ASP.NET Login Control rejects users who exist

Question

Hi,

I'm having some trouble with the ASP.NET 2.0 Login Control.

• I've setup a database with the aspI.net regsql tool.
• I've checked the application name. It is set to "/".

The application can access the SQL Server. In fact, when I go to retrieve the password, it will even send me the password. Despite this, the login control continues to reject logins.

I added this to the web.config:

<membership defaultProvider="AspNetSqlProvider">
  <providers>
    <clear/>
    <add name="AspNetSqlProvider" connectionStringName="LocalSqlServer" applicationName="/" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
  </providers>

And I added the following to my connection strings:

 <remove name="LocalSqlServer" />
    <add name="LocalSqlServer" connectionString="Data Source=IDC-4\EXCALIBUR;Initial Catalog=allied_nr;Integrated Security=True;Asynchronous Processing=True"/>

(Note the "remove name" is to get rid of the default connection string in the App_Data directory.)

Why won't the login control authenticate users?

Answer 1

It sounds like you are storing your passwords in plain text, but the default password storage format of SqlMembershipProvider is "Hashed." You would never be able to retrieve a user's password from the database if it is stored as hashed.

Answer 2

A great set of articles about the Memebership Provider was written on the 4 Guys From Rolla site. Check it out, as I think it will help!

http://www.4guysfromrolla.com/articles/120705-1.aspx

From Part 4 of the series:

"In the Membership system, there are multiple scenarios by which a user's credentials can be invalid:

• The username supplied might not exist in the membership directory
• The username may exist, but the supplied password might be incorrect
• The username and password may be correct, but:
  • The user may not yet be approved
  • The user may be locked out; this can happen if the user attempts to login with an invalid password for a specified number of tries (five, by default)

Unfortunately, the ValidateUser(userName, password) method just returns False if the credentials are invalid, and does not include information as to why, exactly, the credentials are invalid"