This Membership Provider has not been configured to support password retrieval.

Hi,
When an anonymous user has created an new account (with the CreateUserWizard
control), i want to let asp.net generate a password and to send it to the
address of the email provided by the new membershipuser in the
CreateUserWizard control.
i think i need to define a custom provider for membership and i tried this:
web.config:
--
<connectionStrings>
<add name="aspnetdb" connectionString="Data
Source=. \SQLEXPRESS;AttachDbFilename=|DataDirect
ory|\ASPNETDB.MDF;Integrated
Security=True;User Instance=True" providerName="System.Data.SqlClient"/>
</connectionStrings>
<authentication mode="Forms" />
<membership>
<providers>
<add name="MyMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="aspnetdb"
enablePasswordRetrieval="true"
enablePasswordReset="true"
passwordFormat="Encrypted"
requiresQuestionAndAnswer="true"
applicationName="/"
/>
</providers>
</membership>
code-behind:
--
Protected Sub Page_Load(ByVal sender As Object, ByVal e As
System.EventArgs) Handles Me.Load
If User.Identity.IsAuthenticated Then
Dim pw As String
pw = Membership.GetUser.GetPassword.ToString
End If
End Sub
But this generate the error:
"This Membership Provider has not been configured to support password
retrieval."
at line "pw = Membership.GetUser.GetPassword.ToString"
The problem is, i think, that it still the default provider which is used
and not my custom one. But i don't knwo how to fix it.Maybe i don't even
need to defiine a custom provider and maybe i can use the default?
Thanks for help
BenI changed this in web.config:
<membership defaultProvider="MyMembershipProvider">
but now, i get this error:
"You must specify a non-autogenerated machine key to store passwords in the
encrypted format. Either specify a different passwordFormat, or change the
machineKey configuration to use a non-autogenerated decryption key."
Do i have to change the line in web.config: passwordFormat="Encrypted" in
"Clear"? But then the security is not guaranteed?
"Ben" <b@.en.sd> schreef in bericht
news:OvshZOCgHHA.2396@.TK2MSFTNGP04.phx.gbl...
> Hi,
> When an anonymous user has created an new account (with the
> CreateUserWizard control), i want to let asp.net generate a password and
> to send it to the address of the email provided by the new membershipuser
> in the CreateUserWizard control.
> i think i need to define a custom provider for membership and i tried
> this:
> web.config:
> --
> <connectionStrings>
> <add name="aspnetdb" connectionString="Data
> Source=. \SQLEXPRESS;AttachDbFilename=|DataDirect
ory|\ASPNETDB.MDF;Integrat
ed
> Security=True;User Instance=True" providerName="System.Data.SqlClient"/>
> </connectionStrings>
> <authentication mode="Forms" />
> <membership>
> <providers>
> <add name="MyMembershipProvider"
> type="System.Web.Security.SqlMembershipProvider, System.Web,
> Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
> connectionStringName="aspnetdb"
> enablePasswordRetrieval="true"
> enablePasswordReset="true"
> passwordFormat="Encrypted"
> requiresQuestionAndAnswer="true"
> applicationName="/"
> />
> </providers>
> </membership>
> code-behind:
> --
> Protected Sub Page_Load(ByVal sender As Object, ByVal e As
> System.EventArgs) Handles Me.Load
> If User.Identity.IsAuthenticated Then
> Dim pw As String
> pw = Membership.GetUser.GetPassword.ToString
> End If
> End Sub
>
> But this generate the error:
> "This Membership Provider has not been configured to support password
> retrieval."
> at line "pw = Membership.GetUser.GetPassword.ToString"
> The problem is, i think, that it still the default provider which is used
> and not my custom one. But i don't knwo how to fix it.Maybe i don't even
> need to defiine a custom provider and maybe i can use the default?
> Thanks for help
> Ben
>
>

This Membership Provider has not been configured to support password retrieval.

