ASP.NET MVC ActiveDirectoryMembershipProvider user stays logged in even when password has changed

Question

I am using ActiveDirectoryMembershipProvider in my web app. I authenticate users with their domain credentials like so

if (Membership.ValidateUser(m.Username, m.Password))
    FormsAuthentication.SetAuthCookie(m.Username, true);

This works well.

But even when the user's password is changed in active directory, the user stays logged in to the web app?

How can I ensure the user does not stay logged in to the web app if their domain password changes, or their account is disabled etc?

Answer 1

The answer is to periodically (every 30 minutes or so) check User.IsApproved and User.LastPasswordChangedDate to make sure the users credentials are still valid.

To do this you need to manually create the FormsAuthenticationTicket and cookie, rather than using FormsAuthentication.SetAuthCookie.

Put the date you validated the user inside UserData and compare this against LastPasswordChangedDate.

I've implemented this and it works perfectly.

More information here

Check if Active Directory password is different from cookie

Answer 2

I'm not 100% certain, but it sounds like you're unhappy that the user's auth ticket continues to work even though their password changes / account expires.

Once a user has logged in and has a authentication ticket (cookie), the user is not challenged for authentication again until until the ticket expires (set in the web.config file). Here are 2 suggestions for dealing with this problem:

1. Wait for the auth ticket (cookie) to expire. Upon the next login, the user will be required to use their new password. Variations of this solution include using session-only cookies so that the user must always login when the browser is closed (recommended for AD authentication).

2. Write an Http Module that looks for a list of recently updated users and inspects the auth ticket early in the HTTP pipeline. If an auth ticket comes through and matches the list of updated users, you exprire the user's cookie and re-direct them to the login page. Here's a similar question that would help get you started:

   How can I force a logout of all users on a web site