0

The following is the code I am using to effect a password change. I am following the pattern in the Manage.aspx page that comes in the Asp>net web application template for changing the password.

Using that method does NOT hash the password, which is odd since the registration DOES hash it. So, i added the passwordhasher. The problem is the IdentityResult is returning false every time even though the three parameters are correct. Every code line produces the correct result until this line, which produces false every time

UPDATE: The usr.ID in the ChangePassword method is the culprit. The username passed in is the ONLY entry in the users table BUT the usr.Id doesn't match the users id in the table. How is it even retrieving an id?

 Dim result As IdentityResult = manager.ChangePassword(usr.Id, currentPass, newhash)

Here is the method

Private Sub btnSubmitPasswordChange_Click(sender As Object, e As EventArgs) Handles btnSubmitPasswordChange.Click
    Dim db As New MySQLDatabase("MyConnString")
    Dim ut As New UserTable(db)
    Dim username As String = EncryptDecrypt.DecryptQueryString(Request.QueryString("rtu"))
    Dim userId As String = ut.GetUserId(username)
    Dim currentPass As String = ut.GetPasswordHash(userId)
    Dim usr As New IdentityUser(username)
    Dim manager = New UserManager()
    manager.UserValidator = New UserValidator(Of IdentityUser)(manager) With {.AllowOnlyAlphanumericUserNames = False}
    Dim phasher As New PasswordHasher
    Dim newhash As String = phasher.HashPassword(Password.Text)
    Dim result As IdentityResult = manager.ChangePassword(usr.Id, currentPass, newhash)
    If result.Succeeded Then
        Response.Redirect("~/Account/Login.aspx")
    Else
        lblResetSuccess.Text = "Password change failed!"
    End If
    Dim changed As Integer = ut.SetPasswordHash(userId, newhash)
End Sub
dinotom
  • 4,990
  • 16
  • 71
  • 139
  • 1
    have a look at identityresult error list? there you get the detailed error. http://msdn.microsoft.com/en-us/library/microsoft.aspnet.identity.identityresult%28v=vs.111%29.aspx – Danny. Feb 05 '14 at 15:36
  • its not erring, its just always returning false – dinotom Feb 05 '14 at 15:39
  • -> false means not successfull ergo some error occured. From documentation at msdn succeed = true, succeeded = false -> error. || result.errors (<- debug in this list) – Danny. Feb 05 '14 at 16:04
  • the problem is that the current password variable, which I'm retrieving from the table as its hash, is really asking for the original password, which I hard coded in and now the method works. That's absurd since the password is stored as a hash so how would it even know what the original password is? – dinotom Feb 05 '14 at 16:11

0 Answers0