DNN Forums

Ask questions about your website to get help learning DNN and help resolve issues.
Prev
Next

Auto Login

Forums > Building DNN Modules, Providers etc.
Sort:
You are not authorized to post a reply.





John Svoboda

New Around Here



Posts:7
New Around Here




7/12/2022 11:06 AM

    I'm trying to automatically log in a user that is coming from another portal where they were already logged in. I pass an ID value that allows me to retrieve the username and password from an external table that I use for authentication. When logging in normally I use ICG's External Database Authentication provider.

    After retrieving the username and password, I attempt to use UserController.ValidateUser and upon success UserController.UserLogin. It keeps returning LOGIN_FAILURE on validation as the status. However, when I pass the login information for my host account it works, and logs in the host account. 

    One of the parameters for Validation is the AuthType. I've tried both the default "DNN" and "ICGCustom" which is the authtype for the ICG provider. Host account only works when using "DNN".

    Any thoughts would be appreciated.






    John Svoboda

    New Around Here



    Posts:7
    New Around Here




    7/12/2022 12:12 PM
      OK, so I have figured out the first half of my issue. The ICG provider authenticates off my external security database. Then logs the corresponding user from asp.net_membership table. However, it must be doing so without passing the password which did not match what is in my external database. I updated the password in DNN for my test account and after doing so it works. Now I just need to figure out how they are doing that.





      John Svoboda

      New Around Here



      Posts:7
      New Around Here




      7/12/2022 12:49 PM

        I found the following post which gave me my answer...

        https://stackoverflow.com...ssword-in-dotnetnuke

        Apparently the UserController.UserLogin does not require that the password be supplied in the UserInfo passed to it. This surprised me.






        Timo Breumelhof (40F)

        Veteran Member



        Posts:1096
        Veteran Member




        7/12/2022 2:34 PM
          Posted By John Svoboda on 12 Jul 2022 01:49 PM

          I found the following post which gave me my answer...

          https://stackoverflow.com...ssword-in-dotnetnuke

          Apparently the UserController.UserLogin does not require that the password be supplied in the UserInfo passed to it. This surprised me.

          Well, you should realise this method is probably used to login users the already have been authenticated.
          (which can be done using one of the DNN or a custom provider, so on "another level")
          Also as this is server side code, if an attacker / user can get to the point where they can execute this kind of code, they can already do whatever they want.
           

           

           

          40FINGERS Web Solutions · Style Helper · DDR Menu Demo Skins · SEO Redirect
          You are not authorized to post a reply.

          These Forums are dedicated to the discussion of DNN Platform.

          For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

          1. If you have (suspected) security issues, please DO NOT post them in the forums but instead follow the official DNN security policy. 
          2. No Advertising. This includes the promotion of commercial and non-commercial products or services which are not directly related to DNN.
          3. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
          4. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
          5. No Flaming or Trolling.
          6. No Profanity, Racism, or Prejudice.
          7. Site Moderators have the final word on approving / removing a thread or post or comment.
          8. English language posting only, please.

          Would you like to help us?

          Awesome! Simply post in the forums using the link below and we'll get you started.

          Get Involved