to make it /whatever, good thing would be anoying to do it yourself.

I remembered that before I formatted my pc in my control panel, user accounts section I had my account, and tow other ones called SQL, and ASP.NET, I still have does two accounts on my pc now after I formatted it, but for some rason they don't show up in the control panel user accounts, but found under local users and groups uder the mmc.

So when I went to my wwwroot, and check out the security settings, I noticed no asp.net user was there at all, and no network service user was there at all that the sql server uses to login under the sql user to talk to asp.net, and IIS since on my machin the sql server is lauched as a network service.

So I added the asp.net, and network service usernames and gave them the read, write, execute, and modify permissions, found when you right click your wwwroot folder, and then properties, and then the security tab. Afther that I named my application in IIS the same name as my folder, I did nothing else, just incase I restarted my IIS, and SQL server, tested the login control again, mine worked, his worked, no foulling around to make changes yourself with the application names, everything is now auto generated when me, or him make new asp.net applictions on either pcs.

So I'm guessing I was wrong about the application name part, but even do it looks like you aspnet site is connecting to the aspnetdb to check the usernames/pwds, it does connect to that db, but since it has no permissions to read, it will just come up and say failed to login please try again on your login control.

The problem was not with the following for me and my friend:

SQL settings, and server where all good;
IIS settings, and server where all good;
My application was all good;
There is no problem with the login control at all;
Application names where all good, and auto generated;
No problems with config files, or connection strings
We did not have to do realy anthing at all, everything was auto made when we installed all, and made asp.net applicaitions;

BUT OUR PROBLEM WAS

For some reason the software did not auto generate the accounts, and file permissions for IIS to talk to SQL server in the sence to what the aspnetdb is used, since you have permission to connect to the server and a db, but does not mean you have permission to read or write to that db, hence can't compared user/pwd with againts the db values for that user, and since could not compare the values, says must have wrong user or pwd for the login control.

It was a file permission problem for NETWORK SERVICE user that SQL uses to make an instance of the sql server, and the asp.net user that talks to that NETWORK SERVICE user using IIS.

We fixed it by adding users asp.net, and NETWORK SERVICE to our wwwroot folder, and gave them read/write/execute/modify permissions, it worked.

I hope this one is write this time, and works for you.

You never know maybe the other things I said before where right, I dought that...lol.

Re: Troubleshooting the login control?

cdmlb — Thu, 14 Sep 2006 23:42:50 GMT

I figured out my problem, I hope it will not continue.

Normaly when you make a new ASP.NET application using vs2k5 it will name the application in IIS as the name you created with, and then when the aspnetdb is auto generated in your project, it will take the name of you application, and then put it in the aspnet_Application table.

This time after I formatted my pc, I noticed that when I made a new probject, in IIS when you go find your project, right click it, then properties, and then the default Directory Tab, the application name was just blank no name at all. When I looked in the aspnet_Application table in my aspnetdb I found that the application name was just a / that's it nothing else just a / just like I found in the machine.config, and global web.config files that are used by default by asp.net, and created by asp.net found in some IIS settings, and also found in C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG, you can either use IIS to edit it, or just manualy edit it with a text editor.

So what I did since the name was / in my aspnet_Application table, I went to IIS, then found my application, and went to it's properties, in the Applcation name section I just put in / like the aspnet_Application table found in aspnetdb in my project was called.

Voila that worked for me, my login control authenticated, and redirected my to my members page, and I almost [:'(] tears of joy!!! No more problem with Failed to login please try again later error that the login control was giving me after I formatted my pc.

Now each time I make a new project, I have to double check to make sure the application name in IIS, is the same as in my aspnet_Application table find in the aspnetdb are the exact same, I could of named them both the same other then just a /, but I left it like that since it's the root of my application right?

It sucks that it will not do like before I formatted my pc, just to generate the names, and no problems, but life not like that all the time, maybe next time when I format for some reason it will do it by itself I hope, but learning from this problem when it comes time to host the applicaiton on another pc I will know what to check for next time, lol I hope.

