表单身份验证 - 如何验证非活动用户的用户名和密码？
我正在对一个允许用户注册但不活动的应用程序使用表单身份验证。 我们将通过普通邮件（长话短说）发送激活码，用户可以返回该信息并激活他们的帐户。
我想创建一个页面，用户可以返回并输入用户名、密码和生成的密钥来激活帐户。 我已将密钥存储在另一个表中，并计划生成它。 我无法使用非活动帐户验证用户名和密码。 我尝试过 Membership.ValidateUser(用户名,密码) 但它失败了，但如果我激活帐户，它就可以工作。
关于如何检查这个的想法？
I'm using forms authentication for an app that allows users to register but not active. We will send out an activation code via snail mail (long story) and the user can return with that info and activate their account.
I want to create a page where the user can come back and enter their username, password and generated key to activate the account. The key I have stored in another table and I plan to generate it. I'm having trouble verifying the username and password with an inactive account. I've tried Membership.ValidateUser(username,password) and it fails but if I activate the account, it works.
Ideas on how to check this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
首先激活帐户。
如果您通过电子邮件向他们发送激活码，则有一个匿名访问页面，该页面从电子邮件接收激活码（可能通过查询字符串），激活帐户，并将其重定向到激活表单身份验证的登录页面（假设用户名和密码已创建）。
如果访问代码无效且失败，您可以选择停用该帐户。
Activate the account first.
If you are sending them the activation code in an email, have a anonymous access page which receives the activation code from the email (perhaps via querystring), activates the account, and redirects them to a login page with forms authentication activated (assuming the username and password are already created).
If the access code is invalid and fails, you can optionally deactivate the account.
我不会设置 IsActive = false。 这是为了禁用帐户，防止任何类型的登录。 相反，我认为他们登录的能力没有问题。 我将使用成员身份角色来指定何时验证用户。 即“已验证”。
如果他们尚未激活其帐户并尝试登录，您只需检查他们是否具有“已验证”角色即可。 如果没有，请将他们重定向到“您的帐户尚未激活。请等待平邮邮件”的页面。 或者“请在下面输入您的验证码”。 信息。
当他们最终通过普通邮件输入正确的验证码时，您只需将他们添加到“已验证”角色即可。
这使您可以控制允许他们登录并“检查”其帐户的状态。 并且解决了您的 IsActive 问题。
I would not set IsActive = false. That is for disabling an account, preventing any type of login. Instead, I do not see a problem leaving them with the ability to login. I would use a Membership Role to specify when a user is verified. I.e. "Verified".
If they have not activated their account and attempt to login, you simply check to see if they have the Verified role. If not, redirect them to a page of "You account is not yet activated. Please wait for snail mail". Or a "Please enter your verification code below." message.
When they do finally enter the proper verification code from snail mail, you simply add them to the Verified role.
This gives you the control of allowing them to login and "check" the status of their account. And, resolves your IsActive issue.