cannot creat new users?!(1.4 version)

Topics: ASP.NET 2.0, Controls
Jul 4, 2008 at 3:36 PM
Hi. Thanks for the new version. It seems that some of the features are not working.
I creat new users but when I want to login I see the following error: 
Your login attempt was not successful. Please try again.

I modified the config and it worked but for the next user I created again I got the same problem so anytime I have to modify the config file but just simply inserting a aspace inside it.
Would you please help me?
Jul 6, 2008 at 1:33 PM
You need write permissions on the users.xml and roles.xml files in the App_Data folder. If you have that, then it probably is the read-only flag on the xml files. Try to download the users.xml and roles.xml to your own computer and uncheck the read-only flag. Then upload again.
Jul 6, 2008 at 2:26 PM


I am having the same problem as lovencare.  I have checked the read-only addributes as you described and they are not on.  In addition, I have verified that the new users are being written to the users.xml and roles.xml files, so the write permission is definitely granted.

The Admin account is the only 1 that I can log in with.  Any users that I create result in the unsuccessful login that lovencare highlighted, even though they are defined in the users.xml file.  Is it possible there an anomoly with the password encryption that is being used when a new user is created?

I should also point out that this isn't an upgrade for me, rather a fresh brand new install.

I am very new to "blogging", but this software is very well done!

Jul 6, 2008 at 11:18 PM
I was having the same problem, but then the problem just went away after a while (after the session expired?), and I could login as another user, and deleted the default admin user.
Jul 7, 2008 at 2:56 PM
1.4 uses encrypted passwords, so if you have it in the plain text on your blog, validation will fail - it is trying to match encrypted password against saved in plain text. Try to run locally, set password and then copy this encrypted password to your host site. Then you should be able to authenticate.
Jul 7, 2008 at 5:36 PM
Hi Dear rtur,
thanks for your help but you know the other administrators don't have access to the codes or don't know anything about Visual studio or .net! They just want to use the blog. So would you please eliminate the problem from the codes you have written ?
Jul 8, 2008 at 1:22 AM

lovencare wrote:
Hi Dear rtur,
thanks for your help but you know the other administrators don't have access to the codes or don't know anything about Visual studio or .net! They just want to use the blog. So would you please eliminate the problem from the codes you have written ?

:) thanks, lovencare; I did not write that code, I had same issue and just wanted share a fix I used. My understanding is that it only happens when you update from 1.3 to 1.4 without changing password - I forgot to do that and so might someone else.
Jul 8, 2008 at 4:01 AM
I had a clean install of 1.4 and experienced the same issue. I wasn't able to create new users until I forced the session on the site to restart by editing and saving the web.config file. There seems to be an issue here.

Jul 8, 2008 at 6:48 AM
Same problem for me on a fresh new install.
Jul 20, 2008 at 4:50 PM
There's a soluton here

Summary: Replace the default machineKey in web.config with one from this site:
Jul 24, 2008 at 9:59 PM
Did this work for anyone? Did not work me.
Jul 25, 2008 at 2:51 AM
Replacing the default machineKey did not work for me either. Checked my files, none read only. Hmmmmmm.....
Jul 25, 2008 at 3:04 PM
I have the same situation as mmarble.  I set up a new user, but cannot log in with that user. This is a first time installation on my local machine which was done a few days ago.  I have not yet installed on a production web server.  On the local machine, all files have "read only" flag removed.  So far, my fix is similar to bluepixel.  On the local machine, I stopped the Development server.  Then from Web Express restarted the web site.  That worked.....  Simply stopping and starting the browser was not enough.  Hope this helps.
Jul 26, 2008 at 3:01 PM

I have the same situation on 2 different computers: a local Vista computer, and a GoDaddy-hosted Web site.

  • 1.4 clean install
  • no read-only attribute - newly-created users and hashed passwords are saved successfully to the files
  • only admin can log in - newly-created users cannot log in

I suspect that this is somehow related to the hashing of passwords, but don't know enough about encryption to troubleshoot it myself!


Jul 27, 2008 at 12:02 AM
Edited Jul 27, 2008 at 12:03 AM
After I add a user I can restart IIS (application) or save the web.config file, no need to replace the machine key. All newly created users can then log in.
Jul 28, 2008 at 10:59 PM

Changing the Web.config file did not seem to work for us, on a shared hosting (GoDaddy) site. And I hope that no one considers that an acceptable option for adding a new user anyway.   :-)


Jul 29, 2008 at 9:55 PM
That definately is not a valid solution. The problem is specifically with the newer version as version 1.3 did not do this to me. I also have this problem, and yes, restarting IIS allows the user to login. Most of us however host on a webserver that is shared and not dedicated, so we can't just restart IIS whenever we want, even if it was a temporary fix. For those of you having this problem, I would suggest running this project locally using Visual Studio 8 Express (which is free), or download a copy of version 1.3 (which I cannot seem to find on Codeplex).

Anyways, I'm sure a developer will someday read this forum and go "oops" I broke that. I have check the encryption of the passwords and that is NOT the problem. It encrypts the passwords the same way, it has something to do with the XML Membership class that they are using that is not updating itself with the Users.xml file. I'm still debugging, but I doubt I'll spend much more time on this rediculous issue. Honestly they released 1.4 with a huge security problem that needs patched and now something as simple as "Creating another user" does not function. I would say, slow down, and please let users beta test these new versions before you release them to the "average joe".

-Sethmatics Developers
Aug 8, 2008 at 1:52 PM
While running 1.4 (clean install, no upgrade) I was experiencing this same issue. Thanks to all the help in this thread (and this one: I've got it taken care of.

I actually didn't have to modify web.config, and my permissions to the App_Data folder were set correctly. So what worked? Running an IISreset. Seems a bit silly to do this every time I add a new user to the blog, but at least it works. The frustrating part is that a lot of "you folks" probably don't have console access to your hosting server(s) so this isn't a possibility for you. Hopefully/maybe the other fixes will work for you; and, even more hopefully, the team will kick out a fix soon =)

I've tested this several times now on both my development and live server (same installation scenarios) and it seems to be the end-all fix.
Aug 8, 2008 at 4:30 PM
Edited Aug 8, 2008 at 4:33 PM
Can anyone help a newbie? I want to have an open blog setting where anyone can immediately create an account and begin posting.
Or if possible, blog without creating an account. It has to be possible. I must be blind or looking at the wrong setup docs.