Locked out Sitecore users cannot reset their password: Sitecore Password Recovery

Question

I did implement a basic Sitecore password recovery functionality following Enable Sitecore Password Recovery functionality Which works fine.

However, if the Sitecore user is locked and the user clicks "Forget your password?" link on the Sitecore login page, the page throws an error.

How can we fix this issue?

Answer 1

Long story short; this is expected behaviour (almost). And I'll explain why.

Imagine yourself an admin of the solution and, for whatever reason, you've decided to lock sitecore\billg out of the system. The system should then NOT allow this user to simply enable his or her account again by going through the Password Recovery process.

So for your locked out users - the ones who HAVE hit the maximum of 3 or 5 failed attempts - the only recourse is for an admin user to first unlock the accounts, THEN can they proceed through Password Recovery.

The fact that Sitecore throws an YSOD at users in this condition however, I would register as a bug with Sitecore Support. This should of course not happen.

Answer 2

So if a user is locked out of Sitecore, they must ask the security administrator to unlock their security account.

• To unlock a user account, open the User Manager and click the relevant user.
• In the Locked column, an indicator shows if a user has been locked out of Sitecore.
• In the Users group, click Unlock.

If the user is Admin itself then there is also an admin page:

https://yourhost/sitecore/admin/unlock_admin.aspx

By default, it's disabled so you need to edit the aspx file to set enableUnlockButton to true.

Or if you have database access you can run below script against core database -

UPDATE  aspnet_Membership 
SET     IsLockedOut = 0, 
        FailedPasswordAttemptCount = 0
WHERE   UserId IN (SELECT UserId FROM aspnet_Users WHERE UserName = 'sitecore\Admin')

Since password recovery is OOTB functionality and it is throwing a YELLOW page Error then you should ask support for this. But you can handle this by creating a custom passwordRecovery pipeline processor just to verify the account is lock and show the proper message to the user.

Answer 3

Sitecore did send me a patch and it solved the issue. If the user is locked out and the user clicks the "Forget your Password?" link, the site does not throw an error message anymore. It displays the login page with a message.However, the system does not send a new password for locked out users. Sitecore admins need to unlock the user.

Answer 4

You can first unlock your admin account then reset the user's password by admin rights. Below are the steps to update Admin’s password to ‘b’:

1. Login into SQL DB
2. Go to your Core DB
3. Execute below query

UPDATE 
    [aspnet_Membership] 
SET 
    [Password]='qOvF8m8F2IcWMvfOBjJYHmfLABc=', 
    [PasswordSalt]='OM5gu45RQuJ76itRvkSPFw==', 
    [IsApproved] = '1', 
    [IsLockedOut] = '0'
WHERE 
    UserId IN (
        SELECT UserId FROM dbo.aspnet_Users WHERE UserName = 'sitecore\Admin'
    ) 

Answer 5

If this is not a admin user so you can unlock it from User Manager.

• Open the User Manager and click the relevant user. In the Locked column, an indicator shows if a user has been locked out of Sitecore.

• In the Users group, click Unlock.

Other than that you can unlock from DB as well using below query:

UPDATE aspnet_Membership 
SET IsLockedOut = 0, FailedPasswordAttemptCount = 0 
WHERE UserId IN 
  (SELECT UserId FROM aspnet_Users WHERE UserName = 'sitecore\Admin')