ASP.Net User Forgot Password Answer

Question

How can I reset the password for a user who has forgotten the password and password response reset question? I am using ASP.Net membership.

Answer 1

Suppose your membership provider ("AspNetSqlMembershipProvider") in Web.config has requiresQuestionAndAnswer="true" , make a second provider (for example, "AspNetSqlMembershipProviderAdministrativeReset") with all the same parameters, except requiresQuestionAndAnswer="false" .

Then you can create an action that the second provider explicitly uses to allow the administrator to reset the password without requiring the correct answer to the secret question, as in the following fragment:

 var provider = Membership.Providers["AspNetSqlMembershipProviderAdministrativeReset"] as MembershipProvider; var newPassword = provider.ResetPassword(userName, null /* answer */); 

Answer 2

On the administrative page of your site, you can simply reset to get the password by first capturing the user:

 // Assume user name is 'theuser'. Obviously you would get this beforehand MembershipUser user = Membership.GetUser("theuser"); string newPassword = user.ResetPassword(); 

You will now have an automatically generated password in 'newPassword'. You can email this to the user.

There are other ways to achieve this. The membership database is fairly wide open, so you can come up with input systems to get the desired new password yourself and place the hashed value there. Please comment if you need more information. It should not be difficult.