What about using ActiveDirectoryMembershipProvider?
http://msdn.microsoft.com/en-us/library/ms998360.aspx

Petr

Hi Petr,

Thanks for your reply. Is there anyway I can override the login functionality in Umbraco without having to use a membership provider?

I am also looking for similar solution.

What is the best way to change the Umbraco login functionality with a custom membership provider, and have the login logic to do the Login using the server variable "LOGONUSER" without forcing the user to enter User Name and Password.

In other words, I am thinking to modify the "Login.aspx" page of Umbraco back-office, say, to include a Link Button that says:

"Login as Windows User"

Then, the code behind this button will simply do the Login using the User ID retrieved from the "LOGONUSER" variable without passing a password.

I also want to do the same for "Members" login.

Is this possible ?

Tarek.

Tarek,

For members take a look at Reubens blog post for users we probably need some help from core team.

Regards

Ismail

Hi, I think is easy :-)
Create usercontrol or custom xslt extension which use Member.GetMemberByName Method
http://www.umbraco.org/apiDocs/html/MumbracocmsbusinesslogicmemberMemberGetMemberByName.htm

but of course, this may cause security degradation, because you don't check user's password

then you have their username and password and you can use standard asp.net method to login user with this credentials

Petr

Petr,

Would it be possible for you to include some more detail on this for newbies like myself?

I think it is something that many people would want to implement on their Umbraco site and security would not a be an issue for me as my site is on an Intranet so users are already authenticated prior to hitting the login page anyway.

Does the GetMemberByName method also return the name for members aswell as users because I would only want users (backend) being able to auto login and anyone else being redirected to the login page?

Regards

James

James ....

Welcome to the company .... I have same feeling like you !


WE need help and more details ...

I am making a lot of effort and struggling and suffering and getting all sort of errors ....

The only think I manged to do so far is to replace the UserMembershipProvider with the Active Directory Membership Provider and it only worked after making a lot of trials and errors ... and you still have to keep on switching back and forth...

But, I still have to enter the Windows Account and Password like this:

User: [email protected]
Password: **

Guys,

This is a good article on codeproject also do search for active directory throws up more articles reckon should be something there to help.

Regards

Ismail

Hi,

there is article http://www.stevideter.com/2008/03/20/using-two-membership-providers-for-aspnet-logins/
how to use multiple providers, which should be right way how to allow users from AD and custom users to log in.
But I know umbraco move to standard membership is relatively new and maybe isn't ready for 2 membership providers.

If I find some spare time I try create example how to use GetMemberByName. But first possible date is monday ...

Petr

Hi Petr,

Have you created an example yet?

Regards

JT

Hi, I create quick and dirty backdoor page...

I'm not happy giving such sample to internet, it allow users without password knowledge to log in, but I hope it helps you. You should change this sample to verify user against AD (Ismail post links about it)

I don't use umbraco with members with v4 yet, so I cannot confirm that everythings works, but my sample uses standard asp.net membership and it looks like it works.

I reccommend to put it in umbraco directory, otherwise url rewriting try find page in umbraco content.

[code]
<%@ Page Language="C#" %>

<script runat="server"><br />
    protected void Page<em>Load(object sender, EventArgs e)<br />
    {<br />
        if (!Page.IsPostBack) txtUserName.Text = Request.ServerVariables["HTTP</em>USER"];<br />
    }<br />
    protected void btnGetUserInfo_Click(object sender, EventArgs e)<br />
    {<br />
        //You should add AD verification here        <br />
<br />
        MembershipUser u = Membership.GetAllUsers()[txtUserName.Text];<br />
        if (u != null)<br />
        {<br />
            //Use this<br />
            //FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);<br />
            <br />
            //Or if you want go to specific page<br />
            setCookie(u.UserName);<br />
            //Response.Redirect(specificUrl);<br />
            <br />
            //Loginstatus show bad status because this is called after loginstatus check if user is autentificated, <br />
            //try refresh page  <br />
        }<br />
        else<br />
        {<br />
            lblStatus.Text = "User not found";<br />
        }<br />
    }<br />
    protected void setCookie(string userName) {<br />
        FormsAuthentication.SetAuthCookie(userName, false);<br />
        string cookieName = FormsAuthentication.FormsCookieName;<br />
        HttpCookie cookie = Response.Cookies[cookieName];<br />
        cookie.Expires = DateTime.Now.AddMinutes(20);<br />
    }<br />
</script>

Thanks for the sample Petr!

Petr,

Thanks a lot !

Actually, you simple and clear code sample made me have better understanding about Authentication in general.

