/// <summary>
/// Validates a user by making sure their username and password are correct in the system. Regardless of the web.config settings,
/// the password information (salt, format) are taken from the database and then compared
/// </summary>
/// <param name="username">Unique username</param>
/// <param name="password">Password to be compared against database.</param>
/// <returns>true if user entered valid information</returns>
public override bool ValidateUser(string username, string password)
{
//Validate the username and password being entered
if (!SecUtility.ValidateParameter(ref username,
true,
true,
false,
255))
{
return(false);
}
if (!SecUtility.ValidateParameter(ref password,
true,
true,
false,
128))
{
return(false);
}
int status;
return(CheckPassword(username, password, out status));
}
public static MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
{
if (!SecUtility.ValidateParameter(ref username, true, true, true, 0))
{
status = MembershipCreateStatus.InvalidUserName;
return(null);
}
if (!SecUtility.ValidatePasswordParameter(ref password, 0))
{
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
if (!SecUtility.ValidateParameter(ref email, false, false, false, 0))
{
status = MembershipCreateStatus.InvalidEmail;
return(null);
}
if (!SecUtility.ValidateParameter(ref passwordQuestion, false, true, false, 0))
{
status = MembershipCreateStatus.InvalidQuestion;
return(null);
}
if (!SecUtility.ValidateParameter(ref passwordAnswer, false, true, false, 0))
{
status = MembershipCreateStatus.InvalidAnswer;
return(null);
}
return(Provider.CreateUser(username, password, email, passwordQuestion, passwordAnswer, isApproved, providerUserKey, out status));
}
/// <summary>
/// Adds a new role to the data source for the configured applicationName.
/// </summary>
/// <param name="roleName">The name of the role to create.</param>
public override void CreateRole(string roleName)
{
if (roleName.IndexOf(',') > 0)
{
throw new ArgumentException("Role names cannot contain commas.");
}
if (RoleExists(roleName))
{
throw new ProviderException("Role name already exists.");
}
if (!SecUtility.ValidateParameter(ref roleName, true, true, false, MAX_ROLENAME_LENGTH))
{
throw new ProviderException(
String.Format("The role name is too long: it must not exceed {0} chars in length.",
MAX_ROLENAME_LENGTH));
}
SQLiteConnection cn = GetDbConnectionForRole();
try
{
using (SQLiteCommand cmd = cn.CreateCommand())
{
cmd.CommandText = "INSERT INTO " + ROLE_TB_NAME
+ " (RoleId, RoleName, LoweredRoleName, ApplicationId) "
+ " Values ($RoleId, $RoleName, $LoweredRoleName, $ApplicationId)";
cmd.Parameters.AddWithValue("$RoleId", Guid.NewGuid().ToString());
cmd.Parameters.AddWithValue("$RoleName", roleName);
cmd.Parameters.AddWithValue("$LoweredRoleName", roleName.ToLowerInvariant());
cmd.Parameters.AddWithValue("$ApplicationId", _applicationId);
if (cn.State == ConnectionState.Closed)
{
cn.Open();
}
cmd.ExecuteNonQuery();
}
}
finally
{
if (!IsTransactionInProgress())
{
cn.Dispose();
}
}
}
public override bool ValidateUser(string username, string password)
{
if (SecUtility.ValidateParameter(ref username, true, true, true, 256) &&
SecUtility.ValidateParameter(ref password, true, true, false, 128) &&
CheckPassword(username, password, true))
{
// Comment out perf counters in sample: PerfCounters.IncrementCounter(AppPerfCounter.MEMBER_SUCCESS);
// Comment out events in sample: WebBaseEvent.RaiseSystemEvent(null, WebEventCodes.AuditMembershipAuthenticationSuccess, username);
return(true);
}
else
{
// Comment out perf counters in sample: PerfCounters.IncrementCounter(AppPerfCounter.MEMBER_FAIL);
// Comment out events in sample: WebBaseEvent.RaiseSystemEvent(null, WebEventCodes.AuditMembershipAuthenticationFailure, username);
return(false);
}
}
/// <summary>
/// Creates a user from the given parameters and settings in the web.config (under the membership section)
/// </summary>
/// <param name="username">Kerberos LoginID of the user who created the account (or string.empty)</param>
/// <param name="password">Password -- complexity determined by web.config settings</param>
/// <param name="email">Email entered by user</param>
/// <param name="passwordQuestion"></param>
/// <param name="passwordAnswer"></param>
/// <param name="isApproved"></param>
/// <param name="providerUserKey">Not used since username is always unique, we can look up with UserID when necessary</param>
/// <param name="status"></param>
/// <returns>A representation of the current user's membership information</returns>
public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
{
//if the username is SELFCREATED, set it to empty so that we know it was not created on a Kerberos user's behalf
if (username == "SELFCREATED")
{
username = string.Empty;
}
//Make sure the password is non-null or empty (excluding white space)
if (!SecUtility.ValidateParameter(ref password, true, true, false, 0))
{
//If the password is invalid, return the correct status
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
//Check that the password meets all requirements laid out in the web.config
if (password.Length < MinRequiredPasswordLength)
{
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
