Inside of web.config add these two sections underneath system.web
<system.web>
<authentication mode="Forms">
<forms name=".hr" loginUrl="Login.aspx" protection="All" path="/" timeout="60" defaultUrl="Default.aspx" />
</authentication>
<authorization>
<deny users="?" />
<allow users="*" />
</authorization>
then underneath system.webserver add as many of these nodes as are needed. The Telerik one is important because we need to get to the Telerik code even if we're not authenticated.
</system.webServer>
<location path="Telerik.Web.UI.WebResource.axd">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="ChangePassword.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
This is the code for the submit button in the login.aspx
Private Sub btnSubmit_Click(sender As Object, e As EventArgs) Handles btnSubmit2.Click
Try
' Require both fields before attempting login
If Me.txtPassword2.Text = "" Then Exit Sub
If Me.txtUserName2.Text = "" Then Exit Sub
' Normalize username and look up the account
Dim strUserName As String = txtUserName2.Text.Trim
Dim oDT As DataTable = SPs.fp_FPUser_SEL_Login2(strUserName, Session("ConnectionString")).getTable
' If the username exists in the system...
If oDT.Rows.Count > 0 Then
' Validate the supplied password against the stored TabletPassword
If oDT.Rows(0)("TabletPassword") = Me.txtPassword2.Text Then
' Successful login — store username in session
Session("UserName") = strUserName
' Build the AppWeb session object for this user/device
Dim screensize As DeviceScreenSize
screensize = Detector.GetScreenSize(Request.UserAgent)
App = New AppWeb("HR", Session("SQLServer"), Session("Database"), strUserName, screensize)
Session("App") = App
Else
' Password mismatch — log the failed attempt and reset the form
SPs.fp_MasterUserLoginError_Merge(0, strUserName, "HR", txtPassword2.Text, Now, Session("IPAddress"), App.ConnectionString).execute()
Me.txtUserName2.Text = ""
Me.txtPassword2.Text = ""
Me.lblError.Text = "Invalid username or password"
Me.txtPassword2.Visible = True
btnSubmit2.Visible = True
Exit Sub
End If
Else
' Username not found — log the attempt and reset the form
Me.lblError.Text = "Invalid username or password"
SPs.fp_MasterUserLoginError_Merge(0, txtUserName2.Text, "HR", txtPassword2.Text, Now, Session("IPAddress"), App.ConnectionString).execute()
Me.txtUserName2.Text = ""
Me.txtPassword2.Text = ""
Me.txtPassword2.Visible = True
btnSubmit2.Visible = True
End If
Catch ex As Exception
' Re-throw so the global handler can capture details
Throw ex
End Try
End Sub
Last, all the web pages inherit from this InheritedPage class. If someone checks the Remember Me checkbox in the login and then closes the browser and opens it again they will still be authenticated but we won't have our special app class populated, which we use for any number of things. This reinitializes that class and makes it available to the underlying web page
Imports Telerik.Web.Device.Detection
Public Class InheritedPage
Inherits System.Web.UI.Page
Public App As AppWeb
Private Sub InheritedPage_Load(sender As Object, e As EventArgs) Handles Me.Load
If Session("App") Is Nothing Then
If User.Identity.IsAuthenticated Then
Dim screensize As DeviceScreenSize
screensize = Detector.GetScreenSize(Request.UserAgent)
App = New AppWeb("HR", Session("SQLServer"), Session("Database"), User.Identity.Name, screensize)
Session("App") = App
End If
Else
App = Session("App")
End If
End Sub
End Class