So if I need to integrate with my custom Membership Provider, I simply change this line:

[code]MembershipUser u = Membership.GetAllUsers()[txtUserName.Text];[/code]

to perform a look-up to the user who is authenticated. Because it looks like the code does not make use of the object "u" of type "MembershipUser", it is using the string value of the user name.

All what we need now is to Integrate with the Authentication model of Umbraco using the sample code provided by Ruben (as per earlier post in this thread).

Here are my thoughts about this...

Change these lines:

[code] MembershipUser u = Membership.GetAllUsers()[txtUserName.Text];
if (u != null)
{
//Use this
//FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);

//Or if you want go to specific page
setCookie(u.UserName);
//Response.Redirect(specificUrl);

//Loginstatus show bad status because this is called after loginstatus check if user is autentificated,
//try refresh page
}
else
{
lblStatus.Text = "User not found";
}[/code]

so that instead of setting an Authentication Cookie, you must invoke Umbraco membership APIs to:

- Create the user in Umbraco Members store if he does not exist,

- Give him default Access Rights, or assign hom to a default Role/MemberType,

- Authenticate him as per Umbraco Rules.

Correct ?

Notes:

The line of code:

[code]Request.ServerVariables["HTTPUSER"][/code]

is retruning NULL always, so I think you need to chanllenge the request object (IE) to force getting the ID of the Logon User, which is I think same as the value of "LOGONUSER", correct ?

Tarek.

Tarek,

I think Request.ServerVariables["HTTPUSER"] is specific to my scenario as the intranet user has a session variable available that holds their username once they log in. I want to authenticate them against this rather than AD or custom membership provider.

What is strange is that I have changed a username in Umbraco db to the same as httpuser variable but still get "user not found". I've displayed on the page the contents of the session variable so I know exactly what it is, do I need to cast it to a string?

Hi, some notes
1. Request.ServerVariables["HTTP_USER"] is set only if Anonymous acces is disabled - it can be set in web.config or in IIS.

2. if (u != null) is check if user with this name exists in umbraco, If you want create users, put code in else block. There is sample around how to import users from outlook.

3 to James - try use Membership.GetAllUsers() with foreach and dump all users to see if there is user with your name from server variable. Umbraco has members and users ...

Petr Snobelt

I have tried dumping out the users as follows:

MembershipUser u = Membership.GetAllUsers()[txtUserName.Text];

foreach (MembershipUser item in u)
{
Response.Write(item);
}

But get an error stating that System.Web.Security.MembershipUser' does not contain a public definition for 'GetEnumerator'.

Hi,

Error is just what is says, MembershipUser is NOT a collection and doesn't implement IEnumerable

Remove the foreach, you're dealing with a single MembershipUser

Regards,
/Dirk

//This select single user from collection
MembershipUser u = Membership.GetAllUsers()[txtUserName.Text];

You shuld write:

foreach (MembershipUser item in Membership.GetAllUsers())
{
Response.Write(item);
//Now I think you shuld write item.UserName or something like this, intellisence helps
}

Petr

Thanks Petr and Dirk,

I have used the code snippet for looping through all members but I am not getting anything displayed on the webpage. I have also tried item.UserName

foreach (MembershipUser item in Membership.GetAllUsers())
{
Response.Write(item);
}

I have checked the umbracoUser table and ensured that there are users in the db so why would GetAllUsers() not return anything?

Regards

JT

It looks like you try find User (umbraco user's section)
This code works with Members (try create one)

Petr

So GetAllUsers only returns members?

Do you know if there is a method that gets users?


I want to display a link on the editable pages depending on the session variable that holds the username (only certain users will have this functionality) and the link goes to a a page that authenticates the USER and redirects to the live editing version of the page.

The action page that the link goes to basically needs to perform the same as the login page code but on the pageload method:

protected void Button1Click(object sender, System.EventArgs e)
{
// Authenticate users by using the provider specified in umbracoSettings.config
if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].ValidateUser(lname.Text, passw.Text))
{
if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider] is ActiveDirectoryMembershipProvider)
ActiveDirectoryMapping(lname.Text, Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].GetUser(lname.Text, false).Email);

BusinessLogic.User u = new User(lname.Text);
doLogin(u);

// Check if the user should be redirected to live editing
if (u.DefaultToLiveEditing)
{
int startNode = u.StartNodeId;
// If the startnode is -1 (access to all content), we'll redirect to the top root node
if (startNode == -1)
{
if (umbraco.cms.businesslogic.web.Document.GetRootDocuments().Length > 0)
{
startNode = umbraco.cms.businesslogic.web.Document.GetRootDocuments()[0].Id;
}
else
{
throw new Exception("There's currently no content to edit. Please contact your system administrator");
}
}
string redir = String.Format("{0}/liveediting.aspx?redir=/{1}.aspx", GlobalSettings.Path, startNode);
Response.Redirect(redir, true);
}

if (hfheight.Value != "undefined")
{
Session["windowHeight"] = hfheight.Value;
Session["windowWidth"] = hf_width.Value;
}

if (string.IsNullOrEmpty(Request["redir"]))
Response.Redirect("umbraco.aspx");
else
Response.Redirect(Request["redir"]);
}
}

jtmk,

You need

[code]
umbraco.BusinessLogic.User.getAll()
[/code]

Ps you can view api documentation online here or download it.

