Reset Membership Password without Answer

[jeff]

I have a user who forgot both their password and the answer to their
question. I am trying to build an admin page to allow me to reset
passwords, but it seem that all the methods require the answer to
user's questions. Is there something I am missing?

(My passwords are encrypted, not hashed)

 

[jeff]

Ok, I got it to work by changing the membership provider attribute
requiresQuestionAndAnswer to "false". Then I can retrieve the password
with

membershipUser.GetPassword("");

This is great, except that is affected my <ASPASSWORDRECOVERY>
control to no longer ask users for their password question.

I need a way to turn off the requiresQuestionAndAnswer property when I
am logged in as an admin, but this property is read only. Suggestions?
Please?

 

[jeff]

I guess I am answering my own questions.

I made the default MembershipProvider have
requireQuestionAndAnswer="false" and created an additional
MembershipProvider called "MyMembershipProviderStrong" which is
identical to the default provider except that is has
requireQuestionAndAnswer="true". I then set the <ASPASSWORDRECOVERY>
control to explicity use the stronger provider.

MembershipProvider="MyMembershipProviderStrong"

With this setup, my admin pages do not require the answer to the user
questions, but this password recovery control does.

If anyone has better or alternative solutuons, I would love to hear
them.

 

[Dominick Baier [DevelopMentor]]

Hi,

why are you encrypting?

 

[jeff]

mainly so that if my DB is ever hacked the passwords will be
meaningless.

 

[Dominick Baier [DevelopMentor]]

Hi,

they will be even more meaningless when you hash them instead of encryption -

a) hashing is nonreversible
b) you don't need a key

you won't be able to recover but only to reset a password.

much better.