Site when published doesn't allow login

Question

Ok, I've published a site using forms authentication. It works on my staging server. it does not work on the production server. The only thing different is sql is on a different machine for production.

The site does work, showing data from sql, but when I use the login link on the site, it brings up the login form, I login, it redirects to the main page, where it still says "login" instead of "logout".

I've tried aspnet_regsql to uninstall / install forms authentication for the server. I've restarted the www service. Here's a portion of my web.config

    <membership>
  <providers>
    <remove name="AspNetSqlMembershipProvider"/>
    <add name="AspNetSqlMembershipProvider" 
         type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 
         connectionStringName="LocalSqlServer" 
         enablePasswordRetrieval="true" 
         enablePasswordReset="true" 
         requiresQuestionAndAnswer="true" 
         applicationName="/TriState" 
         requiresUniqueEmail="true" 
         minRequiredPasswordLength="4" 
         minRequiredNonalphanumericCharacters="0" 
         passwordFormat="Clear" 
         maxInvalidPasswordAttempts="5" 
         passwordAttemptWindow="10" 
         passwordStrengthRegularExpression="" />
  </providers>
</membership>

Answer 1

Is your login page by any chance named login.aspx? I had a problem with this in the past, since it creates the same class name as the login control and a conflict occurs. In my case I got the "Yellow Screen of Death" i.e. the stack trace since it threw an exception, but then I renamed the page and it was ok.

Answer 2

You should explicitly set your application name. Check your database for the application table. If you have two entries there, then the system is using a different application name for your dev box and the server. If you explicitly set the name, there will be no conflict.

Answer 3

How are you creating the roles and users in the production environment? Do you use a back up of the development database? In that case pay attention to the aspnet_Applications table. Make sure that the name of the application in the development and the production environment are the same. If not, try to edit the table by hand.

Answer 4

Is it possible that the application is serving the wrong cookies? On our testing servers the hostname is different than the production servers and the cookies end up in a different domain. The testing and production servers need to know the domains they are serving to send the right cookies back (this is done by storing the names and domains in the database).

Answer 5

Have you tried backing up the database from the staging server and restoring it on the production server? (here are instructions to do that.)

This will confirm that the database you are using isn't the issue.

Answer 6

Where does LocalSqlServer point? Is that the correct connection string to use in this case?

Answer 7

Ok have you tried doing a manual login to bypass the membership check? This will rule out forms authentication itself being the problem.

        if (Request.QueryString["ReturnUrl"] != null)
        {
            FormsAuthentication.RedirectFromLoginPage("someuserid", false);
        }
        else
        {
            FormsAuthentication.SetAuthCookie("someuserid", false);
            Response.Redirect("~/SomePage.aspx");
        }

Check your users are set up with whatever roles you have allowed in authorization.

    <authorization>
  <deny users="?"/>
  <allow roles="Public"/>
  <allow roles="AdminUser"/>
 </authorization>

Check if there any web.configs further down (inheriting from higher level folder web.configs) which allow or deny any user's roles by specifying authorization.

Answer 8

Make sure your application name is the same in the production database:

applicationName="/TriState"