Strong Password encryption program?

I have a web-based program that will be going to an external web server and
want to create a logon process. I am using forms authentication, passing
encryption with salt, but want to force the user to create passwords with
rules: combinations of numbers & letters, at least one character caps,
things like that, like we would on a a network, and to change the password
every x amount of months. Can anyone point me in the right direction as to
any articles that may help me do this, or the correct process?

Thanks for your help.This is handled at multiple places:

1) Forms authentication allows a user to login into the system for a
session or for a certain amount of time. The way you are handling is
good enough.
2) To have a set of rules for a password, you may use regular
expressions on ASP.NET password textboxes. Search google.
Alternatively, you can write your own logic to validate in code-behind
file or have a trigger in the database of password field, that verifies
the requirement.
3) Password expiry should be maintained by your database logic.
Whenever, a password is updated, update the last updated date and
whenever user login, check if the last updated date is beyond the valid
date time frame. If so, force user to create a new password.

If there are any other ways, please contribute. I'll love to know more
varieties.

Thanks,
Aru
Hello KatMagic,

If you haven't already, take a look at the SqlMembershipProvider api in
ASP.NET 2.0. It has some of what you want built in:

> Configurable password strength
> Automatic lockout
> Minimum number of non-alphanumeric
> Security question/answer
> ...

The membership data are stored in SQL so you have access to the tables,
stored procedures, and functions if you want to customize.

--
enjoy - brians
http://www.limbertech.com

Strong Password encryption program?

I have a web-based program that will be going to an external web server and
want to create a logon process. I am using forms authentication, passing
encryption with salt, but want to force the user to create passwords with
rules: combinations of numbers & letters, at least one character caps,
things like that, like we would on a a network, and to change the password
every x amount of months. Can anyone point me in the right direction as to
any articles that may help me do this, or the correct process?
Thanks for your help.This is handled at multiple places:
1) Forms authentication allows a user to login into the system for a
session or for a certain amount of time. The way you are handling is
good enough.
2) To have a set of rules for a password, you may use regular
expressions on ASP.NET password textboxes. Search google.
Alternatively, you can write your own logic to validate in code-behind
file or have a trigger in the database of password field, that verifies
the requirement.
3) Password expiry should be maintained by your database logic.
Whenever, a password is updated, update the last updated date and
whenever user login, check if the last updated date is beyond the valid
date time frame. If so, force user to create a new password.
If there are any other ways, please contribute. I'll love to know more
varieties.
Thanks,
Aru
Hello KatMagic,
If you haven't already, take a look at the SqlMembershipProvider api in
ASP.NET 2.0. It has some of what you want built in:

> Configurable password strength
> Automatic lockout
> Minimum number of non-alphanumeric
> Security question/answer
> ...
The membership data are stored in SQL so you have access to the tables,
stored procedures, and functions if you want to customize.
enjoy - brians
http://www.limbertech.com

Strongly Type Web Forms

How does a User Control invoke a method on its parent page? Say I have a publicMethod in code behind for an aspx page:
...
public void SomeImportantMethod() { /* do important stuff */}
...
From an Event Handler within the User Control, I'd like to invoke a method on the page in which the User Control is embedded. If I stop in the debugger and inspect this.Page, I see that it has a type of "ASP.MyAspxPage"... where did that come from? Can I delcare it intentionally somewhere?
TIA,
Geo
Your MyAspxPage is your custom page class, which inherits from the System.Web.UI.Page class.
The thing with UserControls is though, that you don't know what parent page they could be in at run-time.
So, to be safe, if you want to call a particular method on the parentPage, I'd say let your Page implement your interface which contains themethod signature (and other stuff if you want).
In your UserControl you then do a defensive cast (using the as keyword)to that interface and check for != null. You then simply call yourmethod on your interface object.
Hope that helps.
Wim

Yes, that does help. It helped in that I was hung up in anold paradigm and should get over it and just use an interface. So, thanks, that helped me get the job done.
I guess I was stuck in theOLD ASP.NET 1.1 code behind days where an ASPX page would have a code behind page which had a namespace declaration and the web form would be a public class derived from System.Web.UI.Page. So, from any C# code I could say:
MyNamespace.MyPage myPage = this.Page as MyNameSpace.MyPage;
if ( myPage != null)
{
myPage.MyMethod("hello world");
}
else
{
Response.Write("what gives?");
}
No fuss no muss, no interfaces.
I think I better go find an article or 2 on code beside or what ever it is we call it now.
Thanks again,
geo

Hello.

I think that you can also use the @.reference directive to introduce the type of the page in the user control (haven't tried it though).