I'm trying to implement Password history for Members so that a user can not enter a password they have previously used.
Im planning on doing this by adding an extra table and storing the hashed password history there and checking against it when a Member updates password.
The Issue i am having is that the password format is set too hashed and cant figure out how to generate the Hashed password in the same way Members.ChangePassword does, so i cant check against the PasswordHistory table.
Ive tried
var _passwordhasher = new MembershipProviderPasswordHasher(Membership.Provider.AsUmbracoMembershipProvider());
var hashed = _passwordhasher.HashPassword(model.NewPassword);
And
var hash = Membership.Provider.AsUmbracoMembershipProvider().HashPasswordForStorage(model.NewPassword);
Neither give same result as
var attempt = Members.ChangePassword(Membership.GetUser().UserName, new Umbraco.Web.Models.ChangingPasswordModel()
{
NewPassword = model.NewPassword,
OldPassword = model.OldPassword
}, Membership.Provider);
var originalPasswordhash = _memberService.GetByUsername(Membership.GetUser().UserName).RawPasswordValue;
I created a history new table to store hashed passwords against a username. which i populated on password change, after a member has a pssword set you can access the Rawvalue using this _memberService.GetByUsername(user.UserName).RawPasswordValue
then simply on each password request change fed in the new password (unhashed) and ran it against the above method looping through the hashed pwhistory table values.
Password History
I'm trying to implement Password history for Members so that a user can not enter a password they have previously used.
Im planning on doing this by adding an extra table and storing the hashed password history there and checking against it when a Member updates password.
The Issue i am having is that the password format is set too hashed and cant figure out how to generate the Hashed password in the same way Members.ChangePassword does, so i cant check against the PasswordHistory table.
Ive tried
And
Neither give same result as
I managed to find an answer to this after a day of going through the source code, and rethinking my approach.
The provider has a protected method of
I made a public method on my custom provider that took in the raw Passwords from the History table and returned the above method's result.
Hi Perry,
Would be interested to see how you implemented password history with ,net Identity.
Would you be prepared to share your findings
Hi,
It was a long time ago and i believe the project got abandoned before going live. But i did implement it not sure how well but here goes.
heres an articale i used on help extending Membership provider https://24days.in/umbraco-cms/2015/extending-membership/
I created a history new table to store hashed passwords against a username. which i populated on password change, after a member has a pssword set you can access the Rawvalue using this
_memberService.GetByUsername(user.UserName).RawPasswordValue
then simply on each password request change fed in the new password (unhashed) and ran it against the above method looping through the hashed pwhistory table values.
Change password controller
Custom MembershipProvider
this is what i was looking for
only exposed in a custom implementation of MembersMembershipProvider as far as i remember
is working on a reply...