CODEWITHSUNDEEP
c#asp.netasp.net-mvcasp.net-identity
hncl
hncl

Reputation: 2305

Asp.net Identity 2.0 temporary password

In my MVC application user registration is implemented in two ways; the user register and then approved by the Administrator; or the Administrator can create a user. My question is: will it be possible to send a temporary password and then the user has to change it after first login, or can I flag this user to use external authentication first time. I would appreciate your suggestions.

Upvotes: 4

Views: 4570

Answers (3)

DSR
DSR

Reputation: 4668

My opinion is to use roles than using new columns, and checking things every time user logged in as it is not good when we thinking about performances.

Create three new roles it could be

  • Created - User created by admin
  • Registered - User registered by them self
  • Approved - Approved by admin

In your case if the user registered them self, then add them to ROLE 'Registered'. If the user created by admin then add them to ROLE 'Created'. Once admin approved or user change there password first time login, then you can add them to ROlE 'Approved'.

Then you can handle user self registration and admin creation controller actions to add users to correct ROlE.

There is a column called 'EmailConfirmed' already there, so that you can use that column for your purpose. Update that column when the user approved or successfully change the password on first login.

As you know that password field is nullable, so that you don't need to insert temporary passwords, (but you could if you want). You can keep password field as null and update it when the user first login. You need to change your views to support this scenario.

You can use asp.net identity framework supported methods in order to achieve this.

GenerateEmailConfirmationTokenAsync
GenerateEmailConfirmationToken
IsEmailConfirmedAsync
ConfirmEmailAsync

This role based scenario may help you to categorize users depending on there role and restrict access easily using [Authorize(Role = "RoleName")].

Let me know if you need anymore details.

Hope this helps.

Upvotes: 0

sean717
sean717

Reputation: 12683

You can define a UserAccount class like this:

public class UserAccount
{
   public int AccountId {  get; set;}

   public UserAccountState AccountState { get; set; }

   public Guid ActivationCode { get; set; }

   public string Password { get; set; }
}

Where UserAccountState is

public enum UserAccountState
{
   PendingActivation = 0,
   UsingTempPassword = 1
   Normal = 2
}

When a new user just signed up. You can put his account to the PendingActivation state and send him a link to activate the account, something like this

www.MySite.com/Activate?code=F3D17EE

When user clicks on the link, you match the user account with the code, and do the following:

  1. Generate a temp password for the account, e.g "TempPass12"
  2. Change the account state to UsingTempPassword
  3. Show the following message to user "Your account is now activated. Click here to login with your temp password TempPass12"

After user login to your site with the temp password, your code should detect that the UserAccountState is in the UsingTempPassword state and subsequently redirect the user to the change password page.

After a new password is provided by the user, the account can be put to the Normal state.

Upvotes: 2

lastr2d2
lastr2d2

Reputation: 3968

Add a column in your password table, something like 'ForceToChangePassword'. Check that column every time an user logged in, if it was set to true, redirect user to the change password page.

Upvotes: 2

Related Questions