AltairisWebSecurity Work Item Rss Feed

Closed Issue: SimpleSqlProfileProvider is not Unicode compatible [33674]

altair — Thu, 17 Jan 2013 15:17:45 GMT

KeyValue column (where the User Name is stored) is getting its value via a varchar type parameter instead of nvarchar. That means if one needs to provide Unicode characters as user name it will strip some useful characters from that.
Comments: That's one of the reasons why it's deprecated and not recommended to be used anymore. Use http://code.msdn.microsoft.com/aspnet4profile

Created Issue: SimpleSqlProfileProvider is not Unicode compatible [33674]

denes — Thu, 17 Jan 2013 12:55:43 GMT

Created Issue: UserID in RoleMemberships Table [32976]

merarischroeder — Fri, 27 Jul 2012 06:18:38 GMT

You support userKeyType="IntIdentity", which is great for linking the user throughout the rest of the DB, however it would be beneficial if this was:

1) Supported by the RoleProvider - perhaps also requiring userKeyType="IntIdentity". That is, supported UserId instead of UserName column.
2) (The default, surrogate keys are the bomb!)

This should help by making UserNames (as well as Email addresses) completely fluid without impacting the DB integrity.

Cheers!

Commented Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

altair — Mon, 20 Feb 2012 21:46:46 GMT

Hi,

First off - thanks so much for making this toolkit. I use it on tons of projects to help make memberships even earlier to use :)

I have a small issue trying to create a user when my database is generated using Migrations (EF 4.3).

I receive the following error:
The password-answer supplied is invalid.

My code is:
internal sealed class Configuration : DbMigrationsConfiguration<MyProject.Data.DataContext>
{
public Configuration()
{
AutomaticMigrationsEnabled = true;
}

protected override void Seed(MyProject.Data.DataContext context)
{
// create default User
MembershipCreateStatus status = new MembershipCreateStatus();
User admin = context.Users.Find("TestGuy");
if (admin == null)
{
Membership.CreateUser("TestGuy", "TestGuy123", "testguy@test.com");
if (status == MembershipCreateStatus.Success)
{
admin.Firstname = "Test";
admin.Surname = "Guy";
admin.DateLastActivity = DateTime.Now;
admin.LastActivityRoute = "/Home/Index";
Role adminRole = context.Roles.Find("Administrator");
admin.Roles = new List<Role>();
admin.Roles.Add(adminRole);
}
}
context.SaveChanges();
}
}

The thing is - I don't set one up on the create user call so I'm wondering how I could bypass this option. I have also set requiresQuestionAndAnswer="false" in my web.config on the TableMembershipProvider tag.

I have this question open over at StackOverflow.com -

http://stackoverflow.com/questions/9326115/how-can-i-create-a-user-account-in-my-user-table-using-entity-framework-migratio

Any ideas on how to overcome this would be very handy as all my projects have one super user access setup for me so I can manage the projects for my clients.

Thanks for your help!

Regards,
Rich
Comments: ** Comment from web user: altair **

Honestly, I don't think it's the right and supported way, to try create users from database seeding, especially when the seeding is supposed to work in non-web environments. I would recommend you to bypass the provider and seed the raw data to database.

But I didn't had yet enough time to look into EF 4.3, so take it 'grano salis'.

Commented Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

onimusha_kiyoko — Mon, 20 Feb 2012 20:27:15 GMT

Hi again,

Thanks for your updates. I have managed to get this working by settings the initial user to be created when the user first goes to the Account/Logon page instead of in the database initializer. It's a bit of a shame that the EF 4.3 Seed options don't play nice with memberships. I'm sure they'll sort it out soon or someone else will post a work around.

You're right through, this is not an issue with your provider. This is an issue trying to use the provider with the EF migrations code.

Thanks for your time.

Regards,
Rich

Commented Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

altair — Mon, 20 Feb 2012 16:44:58 GMT

I don't understand the EF database migration and the mechanism is completely unrelated to my providers, which do not have anything in common with EF. So maybe the problem is in context where the provider methods are called.

Can you please provide me with some simple but complete project I can take a look on?

