mcs/class/Mainsoft.Web/Mainsoft.Web.Security/DerbyMembershipProvider.cs

   1 //
   2 // Mainsoft.Web.Security.DerbyMembershipProvider
   3 //
   4 // Authors:
   5 //      Ben Maurer (bmaurer@users.sourceforge.net)
   6 //      Chris Toshok (toshok@ximian.com)
   7 //      Vladimir Krasnov (vladimirk@mainsoft.com)
   8 //
   9 //
  10 // Permission is hereby granted, free of charge, to any person obtaining
  11 // a copy of this software and associated documentation files (the
  12 // "Software"), to deal in the Software without restriction, including
  13 // without limitation the rights to use, copy, modify, merge, publish,
  14 // distribute, sublicense, and/or sell copies of the Software, and to
  15 // permit persons to whom the Software is furnished to do so, subject to
  16 // the following conditions:
  17 //
  18 // The above copyright notice and this permission notice shall be
  19 // included in all copies or substantial portions of the Software.
  20 //
  21 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  22 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  23 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  24 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  25 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  26 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  27 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  28 //
  29
  30 #if NET_2_0
  31
  32 using System;
  33 using System.Collections;
  34 using System.Collections.Specialized;
  35 using System.Configuration;
  36 using System.Configuration.Provider;
  37 using System.Data;
  38 using System.Data.OleDb;
  39 using System.Data.Common;
  40 using System.Text;
  41 using System.Web.Configuration;
  42 using System.Security;
  43 using System.Security.Cryptography;
  44 using System.Web;
  45 using System.Web.Security;
  46
  47 namespace Mainsoft.Web.Security {
  48         public class DerbyMembershipProvider : MembershipProvider
  49         {
  50                 const int SALT_BYTES = 16;
  51
  52                 bool enablePasswordReset;
  53                 bool enablePasswordRetrieval;
  54                 int maxInvalidPasswordAttempts;
  55                 MembershipPasswordFormat passwordFormat;
  56                 bool requiresQuestionAndAnswer;
  57                 bool requiresUniqueEmail;
  58                 int minRequiredNonAlphanumericCharacters;
  59                 int minRequiredPasswordLength;
  60                 int passwordAttemptWindow;
  61                 string passwordStrengthRegularExpression;
  62                 TimeSpan userIsOnlineTimeWindow;
  63                 ConnectionStringSettings connectionString;
  64
  65                 string applicationName;
  66
  67                 DbConnection CreateConnection ()
  68                 {
  69                         OleDbConnection connection = new OleDbConnection (connectionString.ConnectionString);
  70                         connection.Open ();
  71                         return connection;
  72                 }
  73
  74                 void CheckParam (string pName, string p, int length)
  75                 {
  76                         if (p == null)
  77                                 throw new ArgumentNullException (pName);
  78                         if (p.Length == 0 || p.Length > length || p.IndexOf (",") != -1)
  79                                 throw new ArgumentException (String.Format ("invalid format for {0}", pName));
  80                 }
  81
  82                 public override bool ChangePassword (string username, string oldPwd, string newPwd)
  83                 {
  84                         if (username != null) username = username.Trim ();
  85                         if (oldPwd != null) oldPwd = oldPwd.Trim ();
  86                         if (newPwd != null) newPwd = newPwd.Trim ();
  87
  88                         CheckParam ("username", username, 256);
  89                         CheckParam ("oldPwd", oldPwd, 128);
  90                         CheckParam ("newPwd", newPwd, 128);
  91
  92                         using (DbConnection connection = CreateConnection ()) {
  93                                 PasswordInfo pi = ValidateUsingPassword (username, oldPwd);
  94
  95                                 if (pi != null) {
  96                                         EmitValidatingPassword (username, newPwd, false);
  97                                         string db_password = EncodePassword (newPwd, pi.PasswordFormat, pi.PasswordSalt);
  98
  99                                         int st = DerbyMembershipHelper.Membership_SetPassword (connection, ApplicationName, username, newPwd, (int) pi.PasswordFormat, pi.PasswordSalt, DateTime.UtcNow);
 100
 101                                         if (st == 0)
 102                                                 return true;
 103                                 }
 104                                 return false;
 105                         }
 106                 }
 107
 108                 public override bool ChangePasswordQuestionAndAnswer (string username, string password, string newPwdQuestion, string newPwdAnswer)
 109                 {
 110                         if (username != null) username = username.Trim ();
 111                         if (newPwdQuestion != null) newPwdQuestion = newPwdQuestion.Trim ();
 112                         if (newPwdAnswer != null) newPwdAnswer = newPwdAnswer.Trim ();
 113
 114                         CheckParam ("username", username, 256);
 115                         if (RequiresQuestionAndAnswer)
 116                                 CheckParam ("newPwdQuestion", newPwdQuestion, 128);
 117                         if (RequiresQuestionAndAnswer)
 118                                 CheckParam ("newPwdAnswer", newPwdAnswer, 128);
 119
 120                         using (DbConnection connection = CreateConnection ()) {
 121                                 PasswordInfo pi = ValidateUsingPassword (username, password);
 122
 123                                 if (pi != null) {
 124                                         string db_passwordAnswer = EncodePassword (newPwdAnswer, pi.PasswordFormat, pi.PasswordSalt);
 125
 126                                         int st = DerbyMembershipHelper.Membership_ChangePasswordQuestionAndAnswer (connection, ApplicationName, username, newPwdQuestion, newPwdAnswer);
 127
 128                                         if (st == 0)
 129                                                 return true;
 130                                 }
 131                                 return false;
 132                         }
 133                 }
 134
 135                 public override MembershipUser CreateUser (string username,
 136                                                            string password,
 137                                                            string email,
 138                                                            string pwdQuestion,
