Validate User

[shapper]

Hello,

I am trying to check if a user is valid as follows:

Response.Write(Membership.ValidateUser("usr", "pass").ToString)

It always gives me FALSE.

The username and password are correct. In fact, if I authenticate the
user with the same values:

FormsAuthentication.Authenticate("usr", "pass")
FormsAuthentication.SetAuthCookie("usr", True)

The user is authenticated.

I have no idea what is going on!

Could someone, please, help me out?

Thanks,

Miguel

 

[shapper]

Hello,

I am trying to check if a user is valid as follows:

Response.Write(Membership.ValidateUser("usr", "pass").ToString)

It always gives me FALSE.

The username and password are correct. In fact, if I authenticate the
user with the same values:

FormsAuthentication.Authenticate("usr", "pass")
FormsAuthentication.SetAuthCookie("usr", True)

The user is authenticated.

I have no idea what is going on!

Could someone, please, help me out?

Thanks,

Miguel

Hi,

I found it! Membership.ValidateUser only validates users that are
active which was not this case.

But I also found that FormsAuthentication.Authenticate authenticates
users even when they are not active.

This is really strange. Shouldn't be the other way around?

It makes sense to me that I can validate any user either is active or
not but can't authenticate users that are not active.

Anyway, I think I should start using the following authentication
code:

If Membership.ValidateUser("usr", "pass") Then

FormsAuthentication.Authenticate("usr", "pass")
FormsAuthentication.SetAuthCookie("usr", True)

End If

Instead of only:

FormsAuthentication.Authenticate("usr", "pass")
FormsAuthentication.SetAuthCookie("usr", True)

Could someone advice me on this?

Thanks,

Miguel

 

[Mark Fitzpatrick]

Think of it this way,

Validating a user is both checking the password, and ensuring the account is
valid and active. Authenticating is simply the act of verifying that the
account information is correct.

If you use the validation, you don't need to run a second check using the
FormsAuthentication.Authenticate as if it passes the validation check then
you're ready to log them in. No need to do another check on the username and
password.