通知用户有关帐户锁定的信息，即在ASP .NET MVC2下

Question

I have to implement " Your Account is Locked! " message for the SqlMembershipProvider in MVC2 project.

How I can do it?

Basically my code to logon looks like:

[RequireHttps]
[HttpPost]
public ActionResult LogOn(LogOnModel model, string returnUrl)
{
      if (ModelState.IsValid)
      {
                if (MembershipService.ValidateUser(model.UserName, model.Password))
                {
                     FormsService.SignIn(model.UserName, model.RememberMe);

                     UserProfile profile = UserProfile.GetUserProfile(model.UserName);

                 //.... 
                }
                else
                {
          ModelState.AddModelError("", "The user name or password provided is incorrect.");
        }
   }

   return View(model);
}

Answer 1

Is it just like normal membership?

MembershipUser user = Membership.GetUser("Username")

if (user != null && user.IsLockedOut)
{
    return View("YourPasswordIsTooAmbiguousSoYouGotLockedOut");
}

MSDN: Membership.GetUser(string username)

- Side Note -

The order in which you do authentication is really a Security & UX thing. I'd suggest the following pseudo-code (but I'm no expert):

public ActionResult LogOn(LogOnModel model)
{
    // Is model valid?
    if (!ModelState.IsValid)
    {
        this.ViewData["LogOnError"] = "Bad Credentials.";
        return this.View(model);
    }

    // Is user valid?
    if(!MembershipService.ValidateUser(model.UserName, model.Password))
    {
        this.ViewData["LogOnError"] = "Wrong Credentials.";
        return this.View(model);
    }

    MembershipUser user = Membership.GetUser(model.UserName);

    // Was the user deleted in the last nano-second?
    if (user == null)
    {
        this.ViewData["LogOnError"] = "Race Condition: User previously deleted.";
        return this.View(model);
    }

    // Is user locked out?
    if(user.IsLockedOut)
    {
        this.ViewData["LogOnError"] = "You are locked out.";
        return this.View(model);
    }

    // Sign the user in.
    FormsService.SignIn(model.UserName, model.RememberMe);

    return this.View("LogOnSuccessful");
}

Answer 2

From your code I can tell you're already using ModelState to show errors to user. So you may do the same for informing about locked account. Before your validation part of code do the following:

[RequireHttps]
[HttpPost]
public ActionResult LogOn(LogOnModel model, string returnUrl)
{
      if (ModelState.IsValid)
      {
           UserProfile profile = UserProfile.GetUserProfile(model.UserName); // Moved this here because locking check should be done before ValidateUser()
           if (profile != null && !profile.IsLockedOut)
           {

                if (MembershipService.ValidateUser(model.UserName, model.Password))
                {
                     FormsService.SignIn(model.UserName, model.RememberMe);

                 //.... 
                }
                else
                {
                    ModelState.AddModelError("", "The user name or password provided is incorrect.");
                }
        }
        else
        {
           ModelState.AddModelError("", "The user account does not exist or has been locked out.");
        }
   }

   return View(model);
}