0

I am trying to fetch user's password on a content delivery site using below code snippet. But getting this exception

This Membership Provider has not been configured to support password retrieval.

    var userRecord = Membership.GetUser(user.Name,true);

    password = userRecord.GetPassword();

I also tried configuring membership provider using below config, application throws an error

        <add name="sql" type="System.Web.Security.SqlMembershipProvider" 
                    connectionStringName="core" 
                    applicationName="sitecore" 
                    minRequiredPasswordLength="1" 
                    minRequiredNonalphanumericCharacters="0" 
                    requiresQuestionAndAnswer="false" 
                    requiresUniqueEmail="false" 
                    maxInvalidPasswordAttempts="5" 
                    enablePasswordRetrieval="false"  
                    />

Configured settings are invalid: Hashed passwords cannot be retrieved. Either set the password format to different type, or set enablePasswordRetrieval to false.

https://sdn.sitecore.net/upload/sitecore6/60/membership_providers_sc62-a4.pdf

Has anyone tried retrieving user's password?

Build below feature for Content delivery which is already available for Content Management

enter image description here

  • 6
    Do you understand the concept of hashed passwords? – Mark Cassidy Nov 1 '18 at 23:17
  • 5
    Agreed. You aren't supposed to get the password. Only match against the hashed password. I would consider the reasons why you are asking the question and maybe approach the problem with a different solution. – Pete Navarra Nov 1 '18 at 23:19
  • Do you have any details on why you require retrieving the user password? – Michael West Nov 1 '18 at 23:27
  • 1
    Looks like you were trying to do a password reset. You can do that without knowing their password. You would likely want to automate the resets in email of one time use token to create a new password. – Michael West Nov 2 '18 at 0:02
  • I took a stab at answering this question. I think the Question asker is asking how to validate a password. – Pete Navarra Nov 3 '18 at 7:23
1

This feature is not available on the Content Management server as you suggest it is.

What is available, as you are showing, is the ability to change a password.

  1. The "Old Password" is hashed and matched against the hash in the database (not the password it self).
  2. If it matches, then the Membership Provider will change the password.

But it doesn't retrieve it.

How to Correctly Authenticate/Authorize a User

Below is some sample code that shows how to use the AuthenticationManager in Sitecore.

        var errorMessage = String.Empty;

        if (String.IsNullOrEmpty(strUserName))
        {
            errorMessage = "Invalid username.";
        }
        else if (String.IsNullOrEmpty(strPassword))
        {
            errorMessage = "Invalid password.";
        }
        else
        {
            try
            {
                Sitecore.Security.Domains.Domain domain = Sitecore.Context.Domain;
                string domainUser = domain.Name + @"\" + strUserName;
                if
                (Sitecore.Security.Authentication.AuthenticationManager.Login(domainUser, strPassword))
                {
                    Sitecore.Web.WebUtil.Redirect("/");
                }
                else
                {
                    throw new System.Security.Authentication.AuthenticationException(
                        "Invalid username or password.");
                }
            }
            catch (System.Security.Authentication.AuthenticationException)
            {
                errorMessage = "Processing error.";
            }
        }

This is explained in detail in the Sitcore 6.0 Security API Cookbook which goes into much detail about how to utilize various parts of the Security functions in Sitecore. Probably worth mentioning that this guide will most likely apply to all versions of Sitecore up to Sitecore 9.0.2. In later versions of Sitecore, the Security API will most likely change due to the inclusion of Identity Server.

  • Thanks Pete. Although I am particularly interested in getting "Old Password" hashed and matched against the hash in the database on Content Delivery server. – Umar D Nov 4 '18 at 22:49
  • That is what the "Login" method on the AuthenticationManager is doing. If you want to see how it does that use something like dotPeek to look under the covers. – Pete Navarra Nov 5 '18 at 3:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.