Using E-mail for Sign In w/ LDAP Fallback Authentication

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

Please do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.

This forum is for discussing mojoPortal development

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

You can monitor commits to the repository from this page. We also recommend developers to subscribe to email notifications in the developer forum as occasionally important things are announced.

Before posting questions here you might want to review the developer documentation.

Do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.
This thread is closed to new posts. You must sign in to post in the forums.
3/30/2012 10:47:42 AM
Gravatar
Total Posts 156

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

Sure, but I don't think the purpose of replacement line has changed :).  Why did you want to make sure that user Id and e-mail address were different then, but not now?  I think that's because that's usually what you will want and in our case we would love to have a different user id as well if possible.

3/30/2012 10:57:44 AM
Gravatar
Total Posts 18439

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

look, I've tried to accomodate you but I'm getting tired of arguing with you.

That comment was before .NET 2, before support for LDAP. If we were setting the auth cookie I'd have gone along with allowing email and ldap together but I'm not changing that now.

If it is still important for userid to not be the same (I'm not so sure it is, they each must be unique per site but I don't see a big reason why they cannot be the same value for a given user) I would implement it different today perhaps with a custom validator on the registration page, but that would not solve the problem you are trying to solve for your 30 or so users that need to login without ldap using their email address. How about update their user ids to their email address and move on? Why must you keep arguing with me?

3/30/2012 11:15:11 AM
Gravatar
Total Posts 156

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

I'm arguing with you because I'm told to replicate the e-mail in two different fields under user profile as a "solution" to my problem when it really isn't. The user IDs for those 35 users were taken out of our donors database and we need those user IDs because of a module I'm working on which would use that database.

I understand that you don't manually set the authorization cookie and that you let ASP.NET security framework take care of that, but I also know that this can be addressed and I'm willing to help.

I think the biggest issue here is that even though this is an open source product, the actual development of the entire CMS is fairly closed in the sense that it's not common practice for people to fork, make changes, and make pull requests. So essentially, one has to either fork the project and maintain his/her own fork, continually merging your changes into the fork or try and convince you first to avoid a situation where changes have been made, but you won't commit them.

3/30/2012 11:35:34 AM
Gravatar
Total Posts 18439

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

I'm arguing with you because I'm told to replicate the e-mail in two different fields under user profile as a "solution" to my problem when it really isn't. The user IDs for those 35 users were taken out of our donors database and we need those user IDs because of a module I'm working on which would use that database.

You could solve that problem in your feature by using a custom table to relate those ids.

I understand that you don't manually set the authorization cookie and that you let ASP.NET security framework take care of that, but I also know that this can be addressed and I'm willing to help.
I think the biggest issue here is that even though this is an open source product, the actual development of the entire CMS is fairly closed in the sense that it's not common practice for people to fork, make changes, and make pull requests. So essentially, one has to either fork the project and maintain his/her own fork, continually merging your changes into the fork or try and convince you first to avoid a situation where changes have been made, but you won't commit them.

You have a mythological view that all open source projects should be or are run a particular way. I'm not going to defend myself against that, I run this project my way, it is tightly controlled and that is my perogative, I've always been clear about that, I've never said its open for any or all changes to get in. I accept changes that I'm willing to accept or I reject proposals for many reasons that make sense to me. I'm not willing to make this change at this time. I'm sorry if you don't like that. Open  Source is many things to many people, an open source license doesn't mean every open source project must follow a particular process or that I'm doing it wrong if I don't accept your changes.

3/30/2012 12:08:13 PM
Gravatar
Total Posts 156

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

You could solve that problem in your feature by using a custom table to relate those ids.

user ID and e-mail have separate fields for a reason. My original plan was to utilize as much of mojoPortal as possible and user ID and e-mail seemed to fit the purpose perfectly and they still do, but it looks like I'll have to work around the limitations.

You have a mythological view that all open source projects should be or are run a particular way.

That is not a mythological view - there is a reason why certain open source projects are more popular than others.  A lot of it has to do with how excited and involved the developing community is. Having forums, mailing lists, and irc channels are a big part of it.  However, planning and ease of commit process (after being accepted) is equally important.

I'm not going to defend myself against that, I run this project my way, it is tightly controlled and that is my perogative, I've always been clear about that, I've never said its open for any or all changes to get in. I accept changes that I'm willing to accept or I reject proposals for many reasons that make sense to me.

You have every right to do that - it is your project after all.

