Can't change password through admin interface when enablePasswordReset is false

Description

If, in the web.config, you set enablePasswordReset to false, you can no longer change the password User Accounts area of the Admin interface. Not sure if users can change their own password.

QA Test Plan

None

Attachments

1

Activity

Show:

Will Morgenweck December 12, 2016 at 11:56 PM

Batch update of issues that won't be addressed due to change in functionality from version 9.0

Walter Nicholls July 8, 2016 at 12:38 AM
Edited

Still an issue with 08.00.03

Also weirdly, this may be related so I'll note it here: I had a user account that was locked out (too many failed attempts with wrong password). Had enablePasswordReset=true. Went to change user's password (through Edit User accounts - manage Password). Error came up "a password answer must be provided" (or words to that effect).
So I unlocked the account (on the Manage Account tab). That let me change the password.

Matthew Copeland March 23, 2016 at 6:21 PM
Edited

I can verify this is an issue with a clean new install of 8.0.0.

Non admin users are able to change their own passwords through My Account
As the original poster states, admins cannot change user passwords using Manage Users.

In addition, I don't believe it has been reported, admins cannot change their own password using My Account.

Walter Nicholls December 14, 2015 at 2:40 AM

I can confirm this is still a problem in DNN 7.4.2. - Hit this problem last week. It comes up with message "Your new password was not accepted for security reasons. Please make sure to choose a password which does not match a previously used password and which is long and complex enough to meet the sites password complexity requirements." - screenshot for completeness:

web.config contains
<add name="AspNetSqlMembershipProvider" .... enablePasswordRetrieval="true" enablePasswordReset="false" ...

(complete aside, would prefer PasswordRetrieval=false as well, but there is a 3rd-party module dependent on it for this particular website).

Temporarily changing web.config so enablePasswordReset="true" makes the admin tool work as expected, password changed successfully.

Won't Fix

Details

Assignee

Reporter

Severity

Major

Triage

Triaged

Includes Code Fix

No

Components

Affects versions

Priority

Created February 14, 2014 at 11:21 PM
Updated December 12, 2016 at 11:56 PM
Resolved December 12, 2016 at 11:56 PM