 139                                                            string pwdAnswer,
 140                                                            bool isApproved,
 141                                                            object providerUserKey,
 142                                                            out MembershipCreateStatus status)
 143                 {
 144                         if (username != null) username = username.Trim ();
 145                         if (password != null) password = password.Trim ();
 146                         if (email != null) email = email.Trim ();
 147                         if (pwdQuestion != null) pwdQuestion = pwdQuestion.Trim ();
 148                         if (pwdAnswer != null) pwdAnswer = pwdAnswer.Trim ();
 149
 150                         /* some initial validation */
 151                         if (username == null || username.Length == 0 || username.Length > 256 || username.IndexOf (",") != -1) {
 152                                 status = MembershipCreateStatus.InvalidUserName;
 153                                 return null;
 154                         }
 155                         if (password == null || password.Length == 0 || password.Length > 128) {
 156                                 status = MembershipCreateStatus.InvalidPassword;
 157                                 return null;
 158                         }
 159
 160                         if (!CheckPassword (password)) {
 161                                 status = MembershipCreateStatus.InvalidPassword;
 162                                 return null;
 163                         }
 164                         EmitValidatingPassword (username, password, true);
 165
 166                         if (RequiresUniqueEmail && (email == null || email.Length == 0)) {
 167                                 status = MembershipCreateStatus.InvalidEmail;
 168                                 return null;
 169                         }
 170                         if (RequiresQuestionAndAnswer &&
 171                                 (pwdQuestion == null ||
 172                                  pwdQuestion.Length == 0 || pwdQuestion.Length > 256)) {
 173                                 status = MembershipCreateStatus.InvalidQuestion;
 174                                 return null;
 175                         }
 176                         if (RequiresQuestionAndAnswer &&
 177                                 (pwdAnswer == null ||
 178                                  pwdAnswer.Length == 0 || pwdAnswer.Length > 128)) {
 179                                 status = MembershipCreateStatus.InvalidAnswer;
 180                                 return null;
 181                         }
 182                         if (providerUserKey != null && !(providerUserKey is string)) {
 183                                 status = MembershipCreateStatus.InvalidProviderUserKey;
 184                                 return null;
 185                         }
 186
 187                         /* encode our password/answer using the
 188                          * "passwordFormat" configuration option */
 189                         string passwordSalt = "";
 190
 191                         RandomNumberGenerator rng = RandomNumberGenerator.Create ();
 192                         byte [] salt = new byte [SALT_BYTES];
 193                         rng.GetBytes (salt);
 194                         passwordSalt = Convert.ToBase64String (salt);
 195
 196                         password = EncodePassword (password, PasswordFormat, passwordSalt);
 197                         if (RequiresQuestionAndAnswer)
 198                                 pwdAnswer = EncodePassword (pwdAnswer, PasswordFormat, passwordSalt);
 199
 200                         /* make sure the hashed/encrypted password and
 201                          * answer are still under 128 characters. */
 202                         if (password.Length > 128) {
 203                                 status = MembershipCreateStatus.InvalidPassword;
 204                                 return null;
 205                         }
 206
 207                         if (RequiresQuestionAndAnswer) {
 208                                 if (pwdAnswer.Length > 128) {
 209                                         status = MembershipCreateStatus.InvalidAnswer;
 210                                         return null;
 211                                 }
 212                         }
 213                         status = MembershipCreateStatus.Success;
 214
 215                         using (DbConnection connection = CreateConnection ()) {
 216                                 try {
 217
 218
 219                                         DateTime Now = DateTime.UtcNow;
 220                                         int st = DerbyMembershipHelper.Membership_CreateUser (connection, ApplicationName, username, password, passwordSalt, email,
 221                                                 pwdQuestion, pwdAnswer, isApproved, Now, Now, RequiresUniqueEmail, (int)PasswordFormat, ref providerUserKey);
 222
 223                                         if (st == 0)
 224                                                 return GetUser (providerUserKey, false);
 225                                         else if (st == 2)
 226                                             status = MembershipCreateStatus.DuplicateUserName;
 227                                         else if (st == 3)
 228                                             status = MembershipCreateStatus.DuplicateEmail;
 229                                         else if (st == 9)
 230                                                 status = MembershipCreateStatus.InvalidProviderUserKey;
 231                                         else if (st == 10)
 232                                             status = MembershipCreateStatus.DuplicateProviderUserKey;
 233                                         else
 234                                             status = MembershipCreateStatus.ProviderError;
 235
 236                                         return null;
 237                                 }
 238                                 catch (Exception) {
 239                                         status = MembershipCreateStatus.ProviderError;
 240                                         return null;
 241                                 }
 242                         }
 243                 }
 244
 245                 private bool CheckPassword (string password)
 246                 {
 247                         if (password.Length < MinRequiredPasswordLength)
 248                                 return false;
 249
 250                         if (MinRequiredNonAlphanumericCharacters > 0) {
 251                                 int nonAlphanumeric = 0;
 252                                 for (int i = 0; i < password.Length; i++) {
