Simple user/password protection in asp.net MVC

Question

a very simple problem, maybe someone has a tip for a MVC Beginner like me. I want to Password protect an MVC Application - just on user / password is necessary - I did it via ASPNETDB and SqlMembershipProvider, but there should be hopefully an easier way - in webforms I did it via adding user / password to web.config.

Do I really need to write my own XmlMembershipProvider to solve that problem? If yes, do you know a really simple existing XmlMembershipProvider that can do this for me? Many thanks in advance..

score 5 · Answer 1 · answered Nov 16 '10 at 12:41

What I finally did was:

public class MyMembershipProvider : MembershipProvider {
  // ...
  public override bool ValidateUser(string username, string password)
  {
    return FormsAuthentication.Authenticate(username, password);
  }
}

web.config:

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" timeout="2880" >
    <credentials passwordFormat="Clear">
      <user name="rga" password="XYZ"/>
    </credentials>
  </forms>
</authentication>

...

<membership defaultProvider="XmlMembershipProvider">
  <providers>
        <clear/>
        <add name="MyMembershipProvider" type="Namespace.Of.MyMembershipProvider" 
             enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false"
             maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
             applicationName="/" />
  </providers>
</membership>

So there was no need to change AccountController. Thx for your help.

this is deliciously simple for personal sites with only one login and no real users — 5uperdan, Mar 03 '14 at 20:13
What else is needed beyond the code shown above in order to get this working? — Jon Schneider, Sep 03 '22 at 02:59

score 2 · Answer 2 · answered Nov 16 '10 at 10:19

Hi if you have started a mvc project with visual studio, you have standard a UserController. If you look into this class you will find the following method:

public virtual ActionResult LogOn(LogOnModel model, string returnUrl)

You can impelement your own code in this function for validating password and logon.

For example:

public virtual ActionResult LogOn(LogOnModel model, string returnUrl)
{
    if(model.Password == "YourPassword" && model.UserName == "YourUserName")
    {
        FormsService.SignIn(model.UserName, model.RememberMe);
        if (!String.IsNullOrEmpty(returnUrl))
        {
            return Redirect(returnUrl);
        }
        else
        {
            return RedirectToAction("ActionName");
        }
    }
    else
    {
        ModelState.AddModelError("", "Wrong credentials.");
        return View(model);
    }
}

hope it will help you. Regards

score 1 · Accepted Answer · edited May 23 '17 at 10:33

1

You don´t need to use any membership provider in order to password protect your application. You simply have to provide a service to validate user credentials. You can look here for an idea on how to do that. Basically, you need to generate a salt and then hash the user password using that salt (and the password provided). Then you store the salt and the hashed password in the DB. Try it, it is not difficult. After you have validated the user´s credentials, you can use the code that I wrote in this SO question to use forms authentication.

Cheers!

edited May 23 '17 at 10:33

Community

1
1

answered Nov 16 '10 at 10:07

uvita

4,124
1
27
23

Thanks a lot, I did it meanwhile via my own MembershipProvider - just overridden ValidateUser and it worked - but your solution is even simpler ... – Tobias Pirzer Nov 16 '10 at 10:27

score 0 · Answer 4 · answered Nov 16 '10 at 10:33

0

Why XML MembershipProvider? You just have to inherit form IMembershipProvider and implement the functionality you need.

answered Nov 16 '10 at 10:33

Ilya Smagin

5,992
11
40
57

I was thinking about storing User / Passwd insinde an xml file or web.config. – Tobias Pirzer Nov 16 '10 at 12:43

Simple user/password protection in asp.net MVC

4 Answers4

Linked