1

I did implement a basic Sitecore password recovery functionality following Enable Sitecore Password Recovery functionality Which works fine.

However, if the Sitecore user is locked and the user clicks "Forget your password?" link on the Sitecore login page, the page throws an error.

How can we fix this issue?

enter image description here

7

Long story short; this is expected behaviour (almost). And I'll explain why.

Imagine yourself an admin of the solution and, for whatever reason, you've decided to lock sitecore\billg out of the system. The system should then NOT allow this user to simply enable his or her account again by going through the Password Recovery process.

So for your locked out users - the ones who HAVE hit the maximum of 3 or 5 failed attempts - the only recourse is for an admin user to first unlock the accounts, THEN can they proceed through Password Recovery.

The fact that Sitecore throws an YSOD at users in this condition however, I would register as a bug with Sitecore Support. This should of course not happen.

  • Thanks. That makes sense. I did create a Sitecore ticket. – Ercan Polat Sep 11 at 18:55
0

So if a user is locked out of Sitecore, they must ask the security administrator to unlock their security account.

  • To unlock a user account, open the User Manager and click the relevant user.
  • In the Locked column, an indicator shows if a user has been locked out of Sitecore.
  • In the Users group, click Unlock.

If the user is Admin itself then there is also an admin page:

https://yourhost/sitecore/admin/unlock_admin.aspx

By default, it's disabled so you need to edit the aspx file to set enableUnlockButton to true.

Or if you have database access you can run below script against core database -

UPDATE  aspnet_Membership 
SET     IsLockedOut = 0, 
        FailedPasswordAttemptCount = 0
WHERE   UserId IN (SELECT UserId FROM aspnet_Users WHERE UserName = 'sitecore\Admin')

Since password recovery is OOTB functionality and it is throwing a YELLOW page Error then you should ask support for this. But you can handle this by creating a custom passwordRecovery pipeline processor just to verify the account is lock and show the proper message to the user.

0

If this is not a admin user so you can unlock it from User Manager.

  • Open the User Manager and click the relevant user. In the Locked column, an indicator shows if a user has been locked out of Sitecore.

  • In the Users group, click Unlock.

Other than that you can unlock from DB as well using below query:

UPDATE aspnet_Membership 
SET IsLockedOut = 0, FailedPasswordAttemptCount = 0 
WHERE UserId IN 
  (SELECT UserId FROM aspnet_Users WHERE UserName = 'sitecore\Admin')
  • 1
    Thanks Swati. Yes, I know how to unlock the user. However, this is not a fix for the problem. – Ercan Polat Sep 11 at 18:46
0

Sitecore did send me a patch and it solved the issue. If the user is locked out and the user clicks the "Forget your Password?" link, the site does not throw an error message anymore. It displays the login page with a message.However, the system does not send a new password for locked out users. Sitecore admins need to unlock the user.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.