 253                                         if (!Char.IsLetterOrDigit (password [i]))
 254                                                 nonAlphanumeric++;
 255                                 }
 256                                 return nonAlphanumeric >= MinRequiredNonAlphanumericCharacters;
 257                         }
 258                         return true;
 259                 }
 260
 261                 public override bool DeleteUser (string username, bool deleteAllRelatedData)
 262                 {
 263                         CheckParam ("username", username, 256);
 264
 265                         DeleteUserTableMask deleteBitmask = DeleteUserTableMask.MembershipUsers;
 266
 267                         if (deleteAllRelatedData)
 268                                 deleteBitmask |=
 269                                         DeleteUserTableMask.Profiles |
 270                                         DeleteUserTableMask.UsersInRoles |
 271                                         DeleteUserTableMask.WebPartStateUser;
 272
 273                         int num = 0;
 274                         using (DbConnection connection = CreateConnection ()) {
 275                                 int st = DerbyMembershipHelper.Users_DeleteUser (connection, ApplicationName, username, (int) deleteBitmask, ref num);
 276
 277                                 if (num == 0)
 278                                         return false;
 279
 280                                 if (st == 0)
 281                                         return true;
 282
 283                                 return false;
 284                         }
 285                 }
 286
 287                 public virtual string GeneratePassword ()
 288                 {
 289                         return Membership.GeneratePassword (MinRequiredPasswordLength, MinRequiredNonAlphanumericCharacters);
 290                 }
 291
 292                 public override MembershipUserCollection FindUsersByEmail (string emailToMatch, int pageIndex, int pageSize, out int totalRecords)
 293                 {
 294                         CheckParam ("emailToMatch", emailToMatch, 256);
 295
 296                         if (pageIndex < 0)
 297                                 throw new ArgumentException ("pageIndex must be >= 0");
 298                         if (pageSize < 0)
 299                                 throw new ArgumentException ("pageSize must be >= 0");
 300                         if (pageIndex * pageSize + pageSize - 1 > Int32.MaxValue)
 301                                 throw new ArgumentException ("pageIndex and pageSize are too large");
 302
 303                         totalRecords = 0;
 304                         using (DbConnection connection = CreateConnection ()) {
 305                                 DbDataReader reader = null;
 306
 307                                 DerbyMembershipHelper.Membership_FindUsersByEmail (connection, ApplicationName, emailToMatch, pageSize, pageIndex, out reader);
 308                                 if (reader == null)
 309                                         return null;
 310
 311                                 using (reader) {
 312                                         return BuildMembershipUserCollection (reader, pageIndex, pageSize, out totalRecords);
 313                                 }
 314                         }
 315                 }
 316
 317                 public override MembershipUserCollection FindUsersByName (string nameToMatch, int pageIndex, int pageSize, out int totalRecords)
 318                 {
 319                         CheckParam ("nameToMatch", nameToMatch, 256);
 320
 321                         if (pageIndex < 0)
 322                                 throw new ArgumentException ("pageIndex must be >= 0");
 323                         if (pageSize < 0)
 324                                 throw new ArgumentException ("pageSize must be >= 0");
 325                         if (pageIndex * pageSize + pageSize - 1 > Int32.MaxValue)
 326                                 throw new ArgumentException ("pageIndex and pageSize are too large");
 327
 328                         totalRecords = 0;
 329                         using (DbConnection connection = CreateConnection ()) {
 330                                 DbDataReader reader = null;
 331
 332                                 DerbyMembershipHelper.Membership_FindUsersByName (connection, ApplicationName, nameToMatch, pageSize, pageIndex, out reader);
 333                                 if (reader == null)
 334                                         return null;
 335
 336                                 using (reader) {
 337                                         return BuildMembershipUserCollection (reader, pageIndex, pageSize, out totalRecords);
 338                                 }
 339                         }
 340                 }
 341
 342                 public override MembershipUserCollection GetAllUsers (int pageIndex, int pageSize, out int totalRecords)
 343                 {
 344                         if (pageIndex < 0)
 345                                 throw new ArgumentException ("pageIndex must be >= 0");
 346                         if (pageSize < 0)
 347                                 throw new ArgumentException ("pageSize must be >= 0");
 348                         if (pageIndex * pageSize + pageSize - 1 > Int32.MaxValue)
 349                                 throw new ArgumentException ("pageIndex and pageSize are too large");
 350
 351                         using (DbConnection connection = CreateConnection ()) {
 352                                 DbDataReader reader = null;
 353                                 totalRecords = DerbyMembershipHelper.Membership_GetAllUsers (connection, ApplicationName, pageIndex, pageSize, out reader);
 354                                 return BuildMembershipUserCollection (reader, pageIndex, pageSize, out totalRecords);
 355                         }
 356                 }
 357
 358                 MembershipUserCollection BuildMembershipUserCollection (DbDataReader reader, int pageIndex, int pageSize, out int totalRecords)
 359                 {
 360                         int num_read = 0;
 361                         int num_added = 0;
 362                         int num_to_skip = pageIndex * pageSize;
 363                         MembershipUserCollection users = new MembershipUserCollection ();
 364                         try {
 365                                 while (reader.Read ()) {
 366                                         if (num_read >= num_to_skip) {
 367                                                 if (num_added < pageSize) {
 368                                                         users.Add (GetUserFromReader (reader));
 369                                                         num_added++;
 370                                                 }
 371                                         }
