/// <summary>
/// Checks a password for the user.
/// </summary>
/// <param name="password">The password to test.</param>
/// <returns>True if the password is correct for the user.</returns>
public bool CheckPassword(string password)
{
if (this.Passwords.Count == 0)
{
return(false);
}
UserPassword storedPassword = this.Passwords[0];
return(storedPassword.VerifyPassword(password));
}
/// <summary>
/// Validates the given username and password
/// </summary>
/// <param name="username">Name of user attempting login</param>
/// <param name="password">Password provided by user</param>
/// <returns>True if the login succeeds; false otherwise.</returns>
public static bool Login(string username, string password)
{
User user = UserDataSource.LoadForUserName(username);
if (user == null)
{
return(AuditLogin_InvalidUsername(username));
}
if (!user.IsApproved)
{
return(AuditLogin_Unapproved(user));
}
UserPasswordCollection passwordCollection = user.Passwords;
if (passwordCollection.Count == 0)
{
return(AuditLogin_NoPassword(user));
}
UserPassword storedPassword = passwordCollection[0];
bool isPasswordValid = storedPassword.VerifyPassword(password);
PasswordPolicy policy;
if (user.IsAdmin)
{
policy = new MerchantPasswordPolicy();
}
else
{
policy = new CustomerPasswordPolicy();
}
if (user.IsLockedOut)
{
if (user.LastLockoutDate >= LocaleHelper.LocalNow.AddMinutes(-1 * policy.LockoutPeriod))
{
//STILL LOCKED OUT
// BUG # 6688 (DONT RESET THE LOCKOUT TIME IF ACCOUNT ALREADY LOCKED)
// ALSO IGNORE THE LOGIN ATTEMPTS
//if (!isPasswordValid)
//{
// user.LastLockoutDate = LocaleHelper.LocalNow;
// user.FailedPasswordAttemptCount += 1;
// user.Save();
//}
return(AuditLogin_AccountLocked(user));
}
user.IsLockedOut = false;
}
if (isPasswordValid)
{
user.FailedPasswordAttemptCount = 0;
user.LastLoginDate = LocaleHelper.LocalNow;
user.Save();
return(AuditLogin_Success(user));
}
else
{
user.FailedPasswordAttemptCount += 1;
if (user.FailedPasswordAttemptCount >= policy.MaxAttempts)
{
user.IsLockedOut = true;
// RESET THE FAILED ATTEMPTS COUNT
user.FailedPasswordAttemptCount = 0;
user.LastLockoutDate = LocaleHelper.LocalNow;
}
user.Save();
return(AuditLogin_InvalidPassword(user));
}
}