ASP.NET MVC 5 Default WebApp Forgot Password module missing?

Question

In MVC 4 with SimpleMembership all these functions come with the default webbapp that you create in Visual Studio.

I was wondering where I can find the same for MVC 5 using the new ASP.NET Identity membership system? Is there some official blog or something that is beeing hidden from me in google search results?

UPDATE1: http://blogs.msdn.com/b/webdev/archive/2013/12/20/announcing-preview-of-microsoft-aspnet-identity-2-0-0-alpha1.aspx

UPDATE2: ASP.NET Identity 2.0 RTM has been released. Forgot Password is included in the samples/templates. http://blogs.msdn.com/b/webdev/archive/2014/03/20/test-announcing-rtm-of-asp-net-identity-2-0-0.aspx

score 2 · Accepted Answer · answered Nov 05 '13 at 21:14

2

We are working on adding these features to the ASP.NET Identity system and the MVC 5 templates.

answered Nov 05 '13 at 21:14

pranav rastogi

4,124
23
23

1

One good list as expected by most users, http://brockallen.com/2013/10/20/the-good-the-bad-and-the-ugly-of-asp-net-identity/#ugly I know of the upcoming OwinMiddleware, in 1.1, future version expected to provide blocks for the features listed in link. – jd4u Nov 06 '13 at 06:39
Cool, will hold my horses then and continue with some other stuff in my app in the meantime. :) – PussInBoots Nov 06 '13 at 11:49
3

Hello Pranav. Do you know what the approximate time frame is for the release of those features? The whole ASP.NET MVC 5 Internet Template is kind of pointless without this feature. It would also be great if in the UserManager Library a new "ChangePassword" method is added that doesn't require the current password to be known, so Administrative Users can reset passwords for locked out users. Thanks! – DigiOz Multimedia Nov 09 '13 at 00:10

score 2 · Answer 2 · answered Dec 26 '13 at 22:22

I ran into this as well. To fix it, I created some controller actions in AccountController.cs (and corresponding views) to handle it.

Here are the actual lines that reset the user's password:

[AllowAnonymous]
[HttpPost]
public ActionResult ResetForgottenPassword(string key, ManageUserViewModel model)
{
    var user = db.Users.SingleOrDefault(u => u.ForgotPasswordCode != null && u.ForgotPasswordCode == key);

    if (user == null || !user.ForgotPasswordDate.HasValue || user.ForgotPasswordDate.Value.AddDays(1) < DateTime.UtcNow)
            return new HttpUnauthorizedResult();

    ModelState state = ModelState["OldPassword"];
    if (state != null)
    {
        state.Errors.Clear();
    }

    if (ModelState.IsValid)
    {
        if (UserManager.HasPassword(user.Id))
            UserManager.RemovePassword(user.Id);

        IdentityResult result = UserManager.AddPassword(user.Id, model.NewPassword);

        if (result.Succeeded)
        {
            //Clear forgot password temp key
            user.ForgotPasswordCode = null;
            user.ForgotPasswordDate = null;
            db.SaveChanges();

            //Sign them in
            var identity = UserManager.CreateIdentity(user, DefaultAuthenticationTypes.ApplicationCookie);
            AuthenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = false }, identity);

            return RedirectToAction("Manage", new { Message = ManageMessageId.SetPasswordSuccess });
        }
        else
        {
            AddErrors(result);
        }
    }

    ViewBag.ForgotPasswordCode = key;

    return View(model);
}

Some custom items are the new fields on the user object:

ForgotPasswordCode and ForgotPasswordDate to keep track of the user throughout the "reset password email" process.
I pass the key around in in the ViewBag once the user arrives from the email link.
The db variable is a property of my database context class inherited from a base controller.
I use UTC DateTimes in my database. Change DateTime.UtcNow to DateTime.Now if you do not.

Probably not the best solution, but it's a fairly quick and simple patch.

avalla · Answer 3 · 2013-12-23T13:11:24.810

1

You can build a reset password by yourself (not sure that is the better choice, but is better than nothing)

Generate the hash with:

var newPwdHash = new PasswordHasher().HashPassword(newPasswordPlain)

And replace to the user's passwordhash property

edited Dec 23 '13 at 13:11

answered Dec 23 '13 at 13:03

avalla

560
4
19

score 0 · Answer 4 · answered Dec 30 '13 at 14:40

If you cannot wait for the ASP.NET Identity Team to add this feature you can get an implementation of password reset from the open source project SimpleSecurity. Just take a look at the ResetPassword action on the AccountController. You can read about how the password reset was implemented here. Although the article references SimpleMembership, SimpleSecurity uses the same API to support either SimpleMembership or ASP.NET Identity in your MVC application.

ASP.NET MVC 5 Default WebApp Forgot Password module missing?

4 Answers4