2

If a user provides me their username and password, I am able to log them in using

Sitecore.Security.Authentication.AuthenticationManager.Login(username, password)

Or validate their account with

System.Web.Security.Membership.ValidateUser(userName, password)

However both of these fail if the user provides the correct password but is currently disabled (IsApproved = false).

Is there a way to check a disabled user's password? If a disabled user is attempting to log in I would like to be able to provide a specific error message to tell them that their password is correct but their account is disabled.

1

You could override the SqlMembershipProvider and configure ASP.NET (and Sitecore) to use your version, but the extensibility points are so limited that I feel it's not really worth it. Also, the goal of overriding the membership provider is generally to change one of the public methods, in this case ValidateUser. But I think we should leave that method as is, and in any case Sitecore double-checks if the user is enabled even if that method returns true.

The only decent quick solution I can think of involves temporarily enabling the user and checking the password again. You should only do this after the "normal" check. Note that as a side effect, this will update the "last login date" for that user.

public static bool CheckUnapprovedUserPassword(string username, string password)
{
    var isValid = false;
    var provider = System.Web.Security.Membership.Provider;
    var user = provider.GetUser(username, false);
    if (user?.IsApproved == false)
    {
        user.IsApproved = true;
        provider.UpdateUser(user);
        isValid = provider.ValidateUser(username, password);
        user.IsApproved = false;
        provider.UpdateUser(user);
    }
    return isValid;
}
  • 1
    Thanks for this - I came to a similar conclusion that temporarily enabling the user was the best way to get this working quickly - but it felt wrong. Instead, we ended up creating a new flag in the user's profile which we check against, instead of using User.IsApproved. – NJH Jun 30 '17 at 4:50
2

If login fails, you could try to fetch the user and check the Membership user object properties for the status. You can detect the IsApproved flag this way, but not verify the password.

But you actually do not want to give that kind of information. Just tell the user that his account is blocked, don't tell him that the password was correct. As he can't login anyway you're not helping him with it, but you might give away security details.

  • Yes, I do want to give that information. If the user/pass is incorrect, want to tell them so. If they would have otherwise succeeded but didn't because their account has [IsApproved = false], I want to provide them information on how they can rectify the problem. It is a part of our signup process. – NJH May 17 '17 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.