Regards

Ismail

Thanks for the link to the API documentation Ismail. I am now able to return the user based on login name passed using getAllByLoginName(). I have tried to incorporate this with the code found in the login page to automate the login but I am getting the following error that I am hoping someone can help me with:

CS0103: The name 'UmbracoSettings' does not exist in the current context

Line 35: if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].ValidateUser(lname, passw))



Here is the code for my backdoor login page:

using System;
using System.Collections;
using System.Configuration;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
using umbraco.BusinessLogic;

using umbraco.DataLayer;
public partial class umbracofelsLogin : System.Web.UI.Page
{
public static string lname = "";
public static string passw = "";

protected void PageLoad(object sender, EventArgs e)
{
txtUserName.Text = Request.ServerVariables["LOGINSESSIONVAR"];

//MembershipUser u = umbraco.BusinessLogic.User.getAllByLoginName(txtUserName.Text);

foreach (umbraco.BusinessLogic.User item in umbraco.BusinessLogic.User.getAllByLoginName(txtUserName.Text))
{
Response.Write("Username is: " + item.Name);
lname = item.Name;
passw = "password";
}

// Authenticate users by using the provider specified in umbracoSettings.config
if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].ValidateUser(lname, passw))
{
if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider] is ActiveDirectoryMembershipProvider)
ActiveDirectoryMapping(lname.Text, Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].GetUser(lname.Text, false).Email);

BusinessLogic.User u = new User(lname.Text);
doLogin(u);

// Check if the user should be redirected to live editing
if (u.DefaultToLiveEditing)
{
int startNode = u.StartNodeId;
// If the startnode is -1 (access to all content), we'll redirect to the top root node
if (startNode == -1)
{
if (umbraco.cms.businesslogic.web.Document.GetRootDocuments().Length > 0)
{
startNode = umbraco.cms.businesslogic.web.Document.GetRootDocuments()[0].Id;
}
else
{
throw new Exception("There's currently no content to edit. Please contact your system administrator");
}
}
string redir = String.Format("{0}/liveediting.aspx?redir=/{1}.aspx", GlobalSettings.Path, startNode);
Response.Redirect(redir, true);
}

if (hfheight.Value != "undefined")
{
Session["windowHeight"] = hfheight.Value;
Session["windowWidth"] = hf_width.Value;
}

if (string.IsNullOrEmpty(Request["redir"]))
Response.Redirect("umbraco.aspx");
else
Response.Redirect(Request["redir"]);
}

}

Do you have namespace

[quote]
using umbraco;
[/quote]

also you will need reference in your project to assembly businesslogic ps a useful api doc can be found here

Regards

Ismail

Umbraco gurus,

Guys, correct me if I am wrong !

jtmk,

I am new to Umbraco just like you, but I think you cannot login to Umbraco using ab ASPX Page.

You have to create a User Control item, and just copy/paste parts of the code to the new user control, deploy the user control to Umbraco, wrap it in a Macro, and insert it in a Master Page template or something like that.

Also, you need to consider creating a new class and inherit the Membership provider class of Umbraco (of back-office / front-office).

Check Ruben code sample. It is very clear.

I am also trying to do something similar to what you are doing.

Keep us informed.

Tarek.

I have added the following to the top of my code:

using umbraco;
using umbraco.BusinessLogic;

I now get a different error:

Compiler Error Message: CS0103: The name 'ActiveDirectoryMapping' does not exist in the current context

Line 39: ActiveDirectoryMapping(lname.Text, Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].GetUser(lname.Text, false).Email);


Tarek, I am just using the code that can be found in the login.cs file which is called when the login button event is fired.

jtmk,

Are you modifying the Login.cs page directly ? Or are you replacing the page with a modified version of your own ?

I think this is a cool idea !

I always was thinking that it is not a good practice to modify the Open Source Code directly, because it will make it very difficult to maintain and cope with the future upgrades.

I was thinking to do the following:

1. Inherit the Umbraco Membership provider in a new class, and modify its behaviour to loing against Active Directory. Also, I think there is no need to look-up against Active Directory, you can just simply use the Server Variable "LOGONUSER" because I think it is coming from Active Directory if the user ID is a member of a DOMAIN.

