Extending Membership Provider

I'm attempting to extend the default membership provider to allow user validation against the sitefinity database as well as an external database, assuming the default validation against the sitefinity database fails.  I have created a CustomMembershipProvider extending OpenAccessMembershipProvider.  I registered this custom membership provider in the backend (Administration -> Settings -> Advanced -> Security -> Membership Providers) and I set the MembershipProvider property of the Login control to use the CustomMembershipProvider.  I have overridden the ValidateUser method and I can set a breakpoint and step into it, but base.ValidateUser(username, password) always returns false.  Is base.ValidateUser no longer going against the original datasource?

Hi Greg,

If the user and password exist in the data source the method should return true. ValidateUser returns false if the Telerik.Sitefinity.Security.Model.User object is not found or the username and password do not match. Another reason could be if the user is not approved or it has been locked.

All the best,
Ivan Dimitrov
the Telerik team

When I change the MembershipProvider property of the Login control back to empty, it allows me to login with a valid Sitefinity login, so that rules out the account being locked or the login being invalid.  This makes me believe the custom membership provider is somehow not configured correctly.  Also, because I am able to breakpoint in the overridden method, I know that it is at least able to find the custom class.  Is there any necessary configuration not listed in the original post that I am missing or would cause the Telerik.Sitefinity.Security.Model.User object to not be found?

Thanks.

Hello Greg,

If you query an external database and you call base.ValidateUser this will not work, because the base method uses our hash algorithms to encrypt/decrypt the password and get the user. I tried the Login control with two Membership providers and I was able to authenticate the users. I made a query to another database with my custom provider, but in this case I was not calling the base of ValidateUser and I had my custom logic.

Anyway if you can share the implementation with us I could try to come up with more details. You can also paste the provider registration that is saved inside App_Data/Sitefinity/Configuration/SecurityConfig.config.

Kind regards,
Ivan Dimitrov
the Telerik team

I'm sorry.  Maybe I wasn't clear in my goal.  I want to first attempt authentication with the Sitefinity DB and if that fails, I want to attempt authentication against an external DB.

I have, however, resolved the issue.  I changed DefaultBackendMembershipProvider property in Advanced Security settings (Administration -> Settings -> Advanced -> Security) to the name of my custom membership provider and initial validation now correctly works when using the Sitefinity DB.

Thank you for your help.

Hi,
How can I  "set the MembershipProvider property of the Login control to use the CustomMembershipProvider".
My problem was I deleted the admin user of Sitefinity and there's no way for me to login. So I came up to that possible solution but can't find the login control. Thanks!

Hi,

you have to edit SecurityConfig.config, an example with your  CustomMembershipProvider :

Thanks Nicolas! :)