Secure login to the Membership Provider.

Syntax

Smartsite SXML	Copy Code
<se:login />

Parameters

Name	Data Type	Properties	Description
DefaultReturnUrl	Locator	-	Sets the default redirect url, after successful login. Note that the resultformat should contain login.return() for redirection execution to take place.
NameField	String	-	Sets the field the username value is stored in.
PasswordField	String	-	Sets the field the password/hash value is stored in.
RememberMeField	String	-	Sets the field the 'Remember Me' value is stored in.

Shared Parameters

Name	Data Type	Properties	Description
Access	String	-	Friendly name of the minimum access type level required by the site visitor to execute this macro.
AccessDenied	String	RawData	Sets the value that is returned when the site visitor has insufficient access.
AIM	Enum	-	Sets the AIM scanning mode of the macro. Enum values: NotSet Not set. Off No AIM scanning. External Output XML scanning. Internal Internal scanning, implemented by AIM-aware macros. Autonomous Relations are to be linked to the current source item, instead of the rendered page. SoftLink Should generate soft links (in combination with External flag). InternalAutonomous Internal scanning, combined with the Autonomous setting. ExternalAutonomous External scanning, combined with the Autonomous setting. ExternalAutonomousSoftLink External scanning, combined with the Autonomous and softLink settings. ExternalSoftLink External scanning, combined with the Softlink setting.
Condition	String	MustBeAttribute ExpressionSyntax XmlDecode	Sets the Viper expression to evaluate before actually executing the macro. If the expression returns false, the execution of the module and its child modules is skipped.
Default	String	RawData	Sets the default value that will be returned when the execution would otherwise return an empty string.
Error	String	RawData	Sets the value to return in case on error occurs during execution. The Viper expressions this.error(), this.error(full) and this.error(type) are available in this context.
Id	String	MustBeAttribute Trim	Sets the Id of the macro. Macros with Ids set can be accessed using Viper by referring to page.[id].[methodname()].
LocalId	String	MustBeAttribute Trim	Sets the local id of the macro in the current buffer scope.
Rem	String	RawData NoCache Trim	Sets the remarks. Remarks have no effect on the actual execution of the module. They only improve the readability of the code.
ResultFormat	String	RawData	Sets the resultformat.
ResultType	Enum	-	Sets the type of the result. Enum values: Undefined Not set None No result String Default type Object Generic object Binary Binary data Boolean Boolean DataTable DataTable DateTime Date/time Float Floating point numeric data Integer Integer Locator Extended Uri Xml Xml Data
Save	Collection	-	Sets the buffer names.
Status	Enum	-	Gets a value indicating the ModuleStatus of this module. Enum values: Unknown Unknown BeginInitialize Initializing the module EndInitialize Module has fully initialized BeginSetProperties Properties are about to be set EndSetProperties Properties have been set BeginExecute Execution starts BeginFormatData Starting data formatting. EndFormatData Ended data formatting. BeginFormatResult Before formating result. EndFormatResult After formatting result EndExecute Execution is ending StartLoseScope Execution has completed EndLoseScope Module is about to unload Error Module is in an error state
Timeout	Float	-	Sets the timeout in seconds. In the overriden Execute() method, you can call CheckTimeout() to check whether execution has timed out.
Trim	Enum	MustBeAttribute	Gets a value indicating how the whitespace is trimmed.
Whitespace	Enum	MustBeAttribute	Gets a value indicating whether to preserve whitespace. Enum values: Inherit Inherit from parent. Preserve Keep all whitespace. Remove Remove all whitespace. Normalize Convert all whitespace to single spaces. SimpleFormat Convert all whitespace to single spaces, but keep single line breaks.

Local Viper Methods

Viper	Extension	Description
This.ClearForcedResult		Sets the result of the macro. used to override the normal handling of the result creation.
This.GetForcedResult		Gets the forced result of the macro, set by overriding the normal rendering using SetForcedResult().
This.RenderTime	✓	Returns the render time of the macro in milliseconds.
This.SetForcedResult		Sets the result of the macro. used to override the normal handling of the result creation.