Hi,

When an anonymous user has created an new account (with the CreateUserWizard
control), i want to let asp.net generate a password and to send it to the
address of the email provided by the new membershipuser in the
CreateUserWizard control.

i think i need to define a custom provider for membership and i tried this:

web.config:
----
<connectionStrings>
<add name="aspnetdb" connectionString="Data
Source=.\SQLEXPRESS;AttachDbFilename=|DataDirector y|\ASPNETDB.MDF;Integrated
Security=True;User Instance=True" providerName="System.Data.SqlClient"/>
</connectionStrings>

<authentication mode="Forms" />

<membership>
<providers>
<add name="MyMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="aspnetdb"
enablePasswordRetrieval="true"
enablePasswordReset="true"
passwordFormat="Encrypted"
requiresQuestionAndAnswer="true"
applicationName="/"
/>
</providers>
</membership>
code-behind:
----
Protected Sub Page_Load(ByVal sender As Object, ByVal e As
System.EventArgs) Handles Me.Load
If User.Identity.IsAuthenticated Then
Dim pw As String
pw = Membership.GetUser.GetPassword.ToString
End If
End Sub

But this generate the error:
"This Membership Provider has not been configured to support password
retrieval."
at line "pw = Membership.GetUser.GetPassword.ToString"

The problem is, i think, that it still the default provider which is used
and not my custom one. But i don't knwo how to fix it.Maybe i don't even
need to defiine a custom provider and maybe i can use the default?

Thanks for help
BenI changed this in web.config:

<membership defaultProvider="MyMembershipProvider">

but now, i get this error:
"You must specify a non-autogenerated machine key to store passwords in the
encrypted format. Either specify a different passwordFormat, or change the
machineKey configuration to use a non-autogenerated decryption key."

Do i have to change the line in web.config: passwordFormat="Encrypted" in
"Clear"? But then the security is not guaranteed?

"Ben" <b@.en.sdschreef in bericht
news:OvshZOCgHHA.2396@.TK2MSFTNGP04.phx.gbl...

Quote:

Originally Posted by

Hi,
>
When an anonymous user has created an new account (with the
CreateUserWizard control), i want to let asp.net generate a password and
to send it to the address of the email provided by the new membershipuser
in the CreateUserWizard control.
>
i think i need to define a custom provider for membership and i tried
this:
>
web.config:
----
<connectionStrings>
<add name="aspnetdb" connectionString="Data
Source=.\SQLEXPRESS;AttachDbFilename=|DataDirector y|\ASPNETDB.MDF;Integrated
Security=True;User Instance=True" providerName="System.Data.SqlClient"/>
</connectionStrings>
>
<authentication mode="Forms" />
>
<membership>
<providers>
<add name="MyMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="aspnetdb"
enablePasswordRetrieval="true"
enablePasswordReset="true"
passwordFormat="Encrypted"
requiresQuestionAndAnswer="true"
applicationName="/"
/>
</providers>
</membership>
code-behind:
----
Protected Sub Page_Load(ByVal sender As Object, ByVal e As
System.EventArgs) Handles Me.Load
If User.Identity.IsAuthenticated Then
Dim pw As String
pw = Membership.GetUser.GetPassword.ToString
End If
End Sub
>
>
But this generate the error:
"This Membership Provider has not been configured to support password
retrieval."
at line "pw = Membership.GetUser.GetPassword.ToString"
>
The problem is, i think, that it still the default provider which is used
and not my custom one. But i don't knwo how to fix it.Maybe i don't even
need to defiine a custom provider and maybe i can use the default?
>
Thanks for help
Ben
>
>
>
>

Thoughts about using Session variables for login security?

I am creating a simple website with a login page and some "admin only"
pages.
In my login page's submit button I just say if the "password is correct"
then...
session("IsAdmin") = True
In my admin only pages I check if session("IsAdmin") = True
If it's NOT then I redirect them to the login.aspx page.
Is this solution pretty solid, or is it easy to hack? I keep the password
in the web.config appsettings section so it's easy to change.
I know I could use Membership stuff, but I'm just doing a simple, quick
website.
Your thoughts are appreciated!Hello Bobby,

