Hello all,
I have a database of 65,000 users - all of which have their passwords stored using ASP.NET's 'Encrypted' formats. For reasons that I wont go into, we now need to convert all these passwords over to 'Hashed' format.
The problem is that once I've converted the password, I can no longer login to that account with the original password.
I found this on Stack Overflow which was very helpful:
http://stackoverflow.com/questions/4948824/changing-passwordformat-from-encrypted-to-hashed
...and from that a I have created a solution that does the conversion, but it has a problem.
The idea is that you create 2 membership providers - one encrypted (used to read the existing user's password) and the other is hashed (used for changing the user's password)
Here's what I'm using to convert the password for a single account - just for testing before I tackle all 65,000 accounts:
void TestPasswordConversion() { var encryptedProvider = Membership.Providers["EncryptedProvider"]; var hashedProvider = Membership.Providers["HashedProvider"]; string Username = "testaccountnamehere"; MembershipUser user = Membership.GetUser(Username); string CurrentPassword = user.GetPassword(); var resetPassword = hashedProvider.ResetPassword(Username, null); hashedProvider.ChangePassword(Username, resetPassword, CurrentPassword); Guid userID = new Guid(user.ProviderUserKey.ToString()); UpdateUser(userID); } void UpdateUser(Guid userID) { using (var conn = new SqlConnection( ConfigurationManager.ConnectionStrings["MyConnectionString"].ConnectionString)) { conn.Open(); using (var cmd = new SqlCommand("UPDATE [aspnet_Membership] SET [PasswordFormat]=1 where UserID = '" + userID + "'", conn)) cmd.ExecuteNonQuery(); } }
So as you can see, we're getting back the existing password and then using it to change the password using the hashed membership provider.
It also runs a simple UPDATE to change the password format for that user in the aspnet_membership table to 1 (Hashed).
The problem I have is that once the conversion is done, I can't actually login with the orginal password. Somewhere along the line, the password that gets hashed and saved is different to the original password.
Does anyone have any ideas as to what might be happening?