Shared Local Viper Methods

Viper	Extension	Description
This.AIM.Relations	✓	Gets a list of all outgoing AIM relations created by the macro.
This.Buffer.Exists		Checks whether a local buffer exists.
This.Buffer.Get		Gets a local buffer.
This.Buffer.Set		Sets a local buffer.
This.Error.InnerException.Message		Returns the text message of the inner exception of the exception that has occurred.
This.Error.InnerException.SmartsiteCode		Returns Smartsite error code of the inner exception of the exception that has occurred.
This.Error.InnerException.Throw		Makes Smartsite throw the inner exception.
This.Error.InnerException.ToString		Returns the full information of the inner exception of the exception that has occurred, including the stack trace.
This.Error.InnerException.Type		Returns the full Type name of the inner exception of the exception that has occurred.
This.Error.Message		Returns the text message of the exception that has occurred.
This.Error.SmartsiteCode		Returns the Smartsite Error code of the exception that has occurred.
This.Error.Throw		Makes Smartsite throw the current exception.
This.Error.ToString		Returns the full information of the exception that has occurred, including the stack trace.
This.Error.Type		Returns the full Type name of the exception that has occurred.
This.FindExtension		Finds an extension macro.
This.GetParameter	✓	Gets the value of the given parameter/property.
This.ParameterExists	✓	Checks whether the given parameter/property is set.
This.Result		Returns the result of the macro. Typically used in the ResultFormat property, to format, convert or encode the result.
This.SXMLPath		Gets the path to the macro in the current execution stack.

Remarks

Logging on using the ASP.NET MemberShip technology can now implemented using SXML only. Simply place a login macro on a page and tell it where to get the login data from.

Smartsite SXML	Copy Code
<se:login error="{login.alert(this.error.message())}" namefield="usn" passwordfield="pwd" remembermefield="rmb" />

In this case, we have a form somewhere on the page that holds at least the three fields mentioned: usn, pwd and mbr. Whenever the form is submitted, the macro will test the given credentials and log the visitor on.

Business logic

Login success results in a boolean true value. The default resultformat will force a redirect to the same page. Login failures will raise an exception that can be trapped by an error parameter on the login macro or containing macros.

Making logins secure

By default, form data, including password strings, is posted as clear text, so we will either need to:

Use SSL for the login.
Generate a hash of the password and compare it to a hash of the actual stored password. This is only possible if the Membership Provider supports password retrieving.
Encrypt the password on the client, and decrypt it at the server side, using asymetric encryption (a public and private key)

Logging off

The login macro also provides a static Viper method to undo the login:

Smartsite SXML	Copy Code
{login.undo()};

This method removes the FormsAuthentication cookie and forces a redirect to the same page in order to lose any personalized data.

Configuration

See http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx

Note

Sliding expiration resets the expiration time for a valid authentication cookie if a request is made and more than half of the timeout interval has elapsed. If the cookie expires, the user must re-authenticate. Setting the SlidingExpiration property to false can improve the security of an application by limiting the time for which an authentication cookie is valid, based on the configured timeout value:

<forms loginUrl="/Login" name="Smartsite" timeout="5000000" slidingExpiration="true" />

See http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.slidingexpiration.aspx

Example

Login Example

The Smartsite Login macro allows for signing in and out using the underlying ASP.NET Membership Provider Model. It is completely independent of the actual provider used, and it doesn't output an HTML form. Instead, it passes your logon data to the Membership layer and gives you a maximum of flexibility in how you implement user interface and logon behavior.

