Itself has understood

Hello Sergey,

Am I getting it right -- that you have been able to make this by yourself?

Which principle / devnet article do you mean in particular?


Anyway, the key steps of this solution (to be general) would be:

- create CustomSecurityHandler and in its OnAuthentication method test if the user is not yet authenticated, and optionally find the user by the email (as we suppose the email has been entered instead of username),
-- authenticate against entered password and return the UserInfo object.

- in each logon webpart (e.g. LogonForm), in Login1_LoggedIn() method, ensure setting the proper FormAuthenticationCookie (for the real username, not the email passed through the username textbox).


Regards,
Zdenek C.