Hi all,
I've implemented a custom membership provider (as the user credentials are stored in a legacy application), however, the website is exhibiting two behaviours which it shouldn't.
Firstly, it's not tracking invalid password attempts. My website does not use questions and answers, but according to MSDN (http://msdn.microsoft.com/en-us/library/f1kyba5e(v=VS.90).aspx) the "ValidateUser" method should still track them. When I put a breakpoint on the MaxInvalidPasswordAttempts property it is never even accessed.
Secondly, when I manually lock out a user, I can still log in with those credentials (I have confirmed that the MembershipUser object returned by the GetUser method during the login has the "IsLockedOut" property set correctly).
The config file ...
Go to the complete details ...