Why is ModelState invalid while not logging any errors? - asp.net

Question

I'm having some issues validating my ModelState for a login feature.
The setup is this:
I have a database table with about 6 attributes that will log user information. (Id, Username, Email, Password, CreatedOn, DisabledUser). I'm using the LocalDb feature and Entity Framework.
To interact with the database I'm using the Repository pattern.(IUserRepository to define my operations and UserRepository for a concrete implementation of it that I register with Ninject as my DI Container)
The User entity class is defined like this:
public class User
{
public Int32 Id { get; set; }
public String Username { get; set; }
public String Email { get; set; }
public String Password { get; set; }
public DateTime CreatedOn { get; set; }
public Boolean DisabledUser { get; set; }
}
To define the login process I have a concrete implementation of an interface defined like this:
public class FormsAuthProvider: IAuthProvider
{
public bool Authenticate(string username, string password)
{
bool result = FormsAuthentication.Authenticate(username, password);
if (result)
{
FormsAuthentication.SetAuthCookie(username, false);
}
return result;
}
}
Moving on, the view model that I use to pass the data from the model to the view is
public class LoginViewModel
{
[Required]
public String Username { get; set; }
[Required]
[DataType(DataType.Password)]
public string Password { get; set; }
}
The controller action that handles the login request is:
[HttpPost]
public ActionResult Login(LoginViewModel model, string returnUrl)
{
if (ModelState.IsValid)
{
if (authProvider.Authenticate(model.Username, model.Password))
{
return Redirect(returnUrl ?? Url.Action("Index", "Account"));
}
else
{
ModelState.AddModelError("", "User or password was incorrect");
return View();
}
}
else
{
return View();
}
}
The view
#model pRom.WebUI.Models.LoginViewModel
#{
ViewBag.Title = "Log In";
Layout = "~/Views/Shared/_AccountLayout.cshtml";
}
<h2>Login</h2>
<p>Please log in to access the administrative area:
#using (Html.BeginForm())
{
#Html.ValidationSummary(true)
#Html.EditorForModel()
<p><input type="submit" value="Log in" /></p>
}
</p>
The markup that is spit out on that page is:
<form action="/" method="post"><div class="editor-label"><label for="Username">Username</label></div>
<div class="editor-field"><input class="text-box single-line" data-val="true" data-val-required="The Username field is required." id="Username" name="Username" type="text" value="" /> <span class="field-validation-valid" data-valmsg-for="Username" data-valmsg-replace="true"></span></div>
<div class="editor-label"><label for="Password">Password</label></div>
<div class="editor-field"><input class="text-box single-line password" data-val="true" data-val-required="The Password field is required." id="Password" name="Password" type="password" value="" /> <span class="field-validation-valid" data-valmsg-for="Password" data-valmsg-replace="true"></span></div>
<p><input type="submit" value="Log in" /></p>
</form></p>
So having all this I'm always brought to the error I add in the else branch, although I am sure both the user and password fields are corresponding with what is in the database.
I've tried to debug this somehow and see if there are any errors attached to ModelState but with no luck. Tried a bunch of things that I've found here on SO, primarily iterating on the ModelState property.
I'm stuck, can you point me on where I should look at to solve this problem? Thank you.
EDIT:
I've done some more debugging and where it fails is on
bool result = FormsAuthentication.Authenticate(username, password);
So the Model validations works fine, it's the authentication that doesn't. I've checked the locals and the strings that get passed on for comparison are the fields in the database.

Answer 1

You're using FormsAuthentication.Authenticate (which is obsolete), which actually looks at the credentials stored in the web.config, so that's the most likely issue.
If you're trying to leverage the Membership API, you want to replace FormsAuthentication.Authenticate with Membership.ValidateUser (which takes the same parameters). That requires you to setup a provider in the web.config. Otherwise, you likely need to replace Authenticate with your own custom service class.