 372                                         num_read++;
 373                                 }
 374                                 totalRecords = num_read;
 375                                 return users;
 376                         }
 377                         catch (Exception) {
 378                                 totalRecords = 0;
 379                                 return null; /* should we let the exception through? */
 380                         }
 381                         finally {
 382                                 if (reader != null)
 383                                         reader.Close ();
 384                         }
 385                 }
 386
 387                 public override int GetNumberOfUsersOnline ()
 388                 {
 389                         using (DbConnection connection = CreateConnection ()) {
 390                                 return DerbyMembershipHelper.Membership_GetNumberOfUsersOnline (connection, ApplicationName, userIsOnlineTimeWindow.Minutes, DateTime.UtcNow);
 391                         }
 392                 }
 393
 394                 public override string GetPassword (string username, string answer)
 395                 {
 396                         if (!EnablePasswordRetrieval)
 397                                 throw new NotSupportedException ("this provider has not been configured to allow the retrieval of passwords");
 398
 399                         CheckParam ("username", username, 256);
 400                         if (RequiresQuestionAndAnswer)
 401                                 CheckParam ("answer", answer, 128);
 402
 403                         PasswordInfo pi = GetPasswordInfo (username);
 404                         if (pi == null)
 405                                 throw new ProviderException ("An error occurred while retrieving the password from the database");
 406
 407                         string user_answer = EncodePassword (answer, pi.PasswordFormat, pi.PasswordSalt);
 408                         string password = null;
 409
 410                         using (DbConnection connection = CreateConnection ()) {
 411                                 int st = DerbyMembershipHelper.Membership_GetPassword (connection, ApplicationName, username, answer, MaxInvalidPasswordAttempts, PasswordAttemptWindow, DateTime.UtcNow, out password);
 412
 413                                 if (st == 1)
 414                                         throw new ProviderException ("User specified by username is not found in the membership database");
 415
 416                                 if (st == 2)
 417                                         throw new MembershipPasswordException ("The membership user identified by username is locked out");
 418
 419                                 if (st == 3)
 420                                         throw new MembershipPasswordException ("Password Answer is invalid");
 421
 422                                 return DecodePassword (password, pi.PasswordFormat);
 423                         }
 424                 }
 425
 426                 MembershipUser GetUserFromReader (DbDataReader reader)
 427                 {
 428                         return new MembershipUser (
 429                                 this.Name,                                          /* XXX is this right?  */
 430                                 reader.GetString (0),                               /* name */
 431                                 reader.GetString (1),                               /* providerUserKey */
 432                                 reader.IsDBNull (2) ? null : reader.GetString (2),  /* email */
 433                                 reader.IsDBNull (3) ? null : reader.GetString (3),  /* passwordQuestion */
 434                                 reader.IsDBNull (4) ? null : reader.GetString (4),  /* comment */
 435                                 reader.GetInt32 (5) > 0,                            /* isApproved */
 436                                 reader.GetInt32 (6) > 0,                            /* isLockedOut */
 437                                 reader.GetDateTime (7).ToLocalTime (),              /* creationDate */
 438                                 reader.GetDateTime (8).ToLocalTime (),              /* lastLoginDate */
 439                                 reader.GetDateTime (9).ToLocalTime (),              /* lastActivityDate */
 440                                 reader.GetDateTime (10).ToLocalTime (),             /* lastPasswordChangedDate */
 441                                 reader.GetDateTime (11).ToLocalTime ()              /* lastLockoutDate */);
 442                 }
 443
 444                 public override MembershipUser GetUser (string username, bool userIsOnline)
 445                 {
 446                         if (username.Length == 0)
 447                                 return null;
 448
 449                         CheckParam ("username", username, 256);
 450
 451                         using (DbConnection connection = CreateConnection ()) {
 452                                 DbDataReader reader = null;
 453                                 int st = DerbyMembershipHelper.Membership_GetUserByName (connection, ApplicationName, username, userIsOnline, DateTime.UtcNow, out reader);
 454                                 using (reader) {
 455                                         if (st == 0 && reader != null) {
 456                                                 MembershipUser u = GetUserFromReader (reader);
 457                                                 return u;
 458                                         }
 459                                 }
 460                         }
 461                         return null;
 462                 }
 463
 464                 public override MembershipUser GetUser (object providerUserKey, bool userIsOnline)
 465                 {
 466                         if (providerUserKey == null)
 467                                 throw new ArgumentNullException ("providerUserKey");
 468
 469                         if (!(providerUserKey is string))
 470                                 throw new ArgumentException ("providerUserKey is not of type string");
 471
 472                         using (DbConnection connection = CreateConnection ()) {
 473                                 DbDataReader reader = null;
 474                                 int st = DerbyMembershipHelper.Membership_GetUserByUserId (connection, providerUserKey, userIsOnline, DateTime.UtcNow, out reader);
 475                                 using (reader) {
 476                                         if (st == 0 && reader != null) {
 477                                                 MembershipUser u = GetUserFromReader (reader);
 478                                                 return u;
 479                                         }
 480                                 }
 481                         }
