How can I save a user name and password so that when the user opens their browser again, I can retreive that information and sign them in automatically?

>>When using FormsAuthentication you can make it Persistent cookie..i.e. what happens when you select Remember Me checkbox..

So how do I retrieve the username and password to authenticate them again in the background and sign them in automatically, without the user entering anything again?

User do not have to enter anything.....as long as a valid forms authentication cookie exists on the user computer ....whenever user tries to visit your site (from same computer) he/she will not be asked for any credentials but will be automatically logged-in.

and either one of these statements below sets the valid forms authentication cookie?

e..g
FormsAuthentication.RedirectFromLoginPage(username,true); //note passing true
or
FormsAuthentication.SetAuthCookie(username,true)

yes....you use either of that when the user first tries to Login using username/password.

The First One will redirect automatically to Default page or some requested secured page upon login.
When using Second ...you have to explicitly redirect like:
FormsAuthentication.SetAuthCookie(username,true)
Response.Redirect("To somepage.aspx");

Check this for more info:
http://msdn.microsoft.com/en-us/library/aa480476.aspx

I have this but can't get it to save the user name, and it wont show on the next page when i call Identity.Name

any ideas

code below

webconfig
 
.....
 
    <authentication mode="Forms">
      <forms loginUrl="admin/signin.aspx"
             protection="All"
             path="admin"
             requireSSL="false"
             slidingExpiration="true"
             cookieless="UseDeviceProfile"
             enableCrossAppRedirects="false" />
    </authentication>
    <authorization>
      <allow users="*"/>
      <deny users="?"/>
    </authorization>
 
.....
 
signin.aspx
 
    protected void LogonUser(object sender, EventArgs e)
    {
        string user = uxUserNameTextbox.Text;
        string pwd = uxPasswordTextbox.Text;
 
        bool bAuthenicated = Security.AuthenticateUser(user, pwd);
 
        if (bAuthenicated)
        {
            if (uxRememberCheckBox.Checked)
                FormsAuthentication.RedirectFromLoginPage(user, true);
            else
                FormsAuthentication.RedirectFromLoginPage(user, false);
 
            Response.Redirect("welcome.aspx");
        
        }
        else
            uxErrorLabel.Text = "User name or password is not correct.<br /><br />";
    }
 
Security class
 
.....
 
    public static bool AuthenticateUser(string username, string pwd)
    {
        int found = 0;
 
        using (SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["db"].ConnectionString))
        {
            SqlCommand cmd = new SqlCommand("sp_AuthenticateUser", conn);
            cmd.CommandType = CommandType.StoredProcedure;
            cmd.Parameters.Add("@Username", SqlDbType.VarChar, 10).Value = username;
            cmd.Parameters.Add("@Password", SqlDbType.VarChar, 50).Value = pwd;
 
            try
            {
                conn.Open();
                found = (int)cmd.ExecuteScalar();
 
            }
            catch (Exception e)
            {
                throw new Exception(e.Message);
            }
            finally
            {
                conn.Close();
            }
        }
 
        return (found > 0);
    }
 
.....
 
Global.asax
 
    Sub Application_AuthenticateRequest(ByVal sender As Object, ByVal e As EventArgs)
        
        If Request.IsAuthenticated Then
            
            
            Using conn As SqlConnection = New SqlConnection(ConfigurationManager.ConnectionStrings("db").ConnectionString)
                
                Dim cmd As SqlCommand = New SqlCommand("sp_GetEmployeeAccessList", conn)
                Dim reader As SqlDataReader
                
                cmd.CommandType = CommandType.StoredProcedure
                cmd.Parameters.AddWithValue("@EmployeeID", User.Identity.Name)
                
                Try
                    
                    conn.Open()
                    reader = cmd.ExecuteReader
                    
                    Dim roleList As New ArrayList
            
                    Do While reader.Read()
                        roleList.Add(reader("AccessID"))
                    Loop
                    
                                
                    Dim roleListArray As String() = roleList.ToArray(GetType(String))
            
                    HttpContext.Current.User = New GenericPrincipal(User.Identity, roleListArray)
                    
                    reader.Close()
                    conn.Close()
                    
                Catch ex As Exception
                    Throw New Exception(ex.Message)
                Finally
                    cmd.Dispose()
                End Try
                
            End Using
        
        End If
    
    End Sub

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:

try removing  <allow users="*"/>

<authorization>    
      <deny users="?"/>
    </authorization>
Secondly set breakpoints at line:
33 and 35 ..see which statement is hit..

Third thing: When using FormsAuthentication.RedirectFromLoginPage you do not need
line 37  Response.Redirect("welcome.aspx");
If you need Line 37....
then change
 FormsAuthentication.RedirectFromLoginPage  -->to
 FormsAuthentication.SetAuthCookie

Just drag and drop "LoginName" and LoginStatus Controls on your next Page

made the changes and for some reason the web page isnt following the CSS for the page.  

Plus I'm not getting any of the information to save in the Identity.Name field


any ideas?

Got this error setting up the webconfig file


Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level.  This error can be caused by a virtual directory not being configured as an application in IIS.

Line 110:      <authentication mode="Forms">

where did you set that ?
You can set authentication in root web.config only and not inside a folder.

ok,

Do I have to set all my admin pages in 1 sub folder?

or can I set my admin pages in mutliple sub folders.  

I have HR subfolder and also an admin folder.

HR has some admin pages that u authorization t see and all of admin pages need authorization.

Can this be achieved or should I put al lin 1 sub folder?

you can put the pages in subfolder ...
You cannot use authentication in sub-web.config but you can use authorization in sub-web.config
So set authorization for each sub-folder accordingly.

Also are you planning to put sub-folder HR withing the Admin folder or just a separate folder within the root..?
It doesn't matter though where you put as long as it has proper authorization rules.

>>Also are you planning to put sub-folder HR withing the Admin folder or just a separate folder within the root..?

yes, HR is a seperate folder in the root

>>So set authorization for each sub-folder accordingly.

How do I achieve this

what if I have 3 web pages that are open to any user and 2 that are not in the HR folder.

can you set that in the webconfig file?

you can set authorization rules per page using <location...> as mentioned earlier in css case....
Check this for more info:
http://weblogs.asp.net/gurusarkar/archive/2008/09/29/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config.aspx

Also when I use User.Identity.Name it gives me my PC name and not the user name entered at login.

Is this from the webconfig settings?

Beautiful, I think it's put together, thank you for staying on top of this.

now that all is set, if i close the browser, will it remember my username and password and automatically log me in?

Try it and see... it should...
also you through the link I provided earlier ...
It shows how to set different attributes for FormsAuthentication.
One important to note is "timeout" you can set it to too high value ..default is 30 min.
This along with Persistent should do the job....but again client should be accepting cookies.

sounds good, 1 more thing before i let you go,

when I go to my signin.aspx page it sends me to this link:

...login.aspx?ReturnUrl=%2fnet%fadmin%fsignin.aspx


what attribute can change this?

hope loginUrl was correct...if not set it accordingly to your login page url