problem with custom membership provider

[Ben]

Hi,

i have already posted a more or less similar thread but it's gone unsolved
with the flow of the other threads ..

When an anonymous user has created an new account (with the CreateUserWizard
control), i want to let asp.net generate a password and to send it
(AutoGeneratePassword="true") to the address of the email provided by the
new membershipuser in the CreateUserWizard control.

So i defined a custom provider for membership with this code:

web.config:
-----------
<connectionStrings>
<add name="aspnetdb" connectionString="Data
Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\ASPNETDB.MDF;Integrated
Security=True;User Instance=True" providerName="System.Data.SqlClient"/>
</connectionStrings>

<authentication mode="Forms" />

<membership defaultProvider="MyMembershipProvider">
<providers>
<add name="MyMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="aspnetdb"
enablePasswordRetrieval="true"
enablePasswordReset="true"
passwordFormat="Encrypted"
requiresQuestionAndAnswer="true"
applicationName="/"
/>
</providers>
</membership>

code-behind:
------------
Protected Sub Page_Load(ByVal sender As Object, ByVal e As
System.EventArgs) Handles Me.Load
If User.Identity.IsAuthenticated Then
Dim pw As String
pw = Membership.GetUser.GetPassword.ToString
End If
End Sub

But this generate the error:
"You must specify a non-autogenerated machine key to store passwords in the
encrypted format. Either specify a different passwordFormat, or change the
machineKey configuration to use a non-autogenerated decryption key."

at line "pw = Membership.GetUser.GetPassword.ToString"

Changing in "hashed" is not an option because it's not retrievable and
"clear" is not safe.
So if anyone could explain me how to solve this, it would make my day.
Thanks
Ben

 

[Guest]

Ben,
The exception message is telling you what to do: the machinekey element in
your web.config needs to specify key and not use the autogenerated option.

Here is an article that explains:

http://www.eggheadcafe.com/articles/20030514.asp

Peter

 

[Ben]

Peter,

thanks for replying, but i'm not sure how to fix my problem.
i must use a non-autogenerated decryption key, so this is my attempt:,
without understanding what i'm doing ...I found the hex code on the
microsoft site.
I don't know either which validation to choose (SHA1 or MD5 or ...).

This gives the error: "Validation key specified has invalid hex characters"
If you could give me some hints
Further, i couldn't read anywhere that one must use a non-autogenerated
decryption key in this case. Why is it so?

Thanks

<machineKey
validationKey="21F090935F6E49C2C797F69BBAAD8402ABD2EE0B667A8B44EA7DD4374267A75D7AD972A11
9482D15A4127461DB1DC347C1A63AE5F1CCFAACFF1B72A7F0A281B"
decryptionKey="ABAA84D7EC4BB56D75D217CECFFB9628809BDB8BF91CFCD64568A145BE59719F"
validation="SHA1"
decryption="Auto"
/>

 

[Guest]

Generally what I do is let the user choose their own password. (After all,
how many passwords do you want to have to remember?). Then, the email has a
link which takes them to a page that makes their account active.
Peter

--
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short urls & more: http://ittyurl.net

 

[Ben]

This is a possibility, of course, but not an answer to my problem.
Ben