Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • badigard 7 posts 38 karma points
    Aug 25, 2015 @ 15:02
    badigard
    0

    Members Login following Validation

    Hi, Following this example I have created a member register controller which sends out a verification email to the user. Once the use clicks on the verification link (http://dev.website.com/umbraco/surface/RegisterSurface/MemberValidation?email=email@gmail.com&guid=xxxx) the below action is called.

    My problem is that I cant login the user as the password stored in the IMember is Row thus Members.Login() fails.

    How should I bypass this?

     [HttpGet]
                [ActionName("MemberValidation")]
                public ActionResult MemberValidation(string email, string guid)
                {
                    if (email == null || guid == null)
                    {
                        Session["validateStatus"] = "error";
                        Session["validateMessage"] = "Error validating your email address";
                        return RedirectToUmbracoPage(Umbraco.TypedContentSingleAtXPath("//Home").Id);
                    }
    
                    var memberService = Services.MemberService;
                    var member = memberService.GetByEmail(email);
    
                    if (member.GetValue("validateguid").ToString().ToLower() == guid)
                    {
                        member.IsApproved = true;
                        memberService.Save(member);
    
                        ***Where Im stuck***
                        if (Members.Login(member.Username, member.RawPasswordValue))  
                        {
                            Session["validateStatus"] = "success";
                            Session["member"] = member;
                            return RedirectToUmbracoPage(Umbraco.TypedContentSingleAtXPath("//AccountSettings").Id);
                        }
                    }
    
                    Session["validateStatus"] = "error";
                    Session["validateMessage"] = "Sorry - we can't seem to validate your email address";
                    return RedirectToUmbracoPage(Umbraco.TypedContentSingleAtXPath("//Home").Id);
    
                }
    
  • Robert Foster 459 posts 1820 karma points MVP 4x admin c-trib
    Aug 25, 2015 @ 15:26
    Robert Foster
    100

    Hi, You shouldn't rely on attempting to retrieve a password on a member; that's not what that field is for - it doesn't provide the clear-text password but rather an encrypted value.

    Instead, to log a member in programmatically you can do the following:

    1. Validate the User account (you're doing this already - to an extent) - typically this includes making sure the member isn't locked out; is enabled; hasn't exceeded the maximum password attempts; etc.
    2. Get the User - you already have that too.
    3. Log them in:

      FormsAuthentication.SetAuthCookie(member.UserName, true);

    On the surface that's all there is to it the most complex part is the account validation - if you take a look at Umbraco's source code you'll find a fairly comprehensive implementation here:

    Umbraco.Web.Security.Providers.UmbracoMembershipProvider.ValidateUser(string username, string password) (514 - 603)

    Don't get caught up on line 550 - it uses CheckPassword to verify the provided password against RawPasswordValue by encrypting it first.

  • badigard 7 posts 38 karma points
    Aug 25, 2015 @ 19:24
    badigard
    0

    Thanks for the tip. Works great. So I understand that UmbracoMembershipProvider is an extension to provide a secure layer for member service?

  • Robert Foster 459 posts 1820 karma points MVP 4x admin c-trib
    Aug 26, 2015 @ 01:31
    Robert Foster
    0

    UmbracoMembershipProvider is just that - a custom MembershipProvider built by Umbraco - similar to the built-in DotNet MembershipProvider...

  • This forum is in read-only mode while we transition to the new forum.

    You can continue this topic on the new forum by tapping the "Continue discussion" link below.

Please Sign in or register to post replies