DisableCreatedUser="true" not working

[Jeff]

hi

asp.net 3.5

In my createuserwizard I've specified DisableCreatedUser="true" for the
intention that users should be disabled. User's get account activiated when
they click on a link in confirmation email I send them....

But now I've noticed that I can login with a user before I've clicked on
that link.

This happens before the user get the confirm email:
If the registration was a success I open another page which do this code
MembershipUser user = Membership.GetUser(username);
Roles.AddUserToRole(user.UserName.ToString(), "santa");

My hence says that the AddUserToRole also approve the user, but I'm not
sure..

any ideas?

 

[Gregory A. Beamer]

In my createuserwizard I've specified DisableCreatedUser="true" for
the intention that users should be disabled. User's get account
activiated when they click on a link in confirmation email I send
them....

But now I've noticed that I can login with a user before I've clicked
on that link.

This happens before the user get the confirm email:
If the registration was a success I open another page which do this
code MembershipUser user = Membership.GetUser(username);
Roles.AddUserToRole(user.UserName.ToString(), "santa");

My hence says that the AddUserToRole also approve the user, but I'm
not sure..

First, make sure you set LoginCreatedUser to false when creating the
user (with the wizard esp.). not sure if this will completely solve the
problem, but it is suggested in all the literature.

Second, you can explicitly make the user unapproved, etc. on the
MembershipUser object. when you add the user to the role, to make sure
they cannot log in.


--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

Twitter: @gbworld
Blog: http://gregorybeamer.spaces.live.com

*******************************************
| Think outside the box! |
*******************************************