Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I've been developing a SharePoint Server 2010 site, which uses Forms Based Authentication. As part of my custom login script, I used the following C# code:

System.IdentityModel.Tokens.SecurityToken token = SPSecurityContext.SecurityTokenForFormsAuthentication(new Uri(SPContext.Current.Web.Url), Membership.Providers["FBAMembershipProvider"].Name, Roles.Providers["FBARoleProvider"].Name, FBAUserName, FBAPassword);
SPFederationAuthenticationModule.Current.SetPrincipalAndWriteSessionToken(token);

On my dev server it works just fine, creating the appropriate token and allowing a user to be logged in with FBA.

However, I'm now transferring all my code to a new SharePoint Server 2010 server, and the code above isn't working. The first line returns a token with a null value.

Can anyone help me understand why?

In the back of my mind I'm thinking that I need to install something on the new server, but I can't for the life of me remember what it is. Something like ADSF, or similar acronym. I check the Control Panel > Programs and Features on the old server, but couldn't see anything that might be relevant.

Any ideas?

[update] Following Anders Rask's request for the ULS logs, I think I found the cause of my issue. Now I need to find the solution (I think I've seen this before)

10/18/2011 22:07:24.65  w3wp.exe (0x0968)                           0x0758  SharePoint Foundation           Claims Authentication           0000    Unexpected  Password check on 'mytest@email.com' generated exception: 'System.Configuration.Provider.ProviderException: You must specify a non-autogenerated machine key to store passwords in the encrypted format. Either specify a different passwordFormat, or change the machineKey configuration to use a non-autogenerated decryption key.     at System.Web.Security.MembershipProvider.EncryptPassword(Byte[] password)     at System.Web.Security.MembershipProvider.EncodePassword(String pass, Int32 passwordFormat, String salt)     at System.Web.Security.SqlMembershipProvider.CheckPassword(String username, String password, Boolean updateLastLoginActivityDate, Boolean failIfNotApproved, String& salt, Int32& passwordFormat)     at System.Web.Security.SqlMembershipProvider.ValidateUser(String username, Str...    
10/18/2011 22:07:24.65* w3wp.exe (0x0968)                           0x0758  SharePoint Foundation           Claims Authentication           0000    Unexpected  ...ing password)     at Microsoft.SharePoint.IdentityModel.SPFormsUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)'.  
10/18/2011 22:07:24.65  w3wp.exe (0x0968)                           0x0758  SharePoint Foundation           Claims Authentication           fo1t    Monitorable SPSecurityTokenService.Issue() failed: System.ServiceModel.FaultException`1[Microsoft.IdentityModel.Tokens.FailedAuthenticationException]: The security token username and password could not be validated. (Fault Detail is equal to Microsoft.IdentityModel.Tokens.FailedAuthenticationException: The security token username and password could not be validated.).   
10/18/2011 22:07:24.66  w3wp.exe (0x0E00)                           0x11DC  SharePoint Foundation           Claims Authentication           fsq7    High        Request for security token failed with exception: System.ServiceModel.FaultException: The security token username and password could not be validated.     at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response)     at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)     at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)     at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo)  4acf80d8-9c59-457f-a859-60f8a9af6d46
10/18/2011 22:07:24.66  w3wp.exe (0x0E00)                           0x11DC  SharePoint Foundation           Claims Authentication           8306    Critical    An exception occurred when trying to issue security token: The security token username and password could not be validated..    4acf80d8-9c59-457f-a859-60f8a9af6d46
share|improve this question
    
I take it that you remembered to provision web.config changes to the new site? (membership and roleprovider settings) –  Anders Rask Oct 18 '11 at 20:21
    
Yeah, I followed Donal Conlon's guide to configuring FBA, as I'd done on the old server, and updated the 3 web.configs (Central Admin, Security Store Web Service, my Web Application). I checked them again, and as far as I can see, they are all correct. –  QMKevin Oct 18 '11 at 20:29
    
please add relevant errors and ULS logs –  Anders Rask Oct 18 '11 at 20:50
    
In order to get more characters for the log entries, I updated my original question, above. Thank you for suggesting the logs.. I wasn't expecting it to be there (but now I know EVERY error goes there), and I think I located the issue. –  QMKevin Oct 18 '11 at 21:14

1 Answer 1

up vote 1 down vote accepted

yeah i have seen this before as well, and it has hit me in production as well ;-)

Are you using ProtectedData in .NET to encrypt passwords? http://msdn.microsoft.com/en-us/library/system.security.cryptography.protecteddata.unprotect.aspx

my guess is that you are seeing this now because your production environment is multi-server, and your development environment is single server. Encryption works fine with machine key as long as you are on a single server, but it breaks when you run on several servers.

share|improve this answer
2  
I marked this as the answer, but for me it was simply that my SecurityTokenServiceApplication web.config was using an auto-generated machinecode, while the SharePoint web application was using a specified one. Once I copied the specified machinecode to the STSA, everything worked. I think I'll still be using a single server setup when I finally move into production, but if that changes then your answer will be 110% correct :) Thanks again for the help. –  QMKevin Oct 20 '11 at 14:10
    
@QMKevin worked for me too. STSA machine key was the issue. Thanks :) –  Ishan Mar 15 '13 at 6:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.