> I am creating a simple website with a login page and some "admin only"
> pages.
> In my login page's submit button I just say if the "password is
> correct"
> then...
> session("IsAdmin") = True
> In my admin only pages I check if session("IsAdmin") = True If it's
> NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? I keep the
> password in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple,
> quick website.
Membership is there, membership is quick and membership works out of the
box from the web.config if you need it to.
My experience is that this quick and simple website will run for the coming
20 years and that every time you need to change somthing you hoped you did
it the right way first time round...
--
Jesse Houwing
jesse.houwing at sogeti.nl
I've done the same thing in the past. There is one and only quesion
you need to ask: "is this doing what I need it to?" From your post the
answer is "yes," so you're good. But I see you're asking "is it easy
to hack?"
And the answer is a resounding "no." Session variables are stored in
the server's memory. In order to access them a hacker would need to
hack the server itself and gain access to it's memory. If that
happens, having them view your session variables would be the very
least of your concerns.
On Mar 5, 2:33=A0pm, "Bobby Edward" <t...@.test.com> wrote:
> I am creating a simple website with a login page and some "admin only"
> pages.
> In my login page's submit button I just say if the "password is correct"
> then...
> session("IsAdmin") =3D True
> In my admin only pages I check if session("IsAdmin") =3D True
> If it's NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? =A0I keep the passwo=[/color
]
rd
> in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple, quick
> website.
> Your thoughts are appreciated!
I'd look at Jesse's recommendation about using the built-in membership
system in ASP.Net 2.0 if you really want to have some flexibility. You can
then use Roles to manage your users. For administrators, you can create an
Admin role and assign the users to that role. Then all you have to do is
test if the user is in that role. Actually, better yet, you can set the
authorization section of the web.config file so that only certain users or
roles have access to particular files or folders. This let's you tweak
security in a config file without worrying about coding it in every single
page.
Hope this helps,
Mark Fitzpatrick
Microsoft MVP - Expression
"Bobby Edward" <test@.test.com> wrote in message
news:%23dULGfvfIHA.1188@.TK2MSFTNGP04.phx.gbl...
>I am creating a simple website with a login page and some "admin only"
>pages.
> In my login page's submit button I just say if the "password is correct"
> then...
> session("IsAdmin") = True
> In my admin only pages I check if session("IsAdmin") = True
> If it's NOT then I redirect them to the login.aspx page.
> Is this solution pretty solid, or is it easy to hack? I keep the password
> in the web.config appsettings section so it's easy to change.
> I know I could use Membership stuff, but I'm just doing a simple, quick
> website.
> Your thoughts are appreciated!
>

Thread was being aborted

Hi,
I have a login page, and after i validate a username and password i use a
response.redirect to the default page. The username and password are stored
in an sql db. In the response.redirect i use some session variables to be
added in the query string. However i am getting a "Thread was being
aborted.". Any ideas why this could happen?
Thanks inadvance.hi
You should not include the code "Response.redirect.. " in the code blok
"Try {} catch{}"
Sample:
try
{
//deal with the login logic
}
catch(Exception e)
{
}
Response.redirect("default.aspx");
Thanks a lot, it worked. But out of curiosity, you know why the error was
raised' what goes through the try-catch block that raised that error?
"Solo" <sunsolo@.gmail.com> wrote in message
news:1125819246.425176.236590@.z14g2000cwz.googlegroups.com...
> hi
> You should not include the code "Response.redirect.. " in the code blok
> "Try {} catch{}"
> Sample:
> try
> {
> //deal with the login logic
> }
> catch(Exception e)
> {
> }
> Response.redirect("default.aspx");
>
"Loui Mercieca" <loui@.destiny-creations.com> wrote in message
news:%23p3c7USsFHA.1132@.TK2MSFTNGP10.phx.gbl...

> Thanks a lot, it worked. But out of curiosity, you know why the error was
> raised' what goes through the try-catch block that raised that error?
It's a fairly common "gotcha". If you'd written:
Response.Redirect("default.aspx", false);
you wouldn't have got the error...
Loui,
this is what happens:
"The Response.End method ends the page execution and shifts the execution to
the Application_EndRequest event in the application's event pipeline. The
line of code that follows Response.End is not executed.
This problem occurs in the Response.Redirect and Server.Transfer methods
because both methods call Response.End internally. "
This behavior is by design. You can read about it in
http://support.microsoft.com/default.aspx?scid=kb;[LN];312629
Does this information help you?
Daniel Walzenbach
"Loui Mercieca" <loui@.destiny-creations.com> schrieb im Newsbeitrag
news:OvrjmBSsFHA.3504@.TK2MSFTNGP10.phx.gbl...
> Hi,
> I have a login page, and after i validate a username and password i use a
> response.redirect to the default page. The username and password are
> stored in an sql db. In the response.redirect i use some session variables
> to be added in the query string. However i am getting a "Thread was being
> aborted.". Any ideas why this could happen?
> Thanks inadvance.
>