How to set password rules for ASP.NET identity?

Question

In my ASP.NET applications I have following settings in DefaultMembershipProvider and SqlMembershipProvider in web.config:

enablePasswordRetrieval="true"
passwordFormat="Clear" 
requiresQuestionAndAnswer="false"

They are required for Digest authentication. I would like to move to ASP.NET Identity. I am using automated tool to update all web.config files that I manage.

How do I set these settings for ASP.NET Identity in the project generated by Visual Studio 2013?

Password retrieval greatly increases the weakness of an application by requiring two way encryption and then relaying credentials in plain text. Consider implementing password reset tokens via e-mail instead if possible. — pwdst
– pwdst, Commented Nov 13, 2013 at 12:20
I found a 2014 dated article about custom password policy blogs.msdn.microsoft.com/webdev/2014/01/06/… — oneNiceFriend
– oneNiceFriend, Commented Jun 1, 2016 at 13:01

jd4u · Accepted Answer · 2013-10-23 05:45:21Z

21

You need to provide IPasswordHasher implementation that can provide clear password without hashing. You can set UserManager.PasswordHasher to your implementation.

As of now, there is no web.config configurable settings for Identity. You need to provide appropriate mix of configurable in code, mainly in Startup.cs

It is not recommended to store passwords in clear format.

public class ClearPassword : IPasswordHasher
{
    public string HashPassword(string password)
    {
        return password;
    }

    public PasswordVerificationResult VerifyHashedPassword(string hashedPassword, string providedPassword)
    {
        if(hashedPassword.Equals(providedPassword))
            return PasswordVerificationResult.Success;
        else return PasswordVerificationResult.Failed;
    }
}

edited Oct 23, 2013 at 5:45

answered Oct 23, 2013 at 5:38

jd4u

5,8272 gold badges32 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

idipous Over a year ago

The provided password is clear text or hashed (in case we used hashed passwords)?

jd4u Over a year ago

The example is of the clear text password. You can implement hashing algorithm in HashPassword(string password) function and same way verify it in VerifyHashedPassword function.

oneNiceFriend Over a year ago

Thanks jd4u, but I couldnt get , where to add this class and where to call it?

Collectives™ on Stack Overflow

How to set password rules for ASP.NET identity?

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related