This project is read-only.

Changing PasswordFormat

Topics: Administration, Core
Feb 9, 2016 at 9:52 AM
Hi all,
I did a bulk import of users into my site. I imported generated passwords as Clear text for ease of import. I am now doing UAT and when I try to change my password via the change password page it fails with the message:
Password change was unsuccessful. Please correct the errors and try again. The current password is incorrect or the new password is invalid.

When I check the record in the UserPartRecord table my PasswordFormat has been changed to Hashed, but the Password remains unchanged. The user is now effectively locked out. I can reset the whole thing via the DB and regain access.

I quickly stepped through the code and it seems that in MembershipService.ValidateUser() the UserPart query is always returning Hashed as the password format, even though in the database it is Clear. Also the GetSettings().PasswordFormat property is also set to Hashed, when the passwords are Clear.

Is this a bug? Or a site setting somewhere? Is it possible to set a Clear password and have a user change it to be a hashed one? Obviously I do not want clear passwords in the production site. Should I hash the passwords and reimport the users again?

Thanks in advance.
Feb 10, 2016 at 7:54 AM
Okay, so I believe I have it figured out.

My issue is because I was importing Clear passwords I left HashAlgorithm blank. Orchard.Users.Services.MembershipService.ComputeHashBase64() throws an exception if there is no HashAlgorithm specified. So, the password is not updated, but the user record's PasswordFormat is saved as Hashed. This effectively locks the user out of their account.

What I have done is set the HashAlgorithm to be PBKDF2 in the database (in both Orchard_Users_UserPartRecord and Orchard_Framework_ContentItemRecord) and this works around the issue.

I suppose I should raise a bug for this?