For some reason, when I login, this line always has a value of false:

if (Context.User.Identity.IsAuthenticated) --- in the siteheader.ascx.cs

I am using the admin@thephile.com username and password.

does anyone know why. I look at there version that I downloaded and it works fine.

I think your sp_Accounts_ValidateLogin of stored procedure was changed or related by changed in database.
To try restore original database backup file.

Neo
What the web can be.

Hey Scott,

I had the same problem when I tried to build my own implementation of ThePhile. What I found was that visual studio sets the authentication mode to "Windows" in the webconfig file. If we want our code to work we have to change that to "Forms" as we are using FormsAuthentication. I've pasted the entry as it is in the downloaded code. Hope this helps you out.

Kirby

<authentication mode="Forms">
        <forms name="ThePhile" path="/" loginUrl="/ThePhile/Modules/Users/Login.aspx"
            protection="All" timeout="30">
        </forms>
    </authentication>

I have the same problem. My web.config has the right authentication mode. And before the code checks "Context.User.Identity.IsAuthenticated", FormsAuthentication.SetAuthCookie(...) is called. I even tried to insert the encrypted cookie programatically, it is still the same. I also monitor the "context.response.cookies"'s items. It looks like the "Expires" property always has the current time. I guess that it causes the authentication to be useless right away.

It is really a desperate situation.

I have the same problem. I have compiled the original code and it seems not working. The value is correct at the login page. However, the value is lost when redirected to another page. I cannot use this value to determin whether the user is authenticated. Can anyone fix the problem?

Did you convert the code to use VS 2003? The most common cause of this problem is that you didn't do this correctly. Do you understand projects and references, and dependencies?

Hi,

I had the same problem and solved it (putting other posts together and a little luck) by using the following code in the SiteHeader.aspx Page_Load method just before the if ( Context.User.Identity.IsAuthenticated ):

SitePrincipal cachedNewUser = ( SitePrincipal )Session[ "UserInfo" ];
if(!(cachedNewUser == null))
{
  Context.User = cachedNewUser;
}
if ( Context.User.Identity.IsAuthenticated )
{
  if ( !( Context.User is SitePrincipal ) )
  {
    SitePrincipal newUser = new SitePrincipal( Context.User.Identity.Name );
    Context.User = newUser;
  }
}

...and in the Login.aspx Submit_Click event within the else before the redirect to the Default.aspx page:

Context.Session[ "UserInfo" ] = newUser;

I hope this helps, I wasted a couple hours on this myself.

May help to put it in the ThePhilePage.cs ThePhilePage_Load event too and change the Windows based authentication in the FileManager to Forms based if you're using a hosted environment else it is not very secure (or remove the FileManager module completely!).

Cheers,

JD

Also...

In WebModules/Accounts/Admin/Default.aspx there is a casting error (i.e. Specified cast is not valid) when it is accessed without logging in first. To prevent this you can change the Page_Load code to as follows:

SitePrincipal cachedNewUser = ( SitePrincipal )Session[ "UserInfo" ];
if(!(cachedNewUser == null))
{
  Context.User = cachedNewUser;
}
if ( Context.User.Identity.IsAuthenticated )
{
  if ( !( Context.User is SitePrincipal ) )
  {
    SitePrincipal newUser = new SitePrincipal( Context.User.Identity.Name );
    Context.User = newUser;
  }
  if ( Context.User is SitePrincipal & ( ( SitePrincipal )Context.User ).HasPermission( Convert.ToInt32( AccountsPermissions.UpdateRoles ) ) )
    RoleLink.Visible = true;
  else
    RoleLink.Visible = false;
}
else
  RoleLink.Visible = false;

This will save a call to the database when there is no user logged in and make sure that they don't have access to the functionality.

To keep it consistent with the other pages you can replace "RolesLink.Visible = false;" with:

Response.Write( "You don't have sufficient permission to be using this page." );
Response.End();

JD