I have a very odd problem. I have a web app that uses the .NET Membership API to provide login functionality.

This works fine on my local dev machine, using WebDev 4.0 server.

I'm using .NET 4.0 with some URL Rewriting, but not on the pages where login is required.

I have a Windows Server 2008 with IIS7

However, the Membership API seemingly does not work on the server. I have set up remote debugging and the LoginUser.LoggedIn event of the LoginUser control gets fired okay, but the MembershipUser is null. I get no answer about the username/password being invalid so it seems to be recognising it.

If I enter an invalid username/password, I get an invalid username/password response.

Some code, if it helps:

    <asp:ValidationSummary ID="LoginUserValidationSummary" runat="server" CssClass="validation-error-list" 
         ValidationGroup="LoginUserValidationGroup"/>
    <div class="accountInfo">
        <fieldset class="login">
            <legend>Account Information</legend>
            <p>
                <asp:Label ID="UserNameLabel" runat="server" AssociatedControlID="UserName">Username:</asp:Label>
                <asp:TextBox ID="UserName" runat="server" CssClass="textEntry"></asp:TextBox>
                <asp:RequiredFieldValidator ID="UserNameRequired" runat="server" ControlToValidate="UserName" 
                     CssClass="validation-error" Display="Dynamic" ErrorMessage="User Name is required." ToolTip="User Name is required." 
                     ValidationGroup="LoginUserValidationGroup">*</asp:RequiredFieldValidator>
            </p>
            <p>
                <asp:Label ID="PasswordLabel" runat="server" AssociatedControlID="Password">Password:</asp:Label>
                <asp:TextBox ID="Password" runat="server" CssClass="passwordEntry" TextMode="Password"></asp:TextBox>
                <asp:RequiredFieldValidator ID="PasswordRequired" runat="server" ControlToValidate="Password" 
                     CssClass="validation-error" Display="Dynamic" ErrorMessage="Password is required." ToolTip="Password is required." 
                     ValidationGroup="LoginUserValidationGroup">*</asp:RequiredFieldValidator>
            </p>
            <p>
                <asp:CheckBox ID="RememberMe" runat="server"/>
                <asp:Label ID="RememberMeLabel" runat="server" AssociatedControlID="RememberMe" CssClass="inline">Keep me logged in</asp:Label>
            </p>
        </fieldset>
        <p class="login-action">
            <asp:Button ID="LoginButton" runat="server" CommandName="Login" CssClass="submitButton" Text="Log In" 
                 ValidationGroup="LoginUserValidationGroup"/>
        </p>

and the code behind:

protected void Page_Load(object sender, EventArgs e)
    {
        LoginUser.LoginError += new EventHandler(LoginUser_LoginError);
        LoginUser.LoggedIn += new EventHandler(LoginUser_LoggedIn);
    }

    void LoginUser_LoggedIn(object sender, EventArgs e)
    {
        // this code gets run so it appears logins work
        Roles.DeleteCookie(); // this behaviour has been removed for testing - no difference
    }

    void LoginUser_LoginError(object sender, EventArgs e)
    {
        HtmlGenericControl htmlGenericControl = LoginUser.FindControl("errorMessageSpan") as HtmlGenericControl;
        if (htmlGenericControl != null) htmlGenericControl.Visible = true;
    }

I have "Fiddled" with the Login form reponse and I get the following Cookie-Set headers:

Set-Cookie: ASP.NET_SessionId=lpyyiyjw45jjtuav1gdu4jmg; path=/; HttpOnly
Set-Cookie: .ASPXAUTH=A7AE08E071DD20872D6BBBAD9167A709DEE55B352283A7F91E1066FFB1529E5C61FCEDC86E558CEA1A837E79640BE88D1F65F14FA8434AA86407DA3AEED575E0649A1AC319752FBCD39B2A4669B0F869; path=/; HttpOnly
Set-Cookie: .ASPXROLES=; expires=Mon, 11-Oct-1999 23:00:00 GMT; path=/; HttpOnly

I don't know what is useful here because it is obviously encrypted but I find the .APXROLES cookie having no value interesting. It seems to fail to register the cookie, but passes authentication