2. Add a simple button/link button in Login.aspx to perform "Login as Windows User". This is a simple addition. In the code-behind "ButtonOnClick()" Just call the new Validate function of the new membership provider class, and pass a dummy password like "*WINDOWSUSER". Of course, this will not be used in the login code.

Let me know how it goes with you.

Tarek.

I am using a separate page with a modified version. I am hoping that I can display a link on each page if the user has admin authority and this will point to the auto login page.

I am just unable to get the code taken from login page to work due to .net errors.

I worked out what was causing the error - the ActiveDirectoryMapping method that did not exist in this class was being referenced so once I copied that into my cs file the error disappeared.

I am getting a new error now:

Compiler Error Message: CS0246: The type or namespace name 'BusinessLogic' could not be found (are you missing a using directive or an assembly reference?)

I have declared "using umbraco.BusinessLogic" so any ideas why I would be getting this error?

I have got the auto login now working!!!! woohoo

The code checks a session variable for user's login name and passes it with a default password to the login method which then directs the user to their live editing page as established when the user was set up.

This system is being used within an Intranet though! Please use at your own risk!*

Thanks to everyone that helped with this. Here is the code in case anyone else wants this functionality and any suggestions to make this neater and more efficient are welcome:

using System;
using System.Collections;
using System.Configuration;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
using umbraco;
using umbraco.BusinessLogic;
using umbraco.DataLayer;

using System.ComponentModel;
using System.Drawing;
using System.Web.SessionState;
using System.Web.UI;
using umbraco.cms.businesslogic;
using umbraco.cms.businesslogic.web;




public partial class umbracofelsLogin : System.Web.UI.Page
{
public static string lname = "";
public static string passw = "";

protected void PageLoad(object sender, EventArgs e)
{
txtUserName.Text = Request.ServerVariables["USERIDSESSIONVAR"];

//MembershipUser u = umbraco.BusinessLogic.User.getAllByLoginName(txtUserName.Text);

foreach (umbraco.BusinessLogic.User item in umbraco.BusinessLogic.User.getAllByLoginName(txtUserName.Text))
{
Response.Write("Username is: " + item.Name);
lname = item.Name;
passw = "password";
}

// Authenticate users by using the provider specified in umbracoSettings.config
if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].ValidateUser(lname, passw))
{
if (Membership.Providers[UmbracoSettings.DefaultBackofficeProvider] is ActiveDirectoryMembershipProvider)
ActiveDirectoryMapping(lname, Membership.Providers[UmbracoSettings.DefaultBackofficeProvider].GetUser(lname, false).Email);

umbraco.BusinessLogic.User u = new User(lname);
umbraco.BasePages.BasePage.doLogin(u);

// Check if the user should be redirected to live editing
if (u.DefaultToLiveEditing)
{
int startNode = u.StartNodeId;
// If the startnode is -1 (access to all content), we'll redirect to the top root node
if (startNode == -1)
{
if (umbraco.cms.businesslogic.web.Document.GetRootDocuments().Length > 0)
{
startNode = umbraco.cms.businesslogic.web.Document.GetRootDocuments()[0].Id;
}
else
{
throw new Exception("There's currently no content to edit. Please contact your system administrator");
}
}
string redir = String.Format("{0}/liveediting.aspx?redir=/{1}.aspx", GlobalSettings.Path, startNode);
Response.Redirect(redir, true);
}

if (hfheight.Value != "undefined")
{
Session["windowHeight"] = hfheight.Value;
Session["windowWidth"] = hf_width.Value;
}

if (string.IsNullOrEmpty(Request["redir"]))
Response.Redirect("umbraco.aspx");
else
Response.Redirect(Request["redir"]);
}

}

protected void setCookie(string userName)
{
FormsAuthentication.SetAuthCookie(userName, false);
string cookieName = FormsAuthentication.FormsCookieName;
HttpCookie cookie = Response.Cookies[cookieName];
cookie.Expires = DateTime.Now.AddMinutes(20);
}

private void ActiveDirectoryMapping(string loginName, string email)
{
// Password is not copied over because it is stored in active directory for security!
// The user is create with default access to content and as a writer user type
if (umbraco.BusinessLogic.User.getUserId(loginName) == -1)
{
umbraco.BusinessLogic.User.MakeNew(loginName, loginName, string.Empty, email, umbraco.BusinessLogic.UserType.GetUserType(2));
umbraco.BusinessLogic.User u = new umbraco.BusinessLogic.User(loginName);
u.addApplication("content");
}
}
}

Great job !

I will definitely benefit from your work !

Thank a lot.

Tarek.

No problem Tarek!!!

is working on a reply...