Smartsite SXML	Copy Code
<!--// Complete handling of logging on and off --> <se:if expression="user.isanonymous()"> <se:then> <!--// No user currently signed in: show logon form --> <se:placeholder.addjavascriptinclude url="/assets/behavior/classes/loginform.js" priority="-1"/> <!--// Show the login form. --> <div id="LoginPane" class="LinkPopup" title="Login"> <form class="LoginForm CoolForm" action="{request.location()}" method="post"> <label for="txtUserName">Gebruikersnaam</label> <input class="textbox Required" title="User name" name="txtUserName" id="txtUserName"/><br /> <label for="txtPassword">Wachtwoord</label> <input class="textbox Required" title="Password" type="password" name="txtPassword" id="txtPassword"/><br /> <label for="chkRM">Gegevens onthouden</label> <input class="checkbox" title="Remember Me" type="checkbox" name="chkRM" id="chkRM"/> <br /> <input class="LogOnButton" type="submit" value="Inloggen"/> </form> </div> <!--// Handle the login data if provided by the user. --> <se:login namefield="txtUserName" passwordfield="txtPassword" remembermefield="chkRM" > <se:parameters> <se:parameter name="resultformat"> <!--// The ResultFormat is used on login success. Logon failures can be handled in the Error property. --> <se:placeholder.addjavascriptonload> document.getElementById('LoginPane').innerHTML = "Logon successful! Wait while you are transferred to your destination page..."; var moveToDestination = function(){ document.location.replace("{sys.iif(request.query.exists('ReturnUrl'), request.query(returnurl), channel.link())}"); }; setTimeout(moveToDestination, 100); </se:placeholder.addjavascriptonload> </se:parameter> <se:parameter name="error"> <!--// When a logon fails, show an error. --> <h4 class="error">Error logging on: {this.error.message()}</h4> </se:parameter> </se:parameters> </se:login> </se:then> <se:else> <!--// Offer the user a way to log off... --> <se:if expression="request.query.exists(undologon)"> <se:then> {login.undo()} <!--// sign out the user and refresh the current page --> </se:then> <se:else> <!--// Show a link to sign out --> <a href="{url.setparameter(request.location(), 'undologon', '1')}" title="Log off as '{user.fullname()}'">Log off {user.fullname()}</a> </se:else> </se:if> </se:else> </se:if>

Smartsite SXML

Copy Code

<!--//
    Complete handling of logging on and off
-->
<se:if expression="user.isanonymous()">
    <se:then>        
        <!--//
            No user currently signed in: show logon form
        -->
        <se:placeholder.addjavascriptinclude url="/assets/behavior/classes/loginform.js" priority="-1"/>
    
        <!--//
            Show the login form. 
        -->    
        <div id="LoginPane" class="LinkPopup" title="Login">            
            <form class="LoginForm CoolForm" action="{request.location()}" method="post">
                
                <label for="txtUserName">Gebruikersnaam</label>
                <input class="textbox Required" title="User name" name="txtUserName" id="txtUserName"/><br />
                
                <label for="txtPassword">Wachtwoord</label>
                <input class="textbox Required" title="Password" type="password" name="txtPassword" id="txtPassword"/><br />
                
                <label for="chkRM">Gegevens onthouden</label>
                <input class="checkbox" title="Remember Me" type="checkbox" name="chkRM" id="chkRM"/>
                
                <br />
                <input class="LogOnButton" type="submit" value="Inloggen"/>
                
            </form>    
         </div>
         
         <!--//
             Handle the login data if provided by the user.
         -->
         
         <se:login
                namefield="txtUserName"
                passwordfield="txtPassword"
                remembermefield="chkRM"
             >
             
             <se:parameters>
                 <se:parameter name="resultformat">
                    <!--//
                        The ResultFormat is used on login success. Logon failures can be handled in the Error property.
                    -->
                    <se:placeholder.addjavascriptonload>
                        document.getElementById('LoginPane').innerHTML = "Logon successful! Wait while you are transferred to your destination page...";
                        
                        var moveToDestination = function(){
                            document.location.replace("{sys.iif(request.query.exists('ReturnUrl'), request.query(returnurl), channel.link())}");
                        };
                        
                        setTimeout(moveToDestination, 100);
                        
                    </se:placeholder.addjavascriptonload>
                    
                </se:parameter>
                <se:parameter name="error">
                    <!--//
                        When a logon fails, show an error.
                    -->
                    <h4 class="error">Error logging on: {this.error.message()}</h4>
                </se:parameter>
             </se:parameters>
             </se:login>
        
    </se:then>
    <se:else>
        <!--// 
            Offer the user a way to log off...
        -->
        <se:if expression="request.query.exists(undologon)">
            <se:then>
                {login.undo()} <!--// sign out the user and refresh the current page -->
            </se:then>
            <se:else>
                <!--// Show a link to sign out -->
                <a href="{url.setparameter(request.location(), 'undologon', '1')}" title="Log off as '{user.fullname()}'">Log off {user.fullname()}</a>
            </se:else>
        </se:if>
    </se:else>
</se:if>

SXML