Commented Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

onimusha_kiyoko — Mon, 20 Feb 2012 11:11:22 GMT

My code was not correct in my previous post and I am unable to edit. Please see below for current code. As mentioned, this compiles and database is initialized but no user is created in the User table for me.

// create default User
MembershipCreateStatus status;
User admin = context.Users.Find("TestGuy");
if (admin == null)
{
Membership.CreateUser("TestGuy", "TestGuy123", "testguy@test.com", null, null, true, out status);
if (status == MembershipCreateStatus.Success)
{
admin = context.Users.Find("TestGuy");
admin.Firstname = "Test";
admin.Surname = "Guy";
admin.DateLastActivity = DateTime.Now;
admin.LastActivityRoute = "/Home/Index";
Role adminRole = context.Roles.Find("Administrator");
admin.Roles = new List<Role>();
admin.Roles.Add(adminRole);
}
}

Commented Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

onimusha_kiyoko — Mon, 20 Feb 2012 10:04:34 GMT

Thanks for coming back to me on this issue. I have altered my code so that now it compiles and EF 4.3 runs without any errors but no user is not generated. Any ideas what this could be?

Thanks again for your help with this.

// create default User
MembershipCreateStatus status;
User admin = context.Users.Find("TestGuy");
if (admin == null)
{
Membership.CreateUser("TestGuy", "TestGuy123", "testguy@test.com", null, null, true, out status);
if (status == MembershipCreateStatus.Success)
{
admin.Firstname = "Test";
admin.Surname = "Guy";
admin.DateLastActivity = DateTime.Now;
admin.LastActivityRoute = "/Home/Index";
Role adminRole = context.Roles.Find("Administrator");
admin.Roles = new List<Role>();
admin.Roles.Add(adminRole);
}
}

Commented Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

altair — Fri, 17 Feb 2012 14:54:15 GMT

In your code you don't fill the 'status' variable anywhere -- you just initialize it. That's the first problem I see.

Created Issue: How to use Altairis with Entity Framework 4.3 Migrations? [32273]

onimusha_kiyoko — Fri, 17 Feb 2012 14:24:17 GMT

Hi,

First off - thanks so much for making this toolkit. I use it on tons of projects to help make memberships even earlier to use :)

I have a small issue trying to create a user when my database is generated using Migrations (EF 4.3).

I receive the following error:
The password-answer supplied is invalid.

My code is:
internal sealed class Configuration : DbMigrationsConfiguration<MyProject.Data.DataContext>
{
public Configuration()
{
AutomaticMigrationsEnabled = true;
}

protected override void Seed(QSatCRM.Data.DataContext context)
{
// create default User
MembershipCreateStatus status = new MembershipCreateStatus();
User admin = context.Users.Find("TestGuy");
if (admin == null)
{
Membership.CreateUser("TestGuy", "TestGuy123", "testguy@test.com");
if (status == MembershipCreateStatus.Success)
{
admin.Firstname = "Test";
admin.Surname = "Guy";
admin.DateLastActivity = DateTime.Now;
admin.LastActivityRoute = "/Home/Index";
Role adminRole = context.Roles.Find("Administrator");
admin.Roles = new List<Role>();
admin.Roles.Add(adminRole);
}
}
context.SaveChanges();
}
}

The thing is - I don't set one up on the create user call so I'm wondering how I could bypass this option. I have also set requiresQuestionAndAnswer="false" in my web.config on the TableMembershipProvider tag.

I have this question open over at StackOverflow.com -

http://stackoverflow.com/questions/9326115/how-can-i-create-a-user-account-in-my-user-table-using-entity-framework-migratio

Any ideas on how to overcome this would be very handy as all my projects have one super user access setup for me so I can manage the projects for my clients.

Thanks for your help!

Regards,
Rich

Commented Issue: VerifyPasswordHash missing argument checks [32089]

AlesR — Wed, 18 Jan 2012 10:41:07 GMT

Method VerifyPasswordHash is missing argument checks for null for storedHash and storedSalt.

Proposed code is in attached file.

