Some time ago MS defined web services that would allow an app to authenticate against the ASP .Net membership provider. Check them out.

---

Best wishes,
- Richard
Agile Development Consultant, Practitioner, and Trainer
www.dynamisys.co.uk

Hi Cathal,

Thanks for the info.

•  you say you're taking the hashed password - you cannot decrypt a hash, you can only decrypt if using encryption (hashing is a one way operation)

Yeah, I was using the term too loosely.  Also, I know DNN offers two methods of storage, one which uses hashing and one which uses encryption.  I am fairly sure these use the decryption method (2), but I wasn't 100% sure.  

• your code is definately wrong, as you need to use the machinekey decryptionkey (which is unique to each dotnetnuke install) - whilst the final value is base64 encoded that is just for storage, you need to first base64 decode and then you need to decrypt using a combination of that value, the salt and the decryption key. Whilst this is doable in code, it's much easier to simply call the sqlmembership provider methods -http://www.byteblocks.com/post/2011/0... is a good example

Thanks for the link.  I read through that post, and it seems the actual decryption is delegated to the NetFourMembershipProvider.  However, after googling I was unable to find the source code or any documentation for that class, which I'd need to re-implement.  Do you know where I'd find that.

Also, that byteblocks article is showing how to decrypt the password, which is actually more than I need to do.  For me, it would suffice to be able to encrypt other strings using the same algorithm/salt/machine key that was used to encrypt the original password.  Then I could test if they match.  I don't know if the encryption direction is easier to implement than the decryption direction, but I thought I'd clarify in case it was.

Jonah

Hi Mike,

Unfortunately, that's not a good option for us. We need the system to work independently of any .NET services. That is, the only dependency can be on the database itself. Creating a web service means that we've created a dependency on that service and all its infrastructure. If C# and .NET vanished from the face of the earth tomorrow, our solution should still work as long as that database is up and running.

So the only solution here, I think, is to get my hands dirty with the bowels of that NetFourMembershipProvider.

Thanks for the idea though.

Jonah