ASP Form Authentication

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

Please do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.

This forum is for discussing mojoPortal development

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

You can monitor commits to the repository from this page. We also recommend developers to subscribe to email notifications in the developer forum as occasionally important things are announced.

Before posting questions here you might want to review the developer documentation.

Do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.
This thread is closed to new posts. You must sign in to post in the forums.
1/8/2007 12:18:24 PM
Gravatar
Total Posts 80

ASP Form Authentication

First off I am new to ASP.net development.

The documentation I've found for ASP form authentication recommends to have the "loginURL" attribute set in the web.config:

        <authentication mode="Forms">
            <forms name=".ASPXAUTH" loginUrl="Login.aspx" protection="All" timeout="60" />
        </authentication>

The documentation states that attempts to access an unauthorized page will redirect to the the "loginUrl" and after successful login the user will be redirected to the page they were trying to access. For example if the user attempted to access "Foobar.aspx" when they were not logged in they would be redirected to "Login.aspx" and if they successfully log in they would be automatically redirected to "Foobar.aspx". Mojo dumps the user back on the welcome page. Why was the built in automatic redirection not utilized in Mojo and how do you recommend I enable it?

Modifing the web.config file as in the above example does not have an effect on Mojo.  Mojo just takes the user the the "Access Denied" page.

Regards,
Jesse

1/8/2007 12:46:35 PM
Gravatar
Total Posts 18439

Re: ASP Form Authentication

Automatic redirection to the login page based on the loginUrl attribute only works if you are using simple declarative security in web.config using location and authorization elements and usually hard coding user names in web.config like in this tutorial.

Declarative security while simpler is not compatible with a content management system where the "pages" come from the database and don't neccessarily exist on disk and where users and roles are coming from the database as well.

All pages in mojoPortal have permission for view and edit by roles so its not just a question of is the user logged in and re-directing to the login page. In mojoPortal permissions are checked in code and if the user is not logged in and also in a role with permission they are re-directed to the access denied page.

There is some redirection logic for after login but not when the access is denied. Whatever page you are on when you click the login link, is the page you will be returned to after you login. So for example I may be reading the forum but I can't reply because I'm not logged in, I click the login link and when I login I'm redirected back to the page in the forums where I was and now I can reply. This is the natural flow in mojoPortal, I could be on any page in the site and I don't see the edit links, I decide to edit so I need to login and it always takes me back to the page I want to edit.

Its just not a valid assumption in mojoPortal that Access denied is because the user is not logged in and no reason to assume if the user logs in that they will have permission to access the resource that produced the access denied error.

Hope it helps,

Joe
1/8/2007 1:37:37 PM
Gravatar
Total Posts 80

Re: ASP Form Authentication

How do you purpose handling the case where a user bookmarks a page requiring authentication? I believe it is an important use case in situations where a page is difficult to navigate to so the user bookmarks it. It would be nice to present a login page to the user and then take the user to the bookmarked page after authentication...assuming they have access to that page.

Perhaps something like the following each time a user requests a page?

    if (!HttpContext.Current.User.Identity.IsAuthenticated) // user isn't logged in
       goto login page, authenticate, goto bookmarked page;
    else if (!have proper permissions) // user doesn't have permissions
       goto access denied page;
    else
       goto page;
 
-Jesse
1/9/2007 3:55:27 AM
Gravatar
Total Posts 18439

Re: ASP Form Authentication

I'll look into doing something similar.

Thanks,

Joe
1/9/2007 8:28:37 AM
Gravatar
Total Posts 18439

Re: ASP Form Authentication

I've implemented something similar to this, it is available now in svn branches/2.x

I plan to make a new release this weekend, if you have any chance to test the svn version and provide feedback between now and then it would be much appreciated.

Thanks,

Joe
1/9/2007 12:42:49 PM
Gravatar
Total Posts 80

Re: ASP Form Authentication

I tested and it works as requested. Thanks again.

-Jesse
You must sign in to post in the forums. This thread is closed to new posts.