using System;
using System.Web.Security;
using IdeaBlade.EntityModel;
namespace Sample {
  /// <summary>
  /// A custom LoginManager extending the DevForce AspAuthenticatingLoginManager.
  /// The DevForce implementation currently allows non-authenticated users to be logged in,
  /// so this class overrides user validation and throws a LoginException
  /// when the user is not authenticated.
  /// </summary>
  public class LoginManager : IdeaBlade.EntityModel.Web.AspAuthenticatingLoginManager {
    protected override bool ValidateUserCore(ILoginCredential credential) {
      // Base class calls Membership.ValidateUser, and returns t/f based on whether
      // the user is authenticated.  If not authenticated, we don't actually know why.
      // The base class does not throw a LoginException if the user is not authenticated,
      // so we do here.
      bool isAuthenticated = base.ValidateUserCore(credential);
      if (isAuthenticated) return isAuthenticated;
      var members = Membership.FindUsersByName(credential.UserName);
      if (members.Count == 0) {
        throw new LoginException(LoginExceptionType.InvalidUserName, "Invalid username");
      } else {
        throw new LoginException(LoginExceptionType.InvalidPassword, "Invalid password");
      }
    }
  }
}