3/30/2012 12:29:58 PM
Gravatar
Total Posts 18439

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

user ID and e-mail have separate fields for a reason. My original plan was to utilize as much of mojoPortal as possible and user ID and e-mail seemed to fit the purpose perfectly and they still do, but it looks like I'll have to work around the limitations.

They both serve the purpose of supporting authentication, neither one is an ID in the database sense of the word, they are not intended for joins to other tables in custom features, relating to other tables would be better implemented using UserID field or UserGuid field, but my guess is you do have the email in your external database so you could probably use that if you really wanted to, but a more correct relational way of doing it would use the actual ID fields as opposed to the loginname which is just labelled as User ID in the UI for the benefit of the user.

In a perfect utopian world maybe someday I would just sit around and coordinate the contribution efforts of others (if I agreed with the proposed changes in the first place), but in the real world that takes a lot of time reviewing changes and communicating back and forth and it makes the project require more formal processes the more developers that are involved, and that slows things down. And the more people who want to sling code my way it diverts my efforts off of my own devlopment agenda and puts it on someone else's. I have limited bandwidth so I run the project the best I can under the varying concerns and goals I have foremost of which is making a living. Have you ever heard of Rainbow portal? I once was involved with that and it was so open there were lots of people with commit access all coding in different directions and it ultimately self imploded as a project because there was no-one in charge enough to say no. If others run their projects differently that is up to them and not my concern to compete with them on process of running the project. I'm happy with the rate at which mojoPortal popularity is growing and I'm happy with the way it is progressing as a product, as far as I'm concerned my way of managing it is working very well.

3/30/2012 12:40:01 PM
Gravatar
Total Posts 156

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

As long as you are happy, Joe. 

It certainly sounds like you had a bad experience in the past and have decided to be on the opposite side of the spectrum.

3/30/2012 2:16:27 PM
Gravatar
Total Posts 156

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

Joe,

Why couldn't we test for the username format in  Login.LoggingIn event (http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.login.loggingin.aspx), re-assign UserName to a corresponding user ID if an e-mail is being used, and let authentication proceed?
 
You have an event handler in place already inside your SiteLogin control, so why not do this right before
 
 
 
SiteUser siteUser = new SiteUser(siteSettings, this.UserName);
 
 
3/30/2012 2:37:00 PM
Gravatar
Total Posts 18439

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

I don't know what you mean, that is not going to change what is used to set the cookie, it will set the cookie using what it passed into the ValidateUser method of the membershipprovider and that the membership provider said was valid, and that constructor for SiteUser is only going to find the user using either loginname or email not either/or, that is why sitesettings is passed in so that we know which one to use.

What I don't want to do is make that constructor work no matter which is passed in, that to me is coding in loop holes that I don't want to code in just to accomodate this edge case.

One could call e.Cancel there and then proceed to set the authcookie manually but I don't really want to do that either because it is inconsistent vs other things that use the membership provider such as /Services/AuthenticationService.svc which is a built in feature of ASP.NET much like the LoginControl but can be used in client script or silverlight or desktop apps. And to do that we would still need the constructor on SiteUser to work no matter whether loginname or email is passed in ignoring the site setting. I don't want to do that.

I thought of all the ways it could be done but I don't like any of them. Putting the email in the LoginName field seems to me the most rational workaround for this edge case. I'm sorry you don't like that suggestion but its the only one that seems reasonable to me.

3/30/2012 2:48:16 PM
Gravatar
Total Posts 156

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

What I am suggesting is to always use user Id for everything internally, including passing it to the SiteUser constructor.  This way when user enters an e-mail for the username, we simply look up the user Id for that e-mail in Login.LogginIn event handler, re-assign UserName to the user Id and the proceed to pass it to SiteUser constructor.

SiteUser can always expect a user Id to be passed in to it, nothing else.

3/30/2012 2:50:58 PM
Gravatar
Total Posts 18439

Re: Using E-mail for Sign In w/ LDAP Fallback Authentication

Another workaround you "could" use is to modify your copy of the stored procedure mp_Users_SelectByLoginName so that it also checks against the email address and returns the user row if it matches. It isn't an ideal thing to modify included procedures but that one has not changed in years and is not likely to change frequently if ever. That would be essentially making that SiteUser contsructor work no matter whether login name or email is passed in but only in your copy which is preferable to me than baking it in for everyone.

You must sign in to post in the forums. This thread is closed to new posts.