 482                         return null;
 483                 }
 484
 485                 public override string GetUserNameByEmail (string email)
 486                 {
 487                         CheckParam ("email", email, 256);
 488
 489                         string username = null;
 490
 491                         using (DbConnection connection = CreateConnection ()) {
 492                                 int st = DerbyMembershipHelper.Membership_GetUserByEmail (connection, ApplicationName, email, out username);
 493
 494                                 if (st == 1)
 495                                         return null;
 496
 497                                 if (st == 2 && RequiresUniqueEmail)
 498                                         throw new ProviderException ("More than one user with the same e-mail address exists in the database and RequiresUniqueEmail is true");
 499                         }
 500                         return username;
 501                 }
 502
 503                 bool GetBoolConfigValue (NameValueCollection config, string name, bool def)
 504                 {
 505                         bool rv = def;
 506                         string val = config [name];
 507                         if (val != null) {
 508                                 try { rv = Boolean.Parse (val); }
 509                                 catch (Exception e) {
 510                                         throw new ProviderException (String.Format ("{0} must be true or false", name), e);
 511                                 }
 512                         }
 513                         return rv;
 514                 }
 515
 516                 int GetIntConfigValue (NameValueCollection config, string name, int def)
 517                 {
 518                         int rv = def;
 519                         string val = config [name];
 520                         if (val != null) {
 521                                 try { rv = Int32.Parse (val); }
 522                                 catch (Exception e) {
 523                                         throw new ProviderException (String.Format ("{0} must be an integer", name), e);
 524                                 }
 525                         }
 526                         return rv;
 527                 }
 528
 529                 int GetEnumConfigValue (NameValueCollection config, string name, Type enumType, int def)
 530                 {
 531                         int rv = def;
 532                         string val = config [name];
 533                         if (val != null) {
 534                                 try { rv = (int) Enum.Parse (enumType, val); }
 535                                 catch (Exception e) {
 536                                         throw new ProviderException (String.Format ("{0} must be one of the following values: {1}", name, String.Join (",", Enum.GetNames (enumType))), e);
 537                                 }
 538                         }
 539                         return rv;
 540                 }
 541
 542                 string GetStringConfigValue (NameValueCollection config, string name, string def)
 543                 {
 544                         string rv = def;
 545                         string val = config [name];
 546                         if (val != null)
 547                                 rv = val;
 548                         return rv;
 549                 }
 550
 551                 void EmitValidatingPassword (string username, string password, bool isNewUser)
 552                 {
 553                         ValidatePasswordEventArgs args = new ValidatePasswordEventArgs (username, password, isNewUser);
 554                         OnValidatingPassword (args);
 555
 556                         /* if we're canceled.. */
 557                         if (args.Cancel) {
 558                                 if (args.FailureInformation == null)
 559                                         throw new ProviderException ("Password validation canceled");
 560                                 else
 561                                         throw args.FailureInformation;
 562                         }
 563                 }
 564
 565                 public override void Initialize (string name, NameValueCollection config)
 566                 {
 567                         if (config == null)
 568                                 throw new ArgumentNullException ("config");
 569
 570                         base.Initialize (name, config);
 571
 572                         applicationName = GetStringConfigValue (config, "applicationName", "/");
 573                         enablePasswordReset = GetBoolConfigValue (config, "enablePasswordReset", true);
 574                         enablePasswordRetrieval = GetBoolConfigValue (config, "enablePasswordRetrieval", false);
 575                         requiresQuestionAndAnswer = GetBoolConfigValue (config, "requiresQuestionAndAnswer", true);
 576                         requiresUniqueEmail = GetBoolConfigValue (config, "requiresUniqueEmail", false);
 577                         passwordFormat = (MembershipPasswordFormat) GetEnumConfigValue (config, "passwordFormat", typeof (MembershipPasswordFormat),
 578                                                                                            (int) MembershipPasswordFormat.Hashed);
 579                         maxInvalidPasswordAttempts = GetIntConfigValue (config, "maxInvalidPasswordAttempts", 5);
 580                         minRequiredPasswordLength = GetIntConfigValue (config, "minRequiredPasswordLength", 7);
 581                         minRequiredNonAlphanumericCharacters = GetIntConfigValue (config, "minRequiredNonAlphanumericCharacters", 1);
 582                         passwordAttemptWindow = GetIntConfigValue (config, "passwordAttemptWindow", 10);
 583                         passwordStrengthRegularExpression = GetStringConfigValue (config, "passwordStrengthRegularExpression", "");
 584
 585                         MembershipSection section = (MembershipSection) WebConfigurationManager.GetSection ("system.web/membership");
 586
 587                         userIsOnlineTimeWindow = section.UserIsOnlineTimeWindow;
 588
 589                         /* we can't support password retrieval with hashed passwords */
 590                         if (passwordFormat == MembershipPasswordFormat.Hashed && enablePasswordRetrieval)
 591                                 throw new ProviderException ("password retrieval cannot be used with hashed passwords");
 592
 593                         string connectionStringName = config ["connectionStringName"];
 594
 595                         if (applicationName.Length > 256)
 596                                 throw new ProviderException ("The ApplicationName attribute must be 256 characters long or less.");
 597                         if (connectionStringName == null || connectionStringName.Length == 0)
