While bug fixing I took a deeper look into this issue as I and others have encountered it in the past. I will document here and in github: [
https://github.com/DNNCommunity/DNN.A....
First the process....
First time user logins: when a user logs in, they are authenticated against AD and then a DNN user is created (if doesn't exist) with a random password.
Not first time user logs in: if the local DNN user exists after AD authentication, then for update purposes, the validated DNN user needs to be retrieved. In order to retrieve it, the "ValidateUser" method is
used [
http://www.dotnetnukeru.com/dnndocs/a....
Here is where things get complicated. In order to validate the user, the local DNN password must be provided. The password was created at random and the module has no way of knowing the password. So how does the module retrieve the password for user validation? 2 Options....
Retrieve the password from the user using the System.Web.Security.MembershipUser.getPassword() method. This requires that the enablePasswordRetrieval attribute in web.config be set to true. Also required is the attribute passwordFormat to 'clear' or 'encrypted'. Hashed passwords cannot be retrieved. I believe that this module originally was created before the hashed option and therefore only checked for the enablePasswordRetrieval attribute before attempting the get the password (new check will be added in next pull request). If enablePasswordRetrieval is false and/or passwordFormat is hashed then option 2 must be used.
Create a new random password on the fly, change the users password to the new one, use the new password to validate the user. In the event that enablePasswordRetrieval and/or passwordFormat is hashed, then the system cannot retrieve the existing password. Exceptions will be thrown, tears shed, and many questions asked. Instead, a new password