How to validate a "Disabled" user account

Question

If a user provides me their username and password, I am able to log them in using

Sitecore.Security.Authentication.AuthenticationManager.Login(username, password)

Or validate their account with

System.Web.Security.Membership.ValidateUser(userName, password)

However both of these fail if the user provides the correct password but is currently disabled (IsApproved = false).

Is there a way to check a disabled user's password? If a disabled user is attempting to log in I would like to be able to provide a specific error message to tell them that their password is correct but their account is disabled.

Answer 1

You could override the SqlMembershipProvider and configure ASP.NET (and Sitecore) to use your version, but the extensibility points are so limited that I feel it's not really worth it. Also, the goal of overriding the membership provider is generally to change one of the public methods, in this case ValidateUser. But I think we should leave that method as is, and in any case Sitecore double-checks if the user is enabled even if that method returns true.

The only decent quick solution I can think of involves temporarily enabling the user and checking the password again. You should only do this after the "normal" check. Note that as a side effect, this will update the "last login date" for that user.

public static bool CheckUnapprovedUserPassword(string username, string password)
{
    var isValid = false;
    var provider = System.Web.Security.Membership.Provider;
    var user = provider.GetUser(username, false);
    if (user?.IsApproved == false)
    {
        user.IsApproved = true;
        provider.UpdateUser(user);
        isValid = provider.ValidateUser(username, password);
        user.IsApproved = false;
        provider.UpdateUser(user);
    }
    return isValid;
}

Answer 2

If login fails, you could try to fetch the user and check the Membership user object properties for the status. You can detect the IsApproved flag this way, but not verify the password.

But you actually do not want to give that kind of information. Just tell the user that his account is blocked, don't tell him that the password was correct. As he can't login anyway you're not helping him with it, but you might give away security details.