 598                                 throw new ProviderException ("The ConnectionStringName attribute must be present and non-zero length.");
 599
 600                         connectionString = WebConfigurationManager.ConnectionStrings [connectionStringName];
 601
 602                         DerbyDBSchema.InitializeSchema (connectionString.ConnectionString);
 603                 }
 604
 605                 public override string ResetPassword (string username, string answer)
 606                 {
 607                         if (!EnablePasswordReset)
 608                                 throw new NotSupportedException ("this provider has not been configured to allow the resetting of passwords");
 609
 610                         CheckParam ("username", username, 256);
 611
 612                         if (RequiresQuestionAndAnswer)
 613                                 CheckParam ("answer", answer, 128);
 614
 615                         using (DbConnection connection = CreateConnection ()) {
 616                                 PasswordInfo pi = GetPasswordInfo (username);
 617                                 if (pi == null)
 618                                         throw new ProviderException (username + "is not found in the membership database");
 619
 620                                 string newPassword = GeneratePassword ();
 621                                 EmitValidatingPassword (username, newPassword, false);
 622
 623                                 string db_password = EncodePassword (newPassword, pi.PasswordFormat, pi.PasswordSalt);
 624                                 string db_answer = EncodePassword (answer, pi.PasswordFormat, pi.PasswordSalt);
 625
 626                                 int st = DerbyMembershipHelper.Membership_ResetPassword (connection, ApplicationName, username, db_password, db_answer, (int) pi.PasswordFormat, pi.PasswordSalt, MaxInvalidPasswordAttempts, PasswordAttemptWindow, DateTime.UtcNow);
 627
 628                                 if (st == 0)
 629                                         return newPassword;
 630                                 else if (st == 1)
 631                                         throw new ProviderException (username + " is not found in the membership database");
 632                                 else if (st == 2)
 633                                         throw new MembershipPasswordException ("The user account is currently locked out");
 634                                 else if (st == 3)
 635                                         throw new MembershipPasswordException ("Password Answer is invalid");
 636                                 else
 637                                         throw new ProviderException ("Failed to reset password");
 638                         }
 639                 }
 640
 641                 public override void UpdateUser (MembershipUser user)
 642                 {
 643                         if (user == null)
 644                                 throw new ArgumentNullException ("user");
 645
 646                         if (user.UserName == null)
 647                                 throw new ArgumentNullException ("user.UserName");
 648
 649                         if (RequiresUniqueEmail && user.Email == null)
 650                                 throw new ArgumentNullException ("user.Email");
 651
 652                         CheckParam ("user.UserName", user.UserName, 256);
 653
 654                         if (user.Email.Length > 256 || (RequiresUniqueEmail && user.Email.Length == 0))
 655                                 throw new ArgumentException ("invalid format for user.Email");
 656
 657                         using (DbConnection connection = CreateConnection ()) {
 658                                 int st = DerbyMembershipHelper.Membership_UpdateUser (connection, ApplicationName, user.UserName, user.Email, user.Comment, user.IsApproved, RequiresUniqueEmail, user.LastLoginDate, DateTime.UtcNow, DateTime.UtcNow);
 659
 660                                 if (st == 1)
 661                                         throw new ProviderException ("The UserName property of user was not found in the database.");
 662                                 if (st == 2)
 663                                         throw new ProviderException ("The Email property of user was equal to an existing e-mail address in the database and RequiresUniqueEmail is set to true.");
 664                                 if (st != 0)
 665                                         throw new ProviderException ("Failed to update user");
 666                         }
 667                 }
 668
 669                 public override bool ValidateUser (string username, string password)
 670                 {
 671                         if (username.Length == 0)
 672                                 return false;
 673
 674                         CheckParam ("username", username, 256);
 675                         EmitValidatingPassword (username, password, false);
 676
 677                         PasswordInfo pi = ValidateUsingPassword (username, password);
 678                         if (pi != null) {
 679                                 pi.LastLoginDate = DateTime.UtcNow;
 680                                 UpdateUserInfo (username, pi, true, true);
 681                                 return true;
 682                         }
 683                         return false;
 684                 }
 685
 686                 public override bool UnlockUser (string username)
 687                 {
 688                         CheckParam ("username", username, 256);
 689
 690                         using (DbConnection connection = CreateConnection ()) {
 691                                 try {
 692                                         int st = DerbyMembershipHelper.Membership_UnlockUser (connection, ApplicationName, username);
 693
 694                                         if (st == 0)
 695                                                 return true;
 696                                 }
 697                                 catch (Exception e) {
 698                                         throw new ProviderException ("Failed to unlock user", e);
 699                                 }
 700                         }
 701                         return false;
 702                 }
 703
 704                 void UpdateUserInfo (string username, PasswordInfo pi, bool isPasswordCorrect, bool updateLoginActivity)
 705                 {
 706                         CheckParam ("username", username, 256);
 707
 708                         using (DbConnection connection = CreateConnection ()) {
 709                                 try {
 710                                         int st = DerbyMembershipHelper.Membership_UpdateUserInfo (connection, ApplicationName, username, isPasswordCorrect, updateLoginActivity,
 711                                                 MaxInvalidPasswordAttempts, PasswordAttemptWindow, DateTime.UtcNow, pi.LastLoginDate, pi.LastActivityDate);
