Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Membership Provider issues

Posted on 2011-03-02
2
874 Views
Last Modified: 2012-05-11
Background:
I have an ASP.NET web site that uses Forms authentication and the ActiveDirectoryMembershipProvider for authenticating users against my active directory. No issues with that, works well.

Issue:
If a user has forgotten his/her password he/she will call our help desk to ask for the password to be reset. At that time, the help desk user will be able to reset the user's password and email them the new "temporary" password. That works well, but creates a security risk. So the obvious solution would be to check the "force password reset at next logon" when the password reset is done. The problem is introduced here, because the AD Membership provider can not authenticate the user if the "User must change password at next logon" flag is set. So when the user attempts to logon on to the site using the "temporary" password the Membership.Validate() call always returns false.

I tried to skirt this issue by creating a UserPrincipal object for the user attempting the logon, from the logon page. With the UserPrincipal object i can check the LastPasswordSet property to see if i need to force a password change. LastPasswordSet will be blank if the user recently had the password reset and has not changed it since. See example below.

Logon page code behind
C#:
//...
//username is the user trying to logon with the temp password
UserPrincipal up = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, username)
//...
if (up.LastPasswordSet.HasValue == false)
{//the password has never been changed for this user or was recently reset
            if (up.PasswordNeverExpires == false)//ignore users whos password never expires
            {//user has never changed their password, or the password has been reset and must be changed
                      return_value = true;
             }
}

Open in new window



So, with the code above, I can identify the user trying to access my site must change his/her password at next logon. From there i skip the Membership.Validate() call because i know it will fail anyway, and do a Response.Redirect() to my password change screen. I ask the user for the old password (password from help desk), new password and confirm password. However, when i call MembershipUser.ChangePassword() it always returns false and fails to change the password.

This is where i got stuck. Is there a way to work with the active directory setting "User must change password at next logon" while still using the ActiveDirectoryMembershipProvider and forms auth.


Here is a snippet of my web.Config settings for the membership info:
<connectionStrings>
      <add name="ADConnectionString" connectionString="LDAP://my.domain.com/CN=Users,DC=my,DC=domain,DC=com"/>
</connectionStrings>
...
<membership defaultProvider="MembershipADProvider" >
      <providers>
        <clear/>
        <add name="MembershipADProvider"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             applicationName="MyApplication"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountname"
             enableSearchMethods="true"
             minRequiredNonalphanumericCharacters="0"
             />
      </providers>
</membership>
...

Open in new window


My domain controller is running Windows Server 2008 R2.
I use framework 3.5 for all my .NET code.
0
Comment
Question by:farpoint1
2 Comments
 
LVL 13

Accepted Solution

by:
agarwalrahul earned 500 total points
ID: 35023883
You'll have to custom code that somehow with some sort of "enhanced" AD
membership provider (if you still want to use the membership provider for
the provisioning piece and not just the credentials validation).  You won't
be able to use the native function for "user must change password at next
logon".
0
 

Author Closing Comment

by:farpoint1
ID: 35074971
Answer told me what i already knew. Not much help solving the problem.
0

Featured Post

Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
It was really hard time for me to get the understanding of Delegates in C#. I went through many websites and articles but I found them very clumsy. After going through those sites, I noted down the points in a easy way so here I am sharing that unde…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question