Also
if (storedSalt.Length != 128) throw new ArgumentException("Invalid length of password salt (128 bytes expected).", "passwordHash");
should be
if (storedSalt.Length != 128) throw new ArgumentException("Invalid length of password salt (128 bytes expected).", "storedSalt");
Comments: ** Comment from web user: AlesR **

Yes, this does not really affect toolkit behavior. There is no way for arguments to be wrong.
It's just that when you're testing arguments, I would think that you will test everything.
It also includes one typo, but this is very minor. Maybe not worth opening Visual Studio. For that reason I've also proposed the code so it's zero work for you.
I'm done, it's your call.

Closed Issue: VerifyPasswordHash missing argument checks [32089]

altair — Wed, 18 Jan 2012 10:02:35 GMT

There is no legitimate way incorrect value can be stored in the database in first place. The only way this can happen is that someone fiddles with database and in such case anything may happen - anything can be null, fields can be renamed or having wrong type... There is no way how to handle that, once someone starts corrupting real data.

Created Issue: VerifyPasswordHash missing argument checks [32089]

AlesR — Wed, 18 Jan 2012 08:41:07 GMT

Method VerifyPasswordHash is missing argument checks for null for storedHash and storedSalt.

Proposed code is in attached file.

Closed Issue: Misnamed configuration name minRequiredNonAlphanumericCharacters [31931]

altair — Sun, 18 Dec 2011 23:06:36 GMT

This configuration name (minRequiredNonAlphanumericCharacters) must be renamed to minRequiredNonalphanumericCharacters
"a" in alphanumeric must be in lower case..
AspNetSqlMembershipProvider works this way.. also it must be defaulted to 0
Comments:

The naming is quite inconsistent, considering mapping between property and configuration attribute, so I decided to play safe and allow both capitalization variants. Fixed in 2.4.3

Created Issue: Configuration Name minRequiredNonAlphanumericCharacters [31931]

arash16 — Mon, 12 Dec 2011 21:44:24 GMT

This configuration name (minRequiredNonAlphanumericCharacters) must be renamed to minRequiredNonalphanumericCharacters
a in alphanumeric must be in lower case..
AspNetSqlMembershipProvider works this way.. also it must be defaulted to 0

Commented Issue: Membership.UpdateUser fails when user.Comment == null [31864]

GrantHeaslip — Thu, 01 Dec 2011 16:45:23 GMT

(Please forgive me if I’m missing something obvious — I'm quite new to C# and ASP.NET!)

When I run Membership.UpdateUser(user) when user.Comment == null, I get a System.Configuration.Provider.ProviderException “Error while performing database query.” The InnerException is System.Data.SqlClient.SqlException “The parameterized query '(@UserName nvarchar(5),@Email nvarchar(18),@Comment nvarchar(400' expects the parameter '@Comment', which was not supplied.”

Membership.CreateUser sets the comment field to null, so it seems to me that the provider’s query shouldn’t be assuming it has a value.

I’m not 100% sure, but I believe UpdateUser wasn’t doing this in 2.4.0, and has started in 2.4.1. It’s trivial to ensure that the comment field isn’t null, but it shouldn’t be necessary.

Thanks!
Comments: ** Comment from web user: GrantHeaslip **

Perfect, and thanks for the great library!

Closed Issue: Membership.UpdateUser fails when user.Comment == null [31864]

altair — Thu, 01 Dec 2011 12:32:54 GMT

Commented Issue: Membership.UpdateUser fails when user.Comment == null [31864]

altair — Thu, 01 Dec 2011 12:32:40 GMT

Will be fixed in 2.4.2

Created Issue: Membership.UpdateUser fails when user.Comment == null [31864]

GrantHeaslip — Thu, 01 Dec 2011 03:48:45 GMT

Closed Issue: Can not use, if Users table is called "User" [31246]

altair — Fri, 12 Aug 2011 12:01:58 GMT

I think that is because User is reserved word in sql and it is not placed into [].
Comments:

I think you are right. I added code to automatically quote all entered table names. It would be included in next release, in meantime please download and compile latest version from source code tab.