 712
 713                                         if (st == 0)
 714                                                 return;
 715                                 }
 716                                 catch (Exception e) {
 717                                         throw new ProviderException ("Failed to update Membership table", e);
 718                                 }
 719
 720                         }
 721                 }
 722
 723                 PasswordInfo ValidateUsingPassword (string username, string password)
 724                 {
 725                         MembershipUser user = GetUser (username, true);
 726                         if (user == null)
 727                                 return null;
 728
 729                         if (!user.IsApproved || user.IsLockedOut)
 730                                 return null;
 731
 732                         PasswordInfo pi = GetPasswordInfo (username);
 733
 734                         if (pi == null)
 735                                 return null;
 736
 737                         /* do the actual validation */
 738                         string user_password = EncodePassword (password, pi.PasswordFormat, pi.PasswordSalt);
 739
 740                         if (user_password != pi.Password) {
 741                                 UpdateUserInfo (username, pi, false, false);
 742                                 return null;
 743                         }
 744
 745                         return pi;
 746                 }
 747
 748                 private PasswordInfo GetPasswordInfo (string username)
 749                 {
 750                         using (DbConnection connection = CreateConnection ()) {
 751                                 DbDataReader reader = null;
 752                                 DerbyMembershipHelper.Membership_GetPasswordWithFormat (connection, ApplicationName, username, false, DateTime.UtcNow, out reader);
 753
 754                                 PasswordInfo pi = null;
 755                                 if (reader == null)
 756                                         return null;
 757
 758                                 using (reader) {
 759                                         if (reader.Read ()) {
 760                                                 int isLockedOut = reader.GetInt32 (1);
 761                                                 if (isLockedOut > 0)
 762                                                         return null;
 763
 764                                                 pi = new PasswordInfo (
 765                                                         reader.GetString (3),
 766                                                         (MembershipPasswordFormat) reader.GetInt32 (4),
 767                                                         reader.GetString (5),
 768                                                         reader.GetInt32 (6),
 769                                                         reader.GetInt32 (7),
 770                                                         reader.GetInt32 (2) > 0,
 771                                                         reader.GetDateTime (8),
 772                                                         reader.GetDateTime (9));
 773                                         }
 774                                 }
 775                                 return pi;
 776                         }
 777                 }
 778
 779                 private string EncodePassword (string password, MembershipPasswordFormat passwordFormat, string salt)
 780                 {
 781                         byte [] password_bytes;
 782                         byte [] salt_bytes;
 783
 784                         switch (passwordFormat) {
 785                                 case MembershipPasswordFormat.Clear:
 786                                         return password;
 787                                 case MembershipPasswordFormat.Hashed:
 788                                         password_bytes = Encoding.Unicode.GetBytes (password);
 789                                         salt_bytes = Convert.FromBase64String (salt);
 790
 791                                         byte [] hashBytes = new byte [salt_bytes.Length + password_bytes.Length];
 792
 793                                         Buffer.BlockCopy (salt_bytes, 0, hashBytes, 0, salt_bytes.Length);
 794                                         Buffer.BlockCopy (password_bytes, 0, hashBytes, salt_bytes.Length, password_bytes.Length);
 795
 796                                         MembershipSection section = (MembershipSection) WebConfigurationManager.GetSection ("system.web/membership");
 797                                         string alg_type = section.HashAlgorithmType;
 798                                         if (alg_type == "") {
 799                                                 MachineKeySection keysection = (MachineKeySection) WebConfigurationManager.GetSection ("system.web/machineKey");
 800                                                 alg_type = keysection.Validation.ToString ();
 801                                         }
 802                                         using (HashAlgorithm hash = HashAlgorithm.Create (alg_type)) {
 803                                                 hash.TransformFinalBlock (hashBytes, 0, hashBytes.Length);
 804                                                 return Convert.ToBase64String (hash.Hash);
 805                                         }
 806                                 case MembershipPasswordFormat.Encrypted:
 807                                         password_bytes = Encoding.Unicode.GetBytes (password);
 808                                         salt_bytes = Convert.FromBase64String (salt);
 809
 810                                         byte [] buf = new byte [password_bytes.Length + salt_bytes.Length];
 811
 812                                         Array.Copy (salt_bytes, 0, buf, 0, salt_bytes.Length);
 813                                         Array.Copy (password_bytes, 0, buf, salt_bytes.Length, password_bytes.Length);
 814
 815                                         return Convert.ToBase64String (EncryptPassword (buf));
 816                                 default:
 817                                         /* not reached.. */
 818                                         return null;
 819                         }
 820                 }
 821
 822                 private string DecodePassword (string password, MembershipPasswordFormat passwordFormat)
 823                 {
 824                         switch (passwordFormat) {
 825                                 case MembershipPasswordFormat.Clear:
 826                                         return password;
 827                                 case MembershipPasswordFormat.Hashed:
