Geek asks and answers

Changing a machine key prevents existing users from logging on

I am using a membership provider configured in Web.config, like this, to use SQL CE:

  <connectionStrings>
    <add name="DefaultConnection" connectionString="Data Source=|DataDirectory|\Users.sdf" providerName="System.Data.SqlServerCe.4.0" />
  </connectionStrings>

and

<membership defaultProvider="DefaultMembershipProvider">
  <providers>
    <clear />
    <add name="DefaultMembershipProvider" type="System.Web.Providers.DefaultMembershipProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordFormat="Hashed" applicationName="/" />
  </providers>
</membership>

This works correctly if I do not have machine keys.

If I add the machine key in the Web.configfollowing way, existing users will no longer be able to log in. However, I can create new users, and they can log in.

<machineKey validationKey="D829F10BE92767EC2F9E9FC53B2CF3952AAD386483D6E81E74B4BD84DBE66F71CA121581598FEA669892DBDE46507DF3C8028BBD8FD4E678557621141945171C" decryptionKey="D14678D1FB1777E10316163F6D97071CDF2A447FA15C172DC9525BA397BB0610" validation="SHA1" decryption="AES" />
<pages enableViewStateMac="true"/>

If I delete the machine key, the initially created users can log in again, and the newly created users cannot.

Why does adding a machine key alter whether existing users can log in, given that the password hashed is not encrypted?

+3
source share
1

.Net Framework 4 SHA256. , , SHA1, SHA256.

<membership ... hashAlgorithmType="SHA1">
  <providers>
    ...
  </providers>
</membership>

<machineKey ... validation="SHA1" decryption="AES" />
+3

More articles:


All Articles