Member Avatar for visweswaran28

Hi,

I am working on membership concepts in asp.net. Now i want to reset new password and getpassword for specific user.

this is my web.config code:

<add name="MySqlMembershipProvider" connectionStringName="SQL2005DB380ConnectionString" applicationName="MyAppName" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" passwordFormat="Encrypted" enablePasswordReset="true" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>

How can I get old password and reset new password.

  • 3 Contributors
  • 2 Replies
  • 3K Views
  • 6 Years Discussion Span
  • Latest Post Latest Post by Jitesh Kumar_1

Dani AI

Generated

Adding a couple of gotchas and a safe workflow:

  • To retrieve the existing password, the SqlMembershipProvider must be storing passwords as Encrypted (not Hashed) and you must enable password retrieval. Otherwise GetPassword throws. In practice this means setting enablePasswordRetrieval="true" in your provider config; if passwords are Hashed, retrieval is impossible by design. See the Microsoft guidance on GetPassword/ResetPassword behavior and flags, and the provider source that blocks retrieval when passwordFormat="Hashed". Implementing a Membership Provider and SqlMembershipProvider reference source. (learn.microsoft.com, referencesource.microsoft.com)

  • A pragmatic admin flow to set a specific new password without knowing the old one (and without emailing a password) is: unlock if needed, reset to a temporary random password, then change to the final password. Note a locked-out user cannot reset until unlocked, and failed answers can cause lockout if Q/A is enabled. Recovering and Changing Passwords (C#). (learn.microsoft.com)

// Admin-set new password safely
var user = Membership.GetUser(username);
if (user == null) throw new InvalidOperationException("User not found.");
if (user.IsLockedOut) user.UnlockUser();

string temp = Membership.Provider.ResetPassword(username, null); // null because Q/A disabled
bool ok = Membership.Provider.ChangePassword(username, temp, "NewStr0ngP@ssw0rd!");
  • If you truly must support GetPassword with Encrypted storage, also pin a static <machineKey> (validationKey/decryptionKey) in Web.config. Auto-generated keys can make encrypted passwords unrecoverable across app restarts or servers. Microsoft’s security column explains why this matters. Security Briefs: SqlMembershipProvider and machineKey. (learn.microsoft.com)

Tip: @Jitesh_Kumar_1’s reset-then-change idea is on the right track; the provider-level version above adds the unlock step and avoids relying on a stale MembershipUser instance.

Recommended Answers

All 2 Replies

Member Avatar for dnanetwork

Retrieving information about a particular user is just as easy, using the GetUser method. This method takes the user name and returns a MembershipUser object:

MembershipUser user = Membership.GetUser("AndreaS")

Once you've got a MembershipUser object, you know all you need to know about a particular user, and you can, for example, programmatically change the password. An application commonly needs to support several operations on passwords, such as changing or resetting it, or sending it to a user (possibly with a question/answer challenge protocol). These functions are all supported by the Membership API, but not necessarily by the underlying provider. If the provider does not support a given feature, an exception is thrown when the method is invoked.

To use the ChangePassword method, you must supply the old password in addition to the new password:

Dim user As MembershipUser = Membership.GetUser("AndreaS")
   user.ChangePassword(user.GetPassword(), newPassword)

This, however, might not work in some implementations, such as if you configured the membership system to store the passwords in your database hashed and/or salted—a common security measure. In this case, the original password cannot be retrieved, and resetting the password is the only option available if the user has forgotten the current password. To reset the password, you use the

ResetPassword method:

Dim user As MembershipUser = Membership.GetUser("AndreaS")
string newPassword = user.ResetPassword()

The subsystem of your application that calls ResetPassword is also in charge of sending the new password to the user (for example, via e-mail). Both the GetPassword and ResetPassword methods have a second overload that takes a string parameter. If specified, this string represents the answer to the user's "forgot password" question.

The ability to reset a password, as well as support for a password challenge, is specific to the provider and is configured in the Web.config file. The password challenge question is exposed as a read/write member of the MembershipUser class. When the user is created, the challenge question and answer must be set and stored in the membership database.

Edited by dnanetwork because: n/a
Member Avatar for Jitesh Kumar_1

MembershipUser mu = Membership.GetUser(username);
mu.ChangePassword(mu.ResetPassword(), password);

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.