1

I'm using the change password feature of the standard AspNetSqlMembershipProvider in my ASP.NET MVC-2 app:

MembershipUser user = Membership.GetUser(userId);
string pwd = user.ResetPassword();
if (user.ChangePassword(pwd, confirmPassword))
{
    // it worked
}

And this works for the vast majority of users, but there are a couple of users that can not change their passwords - user.ChangePassword() just returns false.

I've tried it myself to see what was going on, and entered a simple password 12345678 for that user and it failed to change.

So it's not because they are entering passwords that do not match the password rules. My web.config has the membership provider defined like so:

<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" 
connectionStringName="MembershipDatabaseConnectionString" enablePasswordRetrieval="false" 
enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="true" 
maxInvalidPasswordAttempts="5" minRequiredPasswordLength="8" 
minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/" />

Its just the normal definition of AspNetSqlMembershipProvider, there's nothing fancy here.

Why would one user (me) be able to change their password to be 12345678, but another user can not change their password to be 12345678? This other user can not change their password to anything at all.

JK.
  • 21,477
  • 35
  • 135
  • 214
  • 1
    If this is in a test environment (or if you can recreate in such an environment), can you post the values in membership user table for one that fails and one that doesn't fail (with column names)? – steinar Oct 22 '10 at 22:52
  • The only time the change password method should return false is if it fails the same password check that the user is presumably going through to log in. How are you validating the password when they log in? You could also try resetting the password and then see if you can change it. – Greg Nov 16 '10 at 22:46

1 Answers1

0

It sounds like those users are locked out.

MembershipUser.ChangePassword calls SqlMembershipProvider.ChangePassword, which returns false if the user is locked out.

Jeff Ogata
  • 56,645
  • 19
  • 114
  • 127
  • According to the documentation, the method also returns false if the old password provided is invalid or the user does not exist. – Sue Maurizio May 31 '21 at 07:35