Maybe this worked for me, and I hope it works for you too.

If you want to maybe see screen shots of what I mean, just email me at cdmlb@hotmail.com, since this forum does not allow you to just upload a pic directyle in the the text, but only URL type imgaes that are online, or can you?

Re: Troubleshooting the login control?

cdmlb — Thu, 14 Sep 2006 03:07:00 GMT

I had everything working properly, and the login control was letting me in real good no problems at first.

Then I formated pc, and now the login control tells my that it could not login and try again later.

My SQL server is on, I can connect to any db using VS 2005, and the sql manager express, and I can program a page and get data out of a db. Also the ASP.NET Configuration page for the applicaiton works great too, and has no problem with the ASPNETDB.MDF.

Since lets say I have a db called learn.mdf, my prog can connect to it since the connection string is in the web.config file, and when I go in IIS and find that application that I'm working on, go to properties of that application, asp.net tab, edit configuration button, I see a connection string for the ASPNETDB.MDF, and I see my connection string for learn.mdf.

Note the mdf db files, are in my App_Data folder that worked all before I formatted my pc.

I have no clue what IIS had for a connection string before for the ASPNETDB.MDF db.

This is the connection string auto generated in IIS for the ASPNETDB.MDF which is found under global, and local configuration.

Data Source=.\SQLEXPRESS;AttachDBFilename=|DataDirectory|ASPNETDB.MDF;Integrated Security=SSPI;User Instance=true

I have trying to use this type of connection string like VS 2005 allows me to connect with but does not work either.

Data Source=.\SQLEXPRESS;AttachDBFilename=|DataDirectory|ASPNETDB.MDF;Integrated Security=true;User Instance=true

Which is the usel type of conneciton string that allows to connect directly to it.

I don't think the Login control has a problem, no problem with the SQL Epress server, or VS 2005, but the IIS settings to allow you application to connect to the ASPNETDB.MDF itself, for some reason it does not connect to check your user/pwd, and then turns around, and the login control says could not login, try again later.

WinXP Pro SP2;
IIS 5.1;
MS-SQL Express Advance with SP1;
VS 2005 Pro;

I checked my login page script, and code, to make sure I had not like made an event for the login control like mentioned above, and it all worked before I formatted my computer, now since I formatted my computer, IIS and ASPNET.MDF do not like authenticate properly.

Also note my sql express server has mixed mode authentication (windows/sql quthentication) on.

Any thing to fix this would help.

Yes my ASPNETDB.MDF is on, the form authentication user accounts to login my site are active, and I am using the correct pwd for the account...lol

Re: Troubleshooting the login control? (work around)

tubugurl — Fri, 01 Sep 2006 19:41:55 GMT

i don't know if this help anyone else, but i was having a hell of a time with the login control also. i had it on a page with the password recovery control using the ActiveDirectoryMembershipProvider. it was working for a few days, then all of the sudden nobody could login. or they could login once, but not again. answering the security question was working fine, so i knew i had a connection to Active Directory.

well, after a lot of research it turned out that the "enablePasswordReset=true" in the web.config was the culprit. when i started configuring the CreateUserWizard control for registering new user accounts i had to map the password question, answer, failedpasswordanswercount, etc. to Active Directory attributes and that's when i set "enablePasswordReset" equal true. around that time is when the login control started acting up. sometimes you could login, sometimes you couldn't, some accounts worked and some didn't. the only thing that seems to fix it is if i set "enablePasswordReset" to "false". so we're removing the whole password recovery functionality and writing our own.

maybe that will save someone else hours of fruitless research.