int count = 0;
for (int i = 0; i < password.Length; i++)
{
if (!char.IsLetterOrDigit(password, i))
{
count++;
}
}
if (count < MinRequiredNonAlphanumericCharacters)
{
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
if (PasswordStrengthRegularExpression.Length > 0)
{
if (!Regex.IsMatch(password, PasswordStrengthRegularExpression))
{
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
}
//Validate with email as the username
ValidatePasswordEventArgs e = new ValidatePasswordEventArgs(email, password, true);
OnValidatingPassword(e);
if (e.Cancel)
{
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
//Generate a salt of length SALT_SIZE_IN_BYTES
string salt = GenerateSalt();
//Encodes the password using the method defined in the web.config membership section (clear, hashed, or encrypted)
//If method = hashed, then the algortihm defined by the HashAlgorithmType key is used
string encodedPassword = EncodePassword(password, (int)_PasswordFormat, salt);
//Make sure the password isn't too long (if it is, it will not fit in the database
if (encodedPassword.Length > 128)
{
status = MembershipCreateStatus.InvalidPassword;
return(null);
}
//Check the email, question, answer (only the last two if they are required in the web.config)
//if (!SecUtility.ValidateParameter(ref username, true, true, true, 255))
//{
// status = MembershipCreateStatus.InvalidUserName;
// return null;
//}
if (!SecUtility.ValidateParameter(ref email,
RequiresUniqueEmail,
RequiresUniqueEmail,
false,
128))
{
status = MembershipCreateStatus.InvalidEmail;
return(null);
}
if (!SecUtility.ValidateParameter(ref passwordQuestion,
RequiresQuestionAndAnswer,
true,
false,
255))
{
status = MembershipCreateStatus.InvalidQuestion;
return(null);
}
if (!SecUtility.ValidateParameter(ref passwordAnswer,
RequiresQuestionAndAnswer,
true,
false,
128))
{
status = MembershipCreateStatus.InvalidAnswer;
return(null);
}
_dops.ResetDops();
_dops.Sproc = "usp_InsertAccount";
_dops.SetParameter("@LoginID", username, "IN"); //KerberosID of user that created this account (null if created by applicant)
_dops.SetParameter("@Email", email, "IN");
_dops.SetParameter("@Password", encodedPassword, "IN");
_dops.SetParameter("@PasswordFormat", (int)PasswordFormat, "IN");
_dops.SetParameter("@PasswordSalt", salt, "IN");
_dops.SetParameter("@PasswordQuestion", passwordQuestion, "IN");
_dops.SetParameter("@PasswordAnswer", passwordAnswer, "IN");
_dops.SetParameter("@CreateStatus", string.Empty, "OUT");
_dops.SetParameter("RETURN_VALUE", string.Empty, "RETURN");
try
{
_dops.Execute_Sql();
}
catch (SqlException)
{
status = MembershipCreateStatus.ProviderError;
return(null);
}
//If the return value is not 0 (success), inspect the error and return it to the user
if ((int)_dops.GetOutputVariable("RETURN_VALUE") != 0)
{
switch ((string)_dops.GetOutputVariable("@CreateStatus"))
{
case "InvalidLogin":
status = MembershipCreateStatus.DuplicateUserName;
break;
case "InvalidEmail":
status = MembershipCreateStatus.DuplicateEmail;
break;
default:
status = MembershipCreateStatus.ProviderError;
break;
}
return(null);
}
else
{
//No error, so go ahead and return success
DateTime dt = DateTime.Now;
status = MembershipCreateStatus.Success;
return(new MembershipUser(this.Name,
username,
null,
email,
passwordQuestion,
string.Empty,
isApproved,
false,
dt,
dt,
dt,
dt,
DateTime.MinValue));
}
}
public string CreateUser(Oper oper)
{
string password = oper.cnvcPwd;
string username = oper.cnvcOperName;
if (!SecUtility.ValidateParameter(ref password, true, true, false, 128))
{
return(MyMembershipCreateStatus.InvalidPassword);
}
//string salt = GenerateSalt();
string pass = EncodePassword(oper.cnvcPwd);
if (pass.Length > 128)
{
return(MyMembershipCreateStatus.InvalidPassword);
}
if (!SecUtility.ValidateParameter(ref username, true, true, true, 256))
{
return(MyMembershipCreateStatus.InvalidUserName);
}
if (oper.cnvcPwd.Length < MinRequiredPasswordLength)
{
return(MyMembershipCreateStatus.InvalidPassword);
}
int count = 0;
for (int i = 0; i < oper.cnvcPwd.Length; i++)
{
if (!char.IsLetterOrDigit(oper.cnvcPwd, i))
{
count++;
}
}
if (count < MinRequiredNonAlphanumericCharacters)
{
return(MyMembershipCreateStatus.InvalidPassword);
}
if (PasswordStrengthRegularExpression.Length > 0)
{
if (!Regex.IsMatch(oper.cnvcPwd, PasswordStrengthRegularExpression))
{
return(MyMembershipCreateStatus.InvalidPassword);
}
}
oper.cnvcPwd = pass;
DataTable dtOper = SqlHelper.ExecuteDataTable(CommandType.Text, "select * from tbOper where cnvcOperName = '" + oper.cnvcOperName + "'");
if (dtOper.Rows.Count > 0)
{
return(MyMembershipCreateStatus.DuplicateUserName);
}
if (oper.cnvcCardNo.Length > 0)
{
DataTable dtCard = SqlHelper.ExecuteDataTable(CommandType.Text, "select * from tbOper where cnvcCardNo = 'aaa" + oper.cnvcCardNo + "'");
if (dtCard.Rows.Count > 0)
{
return(MyMembershipCreateStatus.DuplicateCardNo);
}
CardM1 m1 = new CardM1();
string strReturn = m1.PutOutCard("aaa" + oper.cnvcCardNo);
if (strReturn.Equals("OPSUCCESS"))
{
oper.cnvcCardNo = "aaa" + oper.cnvcCardNo;
EntityMapping.Create(oper);
}
else
{
return(MyMembershipCreateStatus.CardOperException);
}
}
else
{
EntityMapping.Create(oper);
}
return(MyMembershipCreateStatus.Success);
}