implementing automatic unlocking in asp.net 2.0 sqlmembershipprovider ,CodeCoolest.com,Program so easy, Free source code and programming help

| Web 1 ▼
Web X Visual C / C++Net C#Visual Basic Ajax Java SQL Linux / Unix

• What is The Code Coolest?Join The Code Coolest Today
• Latest articles Chapters, Sections and Articles

Home >> Net C# >> Sample Chapter
implementing automatic unlocking in asp.net 2.0 sqlmembershipprovider
Rating : Excellent[0] Very Good[0] Average[0] Below Average[0] Poor[0]
Pub Date: 10/9/2008
admin [ View Profile ]
Abstract
One potential issue that folks raise about SqlMembershipProvider is that the current lockout behavior can lead to a denial of service (DoS) attack. Theoretically, a malicious user could spam a login page with likely user accounts to force account lockouts for a large number of website users. After the user accounts are locked out, the users have no way to get back onto the website until an administrator intervenes and unlocks the accounts.
Introduction
Sponsored Links
a custom membership provider that implements auto-unlock behavior needs a place for users to configure the timeout beyond which the provider should automatically unlock the user account. for this example, you want the provider configuration to look like the following:
```
<add name="autounlocksample"
   type="autounlockprovider"
   connectionstringname="localsqlserver"
   autounlocktimeout="30"
   applicationname="passwordhistory"/>
```
the custom attribute autounlocktimeout tells the provider how many minutes after a lockout a user account should be automatically unlocked. the provider stores this attribute inside of an override of the initialize method:
```
using system;
using system.configuration.provider;
using system.web.security;
public class autounlockprovider : sqlmembershipprovider
{
   private int autounlocktimeout = 60;    //default to 60 minutes
   public override void initialize(string name,
      system.collections.specialized.namevaluecollection config)
   {
      string sunlocktimeout = config["autounlocktimeout"];
      if (!string.isnullorempty(sunlocktimeout))
         autounlocktimeout = int32.parse(sunlocktimeout);
      config.remove("autounlocktimeout");
      base.initialize(name, config);
   }

   //other provider overrides
}
```
before calling the base class initialize method, the custom provider looks for the autounlocktimeout attribute in configuration. if it finds the attribute, it stores its value and removes it from the configuration collection. if the attribute is not supplied in the provider's configuration, it defaults to a 60-minute long timeout after which locked accounts can be automatically unlocked.

because there are a number of different provider methods that should automatically unlock the user, the core functionality is implemented in a single private method:
```
private bool autounlockuser(string username)
{
   membershipuser mu = this.getuser(username,false);
   if ((mu != null) &&
      (mu.islockedout) &&
      (mu.lastlockoutdate.touniversaltime().addminutes(
       autounlocktimeout)
         < datetime.utcnow)
      )
   {
      bool retval = mu.unlockuser();
      if (retval)
         return true;
      else
         return false;    //something went wrong with the unlock
   }
   else
      return false;       //not locked out in the first place
                          //or still in lockout period
}
```
for any given username, this method loads the membershipuser instance for that user. if the membershipuser instance indicates that the user is locked out, the provider checks to see how much time has elapsed since that last lockout. if more than autounlocktimeout minutes have elapsed, the method calls unlockuser to automatically unlock the account. the return value from the method indicates whether the user account was unlocked. normally, calling this method for users still within the autounlocktimeout period returns false, whereas calling the method for users who are past the timeout period results in a true return value.

to demonstrate how this method works with methods that deal with passwords, the following code shows validateuser automatically unlocking users as necessary:
```
public override bool validateuser(string username, string password)
{
   bool retval = base.validateuser(username, password);
   //the account may be locked out at this point
   if (retval == false)
   {
      bool successfulunlock = autounlockuser(username);
      if (successfulunlock)
         //re-attempt the login
            return base.validateuser(username, password);
      else
         return false;
   }
   else
      return retval;    //first login was successful
}
```
first, the custom provider lets the base provider attempt to validate the user's credentials. if the base call succeeds, no further work is necessary. however, if the initial result is false, the method attempts to unlock the user. there may be other reasons why validateuser fails — for example, the user account specified by username may not even exist in the membership database. if the unlock attempt succeeds though, then custom provider again calls the base class's validateuser. this sequence of calls will usually result in the second attempt succeeding, assuming, of course, that that password parameter is valid. if the automatic unlock attempt did not succeed, then the custom provider returns false because there isn't any point in calling base.validateuser again for a user that is still locked out.

