ASP.NET MVC ActiveDirectoryMembershipProvider user stays logged in even when password has changed

Question

I am using ActiveDirectoryMembershipProvider in my web app. I authenticate users with their domain credentials like so

if (Membership.ValidateUser(m.Username, m.Password))
    FormsAuthentication.SetAuthCookie(m.Username, true);

This works well.

But even when the user's password is changed in active directory, the user stays logged in to the web app?

How can I ensure the user does not stay logged in to the web app if their domain password changes, or their account is disabled etc?

Answer 1

The answer is to periodically (every 30 minutes or so) check User.IsApproved and User.LastPasswordChangedDate to make sure the users credentials are still valid.

To do this you need to manually create the FormsAuthenticationTicket and cookie, rather than using FormsAuthentication.SetAuthCookie.

Put the date you validated the user inside UserData and compare this against LastPasswordChangedDate.

I've implemented this and it works perfectly.

More information here

Check if Active Directory password is different from cookie