Fetch user's password programmtically on content delivery site

Question

I am trying to fetch user's password on a content delivery site using below code snippet. But getting this exception

This Membership Provider has not been configured to support password retrieval.

    var userRecord = Membership.GetUser(user.Name,true);

    password = userRecord.GetPassword();

I also tried configuring membership provider using below config, application throws an error

        <add name="sql" type="System.Web.Security.SqlMembershipProvider" 
                    connectionStringName="core" 
                    applicationName="sitecore" 
                    minRequiredPasswordLength="1" 
                    minRequiredNonalphanumericCharacters="0" 
                    requiresQuestionAndAnswer="false" 
                    requiresUniqueEmail="false" 
                    maxInvalidPasswordAttempts="5" 
                    enablePasswordRetrieval="false"  
                    />

Configured settings are invalid: Hashed passwords cannot be retrieved. Either set the password format to different type, or set enablePasswordRetrieval to false.

https://sdn.sitecore.net/upload/sitecore6/60/membership_providers_sc62-a4.pdf

Has anyone tried retrieving user's password?

Build below feature for Content delivery which is already available for Content Management

Answer 1

This feature is not available on the Content Management server as you suggest it is.

What is available, as you are showing, is the ability to change a password.

1. The "Old Password" is hashed and matched against the hash in the database (not the password it self).
2. If it matches, then the Membership Provider will change the password.

But it doesn't retrieve it.

How to Correctly Authenticate/Authorize a User

Below is some sample code that shows how to use the AuthenticationManager in Sitecore.

        var errorMessage = String.Empty;

        if (String.IsNullOrEmpty(strUserName))
        {
            errorMessage = "Invalid username.";
        }
        else if (String.IsNullOrEmpty(strPassword))
        {
            errorMessage = "Invalid password.";
        }
        else
        {
            try
            {
                Sitecore.Security.Domains.Domain domain = Sitecore.Context.Domain;
                string domainUser = domain.Name + @"\" + strUserName;
                if
                (Sitecore.Security.Authentication.AuthenticationManager.Login(domainUser, strPassword))
                {
                    Sitecore.Web.WebUtil.Redirect("/");
                }
                else
                {
                    throw new System.Security.Authentication.AuthenticationException(
                        "Invalid username or password.");
                }
            }
            catch (System.Security.Authentication.AuthenticationException)
            {
                errorMessage = "Processing error.";
            }
        }

This is explained in detail in the Sitcore 6.0 Security API Cookbook which goes into much detail about how to utilize various parts of the Security functions in Sitecore. Probably worth mentioning that this guide will most likely apply to all versions of Sitecore up to Sitecore 9.0.2. In later versions of Sitecore, the Security API will most likely change due to the inclusion of Identity Server.