with the custom validateuser implementation, you can try logging in with an account and intentionally force a lockout. after autounlocktimeout minutes pass, the next call to validateuser will succeed if you supply the correct password. in fact, this functionality also works transparently with a control like the login control. this is another example of how provider customization can be completely transparent to the user interface layer.

the other aspect of automatically unlocking users is in methods that deal with password answers. for example the override for resetpassword is:
```
public override string resetpassword(
   string username, string passwordanswer)
{
   //a membershippasswordexception could be due to a lockout
   try
   {
      return base.resetpassword(username, passwordanswer);
   }
   catch (membershippasswordexception me) {}
   bool successfulunlock = autounlockuser(username);
   if (successfulunlock)
      //re-attempt the password reset
      return base.resetpassword(username, passwordanswer);
   else
      throw new providerexception(
      "the attempt to auto unlock the user failed during
       resetpassword.");
}
```
in this case, the resetpassword method will throw a memershippasswordexception if the user is locked out. as a result, the first call to the base class is wrapped in a try-catch block that suppresses this exception. in the event that the user is locked out, the override calls autounlockuser to attempt to unlock the user account. if the user account was successfully unlocked, the custom provider attempts to reset the password again by calling into the base class. however, if the automatic unlock attempt failed for some reason, it throws a providerexpcetion to alert callers to the fact that the reset attempt failed. you could also choose to rethrow the membershippasswordexception if you put extra logic into autounlockuser to determine exactly why the unlock attempt failed.

to test this method, you can use a sample page that calls resetpassword and intentionally supply five bad password answers to cause the user account to be locked out. as with validateuser, if you now wait autounlocktimeout minutes to pass, the next call to resetpassword with a valid answer will succeed.

this article is adapted from professional asp.net 2.0 security, membership, and role management by stefan schackow (wrox, 2006, isbn: 0-7645-9698-5), from chapter 11 " sqlmembershipprovider." reprinted with permission from the publisher.
RATE THIS ARTICLE : ExcellentVery GoodAverageBelow AveragePoor
- Latest Comments:
- Add a comment
- Title:
- Comment

Other popular Sample Chapter articles:

•check-point in background thread after application exit
We all know about .NET background threads. Background threads are the kind of threads that don't vote for application exit. Consider an application that has a non-background thread and 20 background threads; then, upon exit of the non-background thread, the application exits (all the 20 background t
•cross platform threads
When writing cross platform applications targeting Windows and any Unix flavored OS, working with different types of threads can be complex. There are two types of threads: detached and joinable. POSIX thread APIs support both Joinable and Detached threads while Win32 multithreading APIs support onl
•delta forth .net
Delta Forth .NET - World's first Forth compiler for the .NET platformDelta Forth is a non-standard Forth dialect. It has several limitations over traditional standards; however it may be an excellent starting point for beginners. The traditional compreter (compiler – interpreter) approach of other i
•C# Generics, Part 2/4: Constraints, Members, Operators
The following article is excerpted from the book Practical .NET2 and C#2. The first part of this article is located here.Type parameter constraints
•The Elements of Game Programming
This article is brought to you by Sams Publishingpublisher of Clayton Walnum's Sams Teach Yourself Game Programming with Visual Basic in 21 DaysThis article is the second part of a two part article. The first part is here. As you've already discovered in part one, a good computer game pushes your
•standard generics library
The attached source code contains a SGL (Standard Generics Library) which is implemention of some data structures and algorithms in C# using generics.Background I have implemented SGL, because I wanted to learn basics of C# and I am interested in solving algorithtmic problems. These data structures
•Report Solution Patterns and Recipes: Greenbar Reports
Report RecipesAs we have endeavored to solve various business problems, we've learned to do some interesting things with Reporting Services. On consulting engagements, I often find myself in front of a client who is asking questions like "can you do this or that?" Almost inevitably, the an
•vb6 save form image to file
This is sample code to save image of the VB 6.0 form to a file. BackgroundNormally the Form.image property only provides the drawing and printedtext in the bitmap image. However if there are image controls, buttons,icons etc on the form then this code pictures those too.Using the codeThere is one si
•create a program that checks all the links in your web page whether they are active or not.
In this article, I will show you how to create a program that checks whether the links in your web application are active or not. We will use Internet Transfer Control to accomplish this task. This is a real world example where you will see the real use of Internet Transfer Control.About the applica
•cthread
CThread makes it possible to work with threads in MFC pretty much the same way as you do in C#/Java. You derive your own class from CThread and implement Run(void* ). To start the thread, you have to call Start(). Now a new thread starts it's execution in Run(). When Run() is finished, the thread st