asp.net - .Net Membership Provider-- Reset (or Change) Password When Old Password and Q/A are Unknown

Question

Trying to figure out if the following is possible. My settings (which I don't have an option of changing) are:

<add [...]
  enablePasswordRetrieval="false"
  enablePasswordReset="true"
  requiresQuestionAndAnswer="true"
  applicationName="/"
  requiresUniqueEmail="false"
  passwordFormat="Hashed"
  maxInvalidPasswordAttempts="5"
  minRequiredPasswordLength="7"
  minRequiredNonalphanumericCharacters="0"
  passwordAttemptWindow="10"
  passwordStrengthRegularExpression="" />

I can't call ChangePassword() without having the old password, but I also can't set a temporary password via user.ResetPassword(), as I get an error stating that the passwordAnswer needs to be supplied.

What are my options for changing a user's password?

Edit: found this:

Change Password Issue in AspNet MembershipProvider

Hacky but it works. Would still like to see if there are other options. Seems like a flaw in the provider if there isn't a built-in way to do this.

Answer 1

使用 ResetPassword 更新密码

您通常可以使用这个简单的技巧重置密码。通过重置用户密码获取临时密码。然后通过将临时密码作为旧密码传递来更改所需的密码。

var user = Membership.GetUser(Username, false);
var tempPassword = user.ResetPassword();
user.ChangePassword(tempPassword, NewPassword);

另一种方法：手动更新密码

正如你所说ChangePassword()的不起作用，这里是会员提供者用来生成盐和散列密码的方法。您可以使用它，并手动将盐和密码保存在数据库中。

private static string GenerateSalt()
{
    byte[] numArray = new byte[16];
    (new RNGCryptoServiceProvider()).GetBytes(numArray);
    string base64String = Convert.ToBase64String(numArray);
    return base64String;
}

private string EncodePassword(string pass, int passwordFormat, string salt)
{
    byte[] numArray;
    byte[] numArray1;
    string base64String;
    bool length = passwordFormat != 0;
    if (length)
    {
        byte[] bytes = Encoding.Unicode.GetBytes(pass);
        byte[] numArray2 = Convert.FromBase64String(salt);
        byte[] numArray3 = null;

        HashAlgorithm hashAlgorithm = HashAlgorithm.Create(Membership.HashAlgorithmType);

        if (hashAlgorithm as KeyedHashAlgorithm == null)
        {
            numArray1 = new byte[(int) numArray2.Length + (int) bytes.Length];
            Buffer.BlockCopy(numArray2, 0, numArray1, 0, (int) numArray2.Length);
            Buffer.BlockCopy(bytes, 0, numArray1, (int) numArray2.Length, (int) bytes.Length);
            numArray3 = hashAlgorithm.ComputeHash(numArray1);
        }
        else
        {
            KeyedHashAlgorithm keyedHashAlgorithm = (KeyedHashAlgorithm) hashAlgorithm;
            if (keyedHashAlgorithm.Key.Length != numArray2.Length)
            {

                if (keyedHashAlgorithm.Key.Length >= (int) numArray2.Length)
                {
                    numArray = new byte[(int) keyedHashAlgorithm.Key.Length];
                    int num = 0;
                    while (true)
                    {
                        length = num < (int) numArray.Length;
                        if (!length)
                        {
                            break;
                        }
                        int num1 = Math.Min((int) numArray2.Length, (int) numArray.Length - num);
                        Buffer.BlockCopy(numArray2, 0, numArray, num, num1);
                        num = num + num1;
                    }
                    keyedHashAlgorithm.Key = numArray;
                }
                else
                {
                    numArray = new byte[(int) keyedHashAlgorithm.Key.Length];
                    Buffer.BlockCopy(numArray2, 0, numArray, 0, (int) numArray.Length);
                    keyedHashAlgorithm.Key = numArray;
                }
            }
            else
            {
                keyedHashAlgorithm.Key = numArray2;
            }
            numArray3 = keyedHashAlgorithm.ComputeHash(bytes);
        }

        base64String = Convert.ToBase64String(numArray3);
    }
    else
    {
        base64String = pass;
    }
    return base64String;
}