Re: Troubleshooting the login control? (work around)

Nyetrogen — Wed, 23 Aug 2006 16:23:57 GMT

Can you explain more about this solution. I've tried for the past 5 days to try and get my app to work on my remote server. From everything that I've read, my configuration is setup properly but I keep getting the generic Login attempt failed message. Maybe provide sample LoggingIn validation that you used. I would really appreciate it. I've looked at this so much that I think I'm just missing something simple. Any help would be much appreciated. I can provide URL or whatever if that would help.

Re: Troubleshooting the login control? (work around)

danko — Wed, 16 Aug 2006 11:36:17 GMT

Yeah, that's the solution!

(I've been having problems with it also antil I've read mandert's post.)

If you wire-up the Authenticate event to your Login control:

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e) {... }

...the default Authenticate event implemented by the Login control won't fire, so it's authentication check won't work!

Just remove the Authenticate event from your code and do all the validation/formatting stuff on LoggingIn event, which fires before the authentication.

Danko

Re: Troubleshooting the login control? (work around)

mandert — Thu, 10 Aug 2006 12:54:43 GMT

Danny,

did you accidentally clicked twice on the login control in design view? This causes an event to be created like the following:

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
}

Delete the event in the Properties window and you should be fine.

Re: Troubleshooting the login control? (work around)

WarrenLong — Mon, 07 Aug 2006 15:06:57 GMT

I also have a similar issue. The login control works fine with VWD. But it will not login when deployed in IIS. I know it can access the database as it returns the correct security question when I cick Forgot Password. I am using Windows XP in a network(part of a domain), IIS 5.1.

Out of curiosity I deployed it (exact copy) on someone else's Windows 2003 machine and it is working there. What could be the problem in the XP machine then? There must be some bug somewhere.......it can access the database but won't authenticate the user.

Re: Troubleshooting the login control? (work around)

Codescribler — Mon, 07 Aug 2006 05:59:42 GMT

AHHHHHHH!

At least it sounds like I am not alone in this. I had a login control that worked perfectly and then all of a sudden decided to stop. I cant understand what I did or if I did anything to break it. I did some experiments and found that if I created my own two texboxes with a login button and called membership.validateuser it worked - for a time. Because I was testing the admin section I set the login page to login automaticaly. This is important because I know therefore that the User name and Password are correct. I decided it was time to tidy the textboxes up tried to login and it failed! I re-instated the automatic login and it failed but the credentials are definately correct!

What on earth is going on. Does anyone have a solid work arround or even a solution!

Danny (going grey rapidly!)

Re: Troubleshooting the login control? (work around)

danhixon — Sat, 01 Jul 2006 19:29:01 GMT

I implemented a work around that seems to work so far:

    Protected Sub Login1_Authenticate(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.AuthenticateEventArgs) Handles Login1.Authenticate
        'i don't know why but e.Authenticated is always false so I 
        'have implemented this work around:
        If Membership.ValidateUser(Login1.UserName, Login1.Password) Then
            FormsAuthentication.RedirectFromLoginPage(Login1.UserName, False)
        End If

    End Sub

I hope to find out why the login control isn't working for us but until then I'll just use this.

Re: Troubleshooting the login control?

danhixon — Sat, 01 Jul 2006 19:21:49 GMT

I am experience this problem too! VERY FRUSTRATING!

    Protected Sub Login1_Authenticate(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.AuthenticateEventArgs) Handles Login1.Authenticate
        If Membership.ValidateUser(Login1.UserName, Login1.Password) Then
            Label1.Text = "user IS valid!"
        End If
        If e.Authenticated Then
            Response.Redirect("admin/managecategories.aspx")

        End If
    End Sub

The login control says "Your login attempt was not successful. Please try again." and my Label1.Text says "user IS valid!"

False is returned when I try calling FormsAuthentication.Authenticate(Login1.UserName, Login1.Password) ...

Any help on this would be GREATLY appreciated!

-Dan

Re: Troubleshooting the login control?

stephajn.saunter — Wed, 03 May 2006 17:49:51 GMT

Sorry...forgot to point out that the results of my explicit call to my provider came back as True.