asp.net membership change password without knowing old one

Question

Evaluting the method signature, it is required to know old password while changing it.

membershipUser.ChangePassword(userWrapper.OldPassword, userWrapper.Password)

Is there any way to change password without knowing old one.

Dareen

Answer 1

 string username = "username";
 string password = "newpassword";
 MembershipUser mu = Membership.GetUser(username);
 mu.ChangePassword(mu.ResetPassword(), password);

Microeconomics

Note that enablePasswordReset option must be enabled in web.config membership provider configuration – Sanorasans

Why can't you just use mu.GetPassword(); instead of mu.ResetPassword(); ? – Tautologism

@RMiranda you could use GetPassword but only if you're storing encrypted passwords in the database when you should be hashing them: security.blogoverflow.com/2011/11/… – Immersionism

ResetPassword() returns new password. But first parameter of ChangePassword() represents old password. I don't understand. How to exactly works ResetPassword() method? – Shanel

Answer 2

The other answers here are correct, but can leave the password in an unknown state.

ChangePassword will throw exceptions if the password doesn't meet the requirements laid out in Web.Config (minimum length, etc.). But it only fails after ResetPassword has been called, so the password will not be known to the original user or to the person who's tried to change it. Check for complexity requirements before changing the password to avoid this:

var user = Membership.GetUser(userName, false);

if ((newPassword.Length >= Membership.MinRequiredPasswordLength) &&
    (newPassword.ToCharArray().Count(c => !Char.IsLetterOrDigit(c)) >=
         Membership.MinRequiredNonAlphanumericCharacters) &&
    ((Membership.PasswordStrengthRegularExpression.Length == 0) ||
         Regex.IsMatch(newPassword, Membership.PasswordStrengthRegularExpression))) {

    user.ChangePassword(user.ResetPassword(), newPassword);
} else {
    // Tell user new password isn't strong enough
}

Immersionism

Even today that is a valid and insightful comment (for legacy code that I'm working on). Thank you. – Vaca

Answer 3

You need to reset the user's password before changing it, and pass in the generated password to ChangePassword.

string randompassword = membershipUser.ResetPassword();
membershipUser.ChangePassword(randompassword , userWrapper.Password)

or inline:

membershipUser.ChangePassword(membershipUser.ResetPassword(), userWrapper.Password)

Rex

Why can't you just use membershipUser.GetPassword(); instead of membershipUser.ResetPassword(); ? – Tautologism

@RMiranda - because passwords should never be stored in a retrievable way. They should be hashed instead. See msdn.microsoft.com/en-us/library/2x0c6sfa(v=vs.110).aspx and en.wikipedia.org/wiki/… – Rex

ResetPassword() returns new password. But first parameter of ChangePassword() represents old password. I don't understand. How to exactly works ResetPassword() method? – Shanel

Answer 4

Try to use SimpleMembershipProvider it's easier:

var token = WebSecurity.GeneratePasswordResetToken("LoginOfUserToChange");
WebSecurity.ResetPassword(token, "YourNewPassword");

Kalidasa

Answer 5

Please note, all these mentioned solutions will only work if the RequiresQuestionAndAnswer property is set to false in Membership system configuration. If RequiresQuestionAndAnswer is true then the ResetPassword method needs to be passed the security answer, otherwise it will throw an exception.

In case you need RequiresQuestionAndAnswer set to true, you can use this workaround

Maryland

Answer 6

This code mentioned on posts above is working:

string username = "username";
string password = "newpassword";
MembershipUser mu = Membership.GetUser(username);
mu.ChangePassword(mu.ResetPassword(), password);

But you have to set requiresQuestionAndAnswer="false" in web.config in membership provider tag. If it is true, resetpassword method generate an error "Value can not be null". In this case you must supply question answer as parameter to ResetPassword.

Prud

Answer 7

Use the password you want to set from textbox in place of 123456.

 MembershipUser user;     
 user = Membership.GetUser(userName,false);
 user.ChangePassword(user.ResetPassword(),"123456");

Restful

Answer 8

@Rob Church is right:

The other answers here are correct but can leave the password in an unknown state.

However, instead of his solution to do the validation by hand, I would try to change the password using the ResetPassword from token method and catch and show the error:

var user = UserManager.FindByName(User.Identity.Name);
string token = UserManager.GeneratePasswordResetToken(user.Id);
var result = UserManager.ResetPassword(user.Id, token, model.Password);
if (!result.Succeeded){
    // show error
}

Valonia

this topic here is to use old Membership. But your code is from new Asp.Net Identity. :) – Heck

Answer 9

string username = "UserName";
string userpassword = "NewPassword";
string resetpassword;
    
MembershipUser mu = Membership.GetUser(username, false);

if (mu == null){
    Response.Write("<script>alert('Invalid Username!')</script>"); 
}

else{
    resetpassword = mu.ResetPassword(username);
    if (resetpassword != null){
         if (mu.ChangePassword(resetpassword, userpassword)){
             Response.Write("<script>alert('Password changed successfully!')</script>"); 
         }
    }
    else{
           Response.Write("<script>alert('Oh some error occurred!')</script>"); 
        }
    }

Cavalryman

Welcome to StackOverflow. Please provide some explanation as well. – Michaud

Answer 10

 string username = "UserName";
 string userpassword = "NewPassword";   
 MembershipUser mu = Membership.GetUser(username, false);
 mu.ChangePassword(mu.ResetPassword(username), userpassword);

Cavalryman

Was this meant as an edit to your other answer? Use the edit link underneath the post and delete this one. – Devon