Unable to login using the password generated by Asp.Net 4 Membership Provider Reset Password

Hi,

I'm developing an application using ASP.NET 4 MVC 3. I'm using the default AspNetSqlMembershipProvider. We are resetting the password using MembershipUser.ResetPassword() function. The method is working fine and resetting the password in the database successfully and returning the new random generated password.

The situation is we are unable to login to our application using the new password.

FYI: my reset call is followed by the user.UnLock() method.

MembershipUser user = Membership.GetUser(userName);
if (user == null)
throw new DataNotFoundException("Invalid User.");
string newPassword = string.Empty();
var isUnlock = user.UnlockUser();
if(isUnlock)
newPassword=user.ResetPassword();
return newPassword;

Any help in this regard is appreciated.

Thanks & Regards

Re: Unable to login using the password generated by Asp.Net 4 Membership Provider Reset Password

If you are using the Membership Provider, you need to use the Mebership Provider to add users to the system.

That's why most of use chose to roll our own login process by creating a Login view and an AccountController.

The way "Pro ASP.Net MVC 3 Framework" teaches it, the first step is to create an Interface called IAuthProvider with a single method:
bool Authenticate( string memberName, string password );

Next you would create a Concrete class called FormsAuthProvider that implements the IAuthProvider interface. It is this Concrete FormsAuthProvider class that authenticates users against the database store.

You will need to find a way to get the FormsAuthProvider into you AccountController and that is usually done in one of two ways:

1) Using NInject to pass it in via a reference to the IAuthProvider interface, or
2) Creating a property of type IAuthProvider and setting that property from your first controllers constructor.

If you are using a Salted Hash for the passwords (as you should be doing), there is no way to create a Reset Password process, instead I create two ChangePassword methods, one that logged in users can use, and one for the AdminConroller that only the site's Admin has access to that can reset the password for any user.

Re: Unable to login using the password generated by Asp.Net 4 Membership Provider Reset Password

eric2820

If you are using the Membership Provider, you need to use the Mebership Provider to add users to the system.

That's why most of use chose to roll our own login process by creating a Login view and an AccountController.

The way "Pro ASP.Net MVC 3 Framework" teaches it, the first step is to create an Interface called IAuthProvider with a single method:
bool Authenticate( string memberName, string password );

Hi eric,

Thanks for your reply.

I'm using the same login process, view and account controller. Every thing is working fine including login, logout, change password and resetting the password. After resetting the password we are unable to log into the application using the new password.

I've checked with the hashAlgorithm by mentioning the <machinekey validation="SHA1"> in System.Web and hashAlogrithm="SHA1" in membership tags (everything is working fine except the reset password).

but it's no use.

Re: Unable to login using the password generated by Asp.Net 4 Membership Provider Reset Password

To use a Salted Hash, you should be using:

public bool Verify( string clrPassword, decimal memberId, IDataProvider db )
{
Identity id   = db.Identity.First( i => i.Id == memberId );
Salt     salt = null;
if ( db.Salt.Count() != 0 && id.SaltIndex != 0 )
        salt = db.Salt.FirstOrDefault( s => s.Id == id.Id );

if( salt == null )
{
   byte[] SaltStr;
      id.EncPassword = Utility.Encode( id.Password, out SaltStr );
   long count = db.Salt.Count() + 1;
      id.SaltIndex = count;
      id.Password = "";
      salt = new Salt( (decimal) count, id.Id, SaltStr, db );
      db.Identity.SqlQuery( "Update [Identity] set [EncPassword] = @EncPassord, [Pasword] = @Password, [SaltIndex] = SaltIndex Where [Id] = @Id", new { id.EncPassword, id.Password, id.SaltIndex, id.Id } );
}

return Utility.ValidatePassword( clrPassword, id.SaltIndex, id.EncPassword, db );
}

Utility class methods:

public static byte[] Encode( string password, out byte[] salt )
{
      Rfc2898DeriveBytes rdb = new Rfc2898DeriveBytes( password, 128, 10000 );
      salt = rdb.Salt;
    return rdb.GetBytes( 128 );
}

public static bool ValidatePassword( string password, decimal saltIndex, byte[] encPassword, IDataProvider db )
{
   Rfc2898DeriveBytes rdb;
   var salt = db.Salt.FirstOrDefault( s => s.Id == saltIndex );
   if ( salt == null )
   {
         return false;
      }

      rdb = new Rfc2898DeriveBytes( password, salt.SaltStr, 10000 );
   byte[] passwordEnc = rdb.GetBytes( 128 );
   return Utility.isSameByteArray( encPassword, passwordEnc );
}

private static bool isSameByteArray( byte[] a, byte[] b )
{
      if ( a.Length != b.Length )
      return false;
   for ( int i = 0; i < a.Length; ++i )
   {
          if ( a[ i ] != b[ i ] )
        return false;
      }

      return true;
}

I use Utility.Encode( string password, out byte[] salt ) to generate the hashes.

But beware, I'm having the same issue you have, when a new password is hashed the user is unable to log in!

Re: Unable to login using the password generated by Asp.Net 4 Membership Provider Reset Password

Finally, I've found the root cause for the problem and obviously solution.

This situation was raised because of the mismatch of hashAlogorithmType used in the application. The default hashAlgorithmType in ASP.NET 4 is "HMACSHA256". Initially, when I added an admin account to the database using the ASP.Net configuration tool, it hashed the password with "SHA1" hashing algorithm. When I tried to reset the password using the ASP.NET Membership API, it was successfully reset the password. But using the default hashing algorithm "HMACSHA256".

That made me crazy when I tried to login using the new password generated by API.

Finally I've added the below code line and set the break point just before calling the API's reset method.

var hashAlgorithmType = Membership.HashAlgorithmType;
my complete code looks like below

MembershipUser user = Membership.GetUser(userName);
if (user == null)
throw new DataNotFoundException("Invalid User.");
string newPassword = string.Empty();
var isUnlock = user.UnlockUser();
var hashAlgorithmType = Membership.HashAlgorithmType;
if(isUnlock) newPassword=user.ResetPassword();
return newPassword;

It has given me the hint about the default hashing algorithm using by the API.

then I've added an attribute to tag in web.config like below

and tried again with resetting the password and login using the generated password.

Wow! it's working.