5

In Sitecore 8.1 when a user whose account has been locked tries to login it says

Your login attempt was not successful. Please try again.

instead of something like

Your account has been locked out . Please contact admin

This is the OOTB functionality in 8.1. I want to customize the error message as specified above. I know for login Sitecore uses System.Web.Security.SqlMembershipProvider.
Please provide suggestions to customize the error messages for such scenario.

1
  • FYI, you might want reconsider if you are subject to security audits. I had to make a change and do away with this due to the fact that when a legitimate username logged in incorrectly a certain number of times, the message changed from "not successful" to "locked out", whereas a non-existent username would just get "not successful" forever. This provides information to bad guys about which usernames are valid and which aren't.
    – Kevin
    Nov 17, 2017 at 18:35

1 Answer 1

12

It is possible to implement in two ways:

1) Switch to the core database and see the following item:

/sitecore/system/Dictionary/Y/Your login attempt was not successful  Please try again

You can put updated phrase to the Phrase field. But as you said in comments, in this case message will be changed for each events.

2) The second way is to customize a handler of Login form.

Add the following class to your solution:

using System.Web.Security;
using Sitecore.Web;

namespace Your_Namespace
{
    /// <summary>
    /// </summary>
    public class CustomLogin : Sitecore.sitecore.login.Default
    {

        protected override bool Login()
        {
            var fullUserName = WebUtil.HandleFullUserName(this.UserName.Text);
            if (!string.IsNullOrWhiteSpace(fullUserName))
            {
                var user = Membership.GetUser(fullUserName, false);
                if (user != null)
                {
                    if (user.IsLockedOut)
                    {
                        RenderError(Sitecore.Globalization.Translate.Text("User Is Locked out"));
                        return false;
                    }
                }
            }


            return base.Login();
        }

        private void RenderError(string text)
        {
            if (string.IsNullOrEmpty(text))
                return;
            this.FailureHolder.Visible = true;
            this.FailureText.Text = text;
        }
    }
}

Then, navigate to the \sitecore\login\ folder and find the default.aspx file. You need update the following line with your custom class:

<%@ Page Language="C#" AutoEventWireup="true" Async="true" CodeBehind="Default.aspx.cs" Inherits="Sitecore.sitecore.login.Default" %>

It should look like below (Inherits attribute is updated):

<%@ Page Language="C#" AutoEventWireup="true" Async="true" CodeBehind="Default.aspx.cs" Inherits="Your_Namespace.CustomLogin, Your_Namespace" %>

The last step to add the dictionary for message. Switch to the core database and see the following item:

/sitecore/system/Dictionary/U

Add the dictionary entry. I called it "User Is Locked out":

adding dictionary

Result:

result

3
  • That will change the error messages for all scenarios like wrong password. I need specifically for locked users. When a locked user try to login it should say your account is locked instead of generic message.
    – Anjo
    Nov 17, 2017 at 10:30
  • Ok, let me see how you can do that Nov 17, 2017 at 10:31
  • @Anjo I've updated an answer. Please look through it. Nov 17, 2017 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.