search

brockallen / BrockAllen.MembershipReboot

MembershipReboot is a user identity management and authentication library.
Other
742 stars 238 forks source link

Running 8.3.0 and some passwords no longer valid #565

Closed kylegalbraith closed 9 years ago

kylegalbraith commented 9 years ago

Using MR with Identity Server 3, I grabbed the latest version of MR (8.3.0 previously on 7.2.0) and then a couple users in the system could no longer log in even though their password was correct. Looking at the commits in this version, I do not see anything that jumps out at me that would have changed within MembershipReboot. Any idea why all of a sudden a few users could no longer use their current password?

brockallen commented 9 years ago

Not sure. It's unrelated to anything in .config (meaning there's no use of <machineKey> for exmaple). The only thing I can think of is if the iteration count is somehow broken.

kylegalbraith commented 9 years ago

I have revised this as I do not think it has anything to do with an upgrade because we have actually been on 8.3.0 without a problem for a while now. Yet mysteriously some passwords had to be reset this morning as users could no longer log in with them.

This is hosted in AWS elasticbeanstalk using Sql Server as the database to house MembershipReboot. Passwords do not automatically expire in MR or anything like that correct? Seems there is further investigation I need to do. But again this has nothing to do with the upgrade. Apologies for the confusion.

brockallen commented 9 years ago

Right -- the only expiration would be something your app enforces. Thanks for the update.