?
Solved

Membership Provider issues

Posted on 2011-03-02
2
Medium Priority
?
878 Views
Last Modified: 2012-05-11
Background:
I have an ASP.NET web site that uses Forms authentication and the ActiveDirectoryMembershipProvider for authenticating users against my active directory. No issues with that, works well.

Issue:
If a user has forgotten his/her password he/she will call our help desk to ask for the password to be reset. At that time, the help desk user will be able to reset the user's password and email them the new "temporary" password. That works well, but creates a security risk. So the obvious solution would be to check the "force password reset at next logon" when the password reset is done. The problem is introduced here, because the AD Membership provider can not authenticate the user if the "User must change password at next logon" flag is set. So when the user attempts to logon on to the site using the "temporary" password the Membership.Validate() call always returns false.

I tried to skirt this issue by creating a UserPrincipal object for the user attempting the logon, from the logon page. With the UserPrincipal object i can check the LastPasswordSet property to see if i need to force a password change. LastPasswordSet will be blank if the user recently had the password reset and has not changed it since. See example below.

Logon page code behind
C#:
//...
//username is the user trying to logon with the temp password
UserPrincipal up = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, username)
//...
if (up.LastPasswordSet.HasValue == false)
{//the password has never been changed for this user or was recently reset
            if (up.PasswordNeverExpires == false)//ignore users whos password never expires
            {//user has never changed their password, or the password has been reset and must be changed
                      return_value = true;
             }
}

Open in new window



So, with the code above, I can identify the user trying to access my site must change his/her password at next logon. From there i skip the Membership.Validate() call because i know it will fail anyway, and do a Response.Redirect() to my password change screen. I ask the user for the old password (password from help desk), new password and confirm password. However, when i call MembershipUser.ChangePassword() it always returns false and fails to change the password.

This is where i got stuck. Is there a way to work with the active directory setting "User must change password at next logon" while still using the ActiveDirectoryMembershipProvider and forms auth.


Here is a snippet of my web.Config settings for the membership info:
<connectionStrings>
      <add name="ADConnectionString" connectionString="LDAP://my.domain.com/CN=Users,DC=my,DC=domain,DC=com"/>
</connectionStrings>
...
<membership defaultProvider="MembershipADProvider" >
      <providers>
        <clear/>
        <add name="MembershipADProvider"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             applicationName="MyApplication"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountname"
             enableSearchMethods="true"
             minRequiredNonalphanumericCharacters="0"
             />
      </providers>
</membership>
...

Open in new window


My domain controller is running Windows Server 2008 R2.
I use framework 3.5 for all my .NET code.
0
Comment
Question by:farpoint1
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 13

Accepted Solution

by:
Rahul Agarwal earned 1500 total points
ID: 35023883
You'll have to custom code that somehow with some sort of "enhanced" AD
membership provider (if you still want to use the membership provider for
the provisioning piece and not just the credentials validation).  You won't
be able to use the native function for "user must change password at next
logon".
0
 

Author Closing Comment

by:farpoint1
ID: 35074971
Answer told me what i already knew. Not much help solving the problem.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is for Object-Oriented Programming (OOP) beginners. An Interface contains declarations of events, indexers, methods and/or properties. Any class which implements the Interface should provide the concrete implementation for each Inter…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question