Hi Arash,

You are right. The reason we don't return false there is that it results in the generic authnetication failed message which is not very helpful to the user, so instead we enforce it from SiteLogin.cs in the SiteLogin_LoggingIn event we check if the account is locked and if so we cancel the login. This allows us to show a more meaningful error to the user indicating the account is locked whereas if we just return false from validateuser it will result in a less helpful generic error that authentication failed.

However, I realize that if you are using the AuthenticationService you may wish to make it return false there, so I've added a config setting to enable that for you. If you get the latest code, you can add this to your user.config to make it return false from validateuser if the account is locked:

<add key="MembershipProvider:ReturnFalseInValidateUserIfAccountLocked" value="true" />

Hope that helps,

Joe