Solved

Membership Provider issues

Posted on 2011-03-02
2
873 Views
Last Modified: 2012-05-11
Background:
I have an ASP.NET web site that uses Forms authentication and the ActiveDirectoryMembershipProvider for authenticating users against my active directory. No issues with that, works well.

Issue:
If a user has forgotten his/her password he/she will call our help desk to ask for the password to be reset. At that time, the help desk user will be able to reset the user's password and email them the new "temporary" password. That works well, but creates a security risk. So the obvious solution would be to check the "force password reset at next logon" when the password reset is done. The problem is introduced here, because the AD Membership provider can not authenticate the user if the "User must change password at next logon" flag is set. So when the user attempts to logon on to the site using the "temporary" password the Membership.Validate() call always returns false.

I tried to skirt this issue by creating a UserPrincipal object for the user attempting the logon, from the logon page. With the UserPrincipal object i can check the LastPasswordSet property to see if i need to force a password change. LastPasswordSet will be blank if the user recently had the password reset and has not changed it since. See example below.

Logon page code behind
C#:
//...
//username is the user trying to logon with the temp password
UserPrincipal up = UserPrincipal.FindByIdentity(context, IdentityType.SamAccountName, username)
//...
if (up.LastPasswordSet.HasValue == false)
{//the password has never been changed for this user or was recently reset
            if (up.PasswordNeverExpires == false)//ignore users whos password never expires
            {//user has never changed their password, or the password has been reset and must be changed
                      return_value = true;
             }
}

Open in new window



So, with the code above, I can identify the user trying to access my site must change his/her password at next logon. From there i skip the Membership.Validate() call because i know it will fail anyway, and do a Response.Redirect() to my password change screen. I ask the user for the old password (password from help desk), new password and confirm password. However, when i call MembershipUser.ChangePassword() it always returns false and fails to change the password.

This is where i got stuck. Is there a way to work with the active directory setting "User must change password at next logon" while still using the ActiveDirectoryMembershipProvider and forms auth.


Here is a snippet of my web.Config settings for the membership info:
<connectionStrings>
      <add name="ADConnectionString" connectionString="LDAP://my.domain.com/CN=Users,DC=my,DC=domain,DC=com"/>
</connectionStrings>
...
<membership defaultProvider="MembershipADProvider" >
      <providers>
        <clear/>
        <add name="MembershipADProvider"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             applicationName="MyApplication"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountname"
             enableSearchMethods="true"
             minRequiredNonalphanumericCharacters="0"
             />
      </providers>
</membership>
...

Open in new window


My domain controller is running Windows Server 2008 R2.
I use framework 3.5 for all my .NET code.
0
Comment
Question by:farpoint1
2 Comments
 
LVL 13

Accepted Solution

by:
agarwalrahul earned 500 total points
ID: 35023883
You'll have to custom code that somehow with some sort of "enhanced" AD
membership provider (if you still want to use the membership provider for
the provisioning piece and not just the credentials validation).  You won't
be able to use the native function for "user must change password at next
logon".
0
 

Author Closing Comment

by:farpoint1
ID: 35074971
Answer told me what i already knew. Not much help solving the problem.
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Today I had a very interesting conundrum that had to get solved quickly. Needless to say, it wasn't resolved quickly because when we needed it we were very rushed, but as soon as the conference call was over and I took a step back I saw the correct …
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This Micro Tutorial will teach you how to censor certain areas of your screen. The example in this video will show a little boy's face being blurred. This will be demonstrated using Adobe Premiere Pro CS6.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question