 828                                         throw new ProviderException ("Hashed passwords cannot be decoded.");
 829                                 case MembershipPasswordFormat.Encrypted:
 830                                         return Encoding.Unicode.GetString (DecryptPassword (Convert.FromBase64String (password)));
 831                                 default:
 832                                         /* not reached.. */
 833                                         return null;
 834                         }
 835                 }
 836
 837                 public override string ApplicationName
 838                 {
 839                         get { return applicationName; }
 840                         set { applicationName = value; }
 841                 }
 842
 843                 public override bool EnablePasswordReset
 844                 {
 845                         get { return enablePasswordReset; }
 846                 }
 847
 848                 public override bool EnablePasswordRetrieval
 849                 {
 850                         get { return enablePasswordRetrieval; }
 851                 }
 852
 853                 public override MembershipPasswordFormat PasswordFormat
 854                 {
 855                         get { return passwordFormat; }
 856                 }
 857
 858                 public override bool RequiresQuestionAndAnswer
 859                 {
 860                         get { return requiresQuestionAndAnswer; }
 861                 }
 862
 863                 public override bool RequiresUniqueEmail
 864                 {
 865                         get { return requiresUniqueEmail; }
 866                 }
 867
 868                 public override int MaxInvalidPasswordAttempts
 869                 {
 870                         get { return maxInvalidPasswordAttempts; }
 871                 }
 872
 873                 public override int MinRequiredNonAlphanumericCharacters
 874                 {
 875                         get { return minRequiredNonAlphanumericCharacters; }
 876                 }
 877
 878                 public override int MinRequiredPasswordLength
 879                 {
 880                         get { return minRequiredPasswordLength; }
 881                 }
 882
 883                 public override int PasswordAttemptWindow
 884                 {
 885                         get { return passwordAttemptWindow; }
 886                 }
 887
 888                 public override string PasswordStrengthRegularExpression
 889                 {
 890                         get { return passwordStrengthRegularExpression; }
 891                 }
 892
 893                 [Flags]
 894                 private enum DeleteUserTableMask
 895                 {
 896                         MembershipUsers = 1,
 897                         UsersInRoles = 2,
 898                         Profiles = 4,
 899                         WebPartStateUser = 8
 900                 }
 901
 902                 private sealed class PasswordInfo
 903                 {
 904                         private string _password;
 905                         private MembershipPasswordFormat _passwordFormat;
 906                         private string _passwordSalt;
 907                         private int _failedPasswordAttemptCount;
 908                         private int _failedPasswordAnswerAttemptCount;
 909                         private bool _isApproved;
 910                         private DateTime _lastLoginDate;
 911                         private DateTime _lastActivityDate;
 912
 913                         internal PasswordInfo (
 914                                 string password,
 915                                 MembershipPasswordFormat passwordFormat,
 916                                 string passwordSalt,
 917                                 int failedPasswordAttemptCount,
 918                                 int failedPasswordAnswerAttemptCount,
 919                                 bool isApproved,
 920                                 DateTime lastLoginDate,
 921                                 DateTime lastActivityDate)
 922                         {
 923                                 _password = password;
 924                                 _passwordFormat = passwordFormat;
 925                                 _passwordSalt = passwordSalt;
 926                                 _failedPasswordAttemptCount = failedPasswordAttemptCount;
 927                                 _failedPasswordAnswerAttemptCount = failedPasswordAnswerAttemptCount;
 928                                 _isApproved = isApproved;
 929                                 _lastLoginDate = lastLoginDate;
 930                                 _lastActivityDate = lastActivityDate;
 931                         }
 932
 933                         public string Password
 934                         {
 935                                 get { return _password; }
 936                                 set { _password = value; }
 937                         }
 938                         public MembershipPasswordFormat PasswordFormat
 939                         {
 940                                 get { return _passwordFormat; }
 941                                 set { _passwordFormat = value; }
 942                         }
 943                         public string PasswordSalt
 944                         {
 945                                 get { return _passwordSalt; }
 946                                 set { _passwordSalt = value; }
 947                         }
 948                         public int FailedPasswordAttemptCount
 949                         {
 950                                 get { return _failedPasswordAttemptCount; }
 951                                 set { _failedPasswordAttemptCount = value; }
 952                         }
 953                         public int FailedPasswordAnswerAttemptCount
 954                         {
 955                                 get { return _failedPasswordAnswerAttemptCount; }
 956                                 set { _failedPasswordAnswerAttemptCount = value; }
 957                         }
 958                         public bool IsApproved
 959                         {
 960                                 get { return _isApproved; }
 961                                 set { _isApproved = value; }
 962                         }
 963                         public DateTime LastLoginDate
 964                         {
 965                                 get { return _lastLoginDate; }
 966                                 set { _lastLoginDate = value; }
 967                         }
 968                         public DateTime LastActivityDate
 969                         {
 970                                 get { return _lastActivityDate; }
 971                                 set { _lastActivityDate = value; }
 972                         }
 973                 }
 974         }
 975 }
 976 #endif
 977