If I need to change a Sitecore user's password, the dialog requires that I submit the old password at the same time. Often I don't know the old password, so within the same dialog I can generate a new one, copy-paste it into the 'old password' field and then set a new password.

These seems like a strange process. What is the rationale to this?

enter image description here

up vote 7 down vote accepted

I don't think there is any specific reason.

My guess would be that it is just because that is how the ASP.NET Membership API is structured. You cannot change the password without knowing the password (which you can by resetting it).

 var user = Membership.GetUser(username);
 var randomPassword = user.ResetPassword();
 user.ChangePassword(randomPassword, newPassword);

They should of course easily be able to combine it like above, so it's probably just an oversight on their part.

  • 1
    That sure sounds like a specific reason ;-) – Dmytro Shevchenko Oct 26 '16 at 8:01
  • At first I wrote "good" reason - which maybe was more fitting :) – Søren Kruse Oct 26 '16 at 8:03

If you are using Sitecore 8.1 Update-2 or newer then there is a new Security Tools admin page that can be found at /sitecore/admin/SecurityTools.aspx.

Security Tools Admin Page

The Reset User Password wil allow you to reset a users password without first having to generate a random password first.

You can find more details about this (and other new admin pages) in this blog post.

This means that it is possible to reset the password without knowing the old one, and as Soren Kruse points out in his answer, this is pretty much what Sitecore have done with this new admin page:

string text1 = this.ResetUserName.Text;
string text2 = this.ResetUserPassword.Text;
...
MembershipUser user = Membership.GetUser(text1);
string oldPassword = user.ResetPassword();
if (user.ChangePassword(oldPassword, text2))
  this.SetSuccessMessage(this.ResultResetPassword, "Password successfully reset for user {0}.".FormatWith((object) text1));
   ...

The Asp.net Membership API uses a method called ChangePassword, hence the need for the old password.

Resetting a password would then look like this:

string username = "username";
string password = "newpassword";
MembershipUser mu = Membership.GetUser(username);
mu.ChangePassword(mu.ResetPassword(), password);

In case you have Sitecore PowerShell Extensions installed you can set a new password without knowing the old.

Example: The following assigns a new password to three users.

"michael","adam","mike" | Set-UserPassword -NewPassword b -Reset

See the SPE help for Set-User here.

The screen shared for admins as for non-admins. The only difference is that an admin has the option to use the generate button.

As a user could only change his password if he's logged on, he could provide the old password. An admin wouldn't know the password and could use the generate button.

  • In addition, as an admin you can generate a password for a user when he loses his or her password without being able to "remember" it very fast – Dilyano Senders Oct 26 '16 at 13:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.