ASP.NET 2.0 Membership: ValidateUser not locking out the user?

Question

Hi

I am using the default SQLMembershipProvider in my ASP.NET 2.0 website, and expect the Membership.ValidateUser to lock-out the user after entering a number of wrong passwords (5, in my case) but ValidateUser doesn't seem to be caring about keeping count of bad password attempts and locking out the user.

What's wrong?

The Membership configuration in my web.config:

<membership defaultProvider="SqlMembershipProvider" >
   <providers>
     <clear />
      <add connectionStringName="ConnectionStringName" enablePasswordRetrieval="true"
         enablePasswordReset="true" requiresQuestionAndAnswer="false"
         requiresUniqueEmail="true" passwordFormat="Encrypted" maxInvalidPasswordAttempts="5"
         minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0"
         passwordAttemptWindow="10" passwordStrengthRegularExpression=""
         applicationName="MyApp" name="SqlMembershipProvider"
         type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
   </providers>
</membership>

Answer 1

what is the PasswordAttemptWindow and MaxInvalidPasswordAttempts set to? and is these configuration settings set in the correct web.config? (the one actual in use by the test environment)

Answer 2

Here's the config for my membership usage which is working as required if it's of any use:

<membership defaultProvider="AspNetSqlMembershipProvider" userIsOnlineTimeWindow="30">
  <providers>
    <remove name="AspNetSqlMembershipProvider" />
    <!-- 
      Membership defaults mainly below this point:
      connString, reqQ&A - modified - all others currently default.
    -->
    <add connectionStringName="CustomSqlServerProvider"
          name="AspNetSqlMembershipProvider"
          type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
          enablePasswordRetrieval="false"
         enablePasswordReset="true"
         requiresQuestionAndAnswer="false"
         requiresUniqueEmail="false"
         passwordFormat="Hashed"
         maxInvalidPasswordAttempts="5"
         minRequiredPasswordLength="7"
         minRequiredNonalphanumericCharacters="1"
         passwordAttemptWindow="10"
         passwordStrengthRegularExpression=""
         applicationName="/" />
  </providers>
</membership>

Also, have you tried using the .Login() method for the authentication process instead? That's what i'm using rather than validateuser().

Answer 3

Please set the user.[IsApproved] to true