Using ASP.Net Forms and ASP.Net MVC 3 (combined – we are in process of changing Web Forms to MVC), I have a scenario where a person authenticates (user name / password) but due to a specific condition existing on their account, they are required to change their password before proceeding.
Since the user is already authenticated, is there a global location where I can prevent any access to the portions of the site that require authentication until they enter their new password? I understand that there might have to be 2 locations (one for Web Forms, the other for MVC).
In Application_AuthenticateRequest check for the specific condition. If not met (ie they must change pwd), redirect to the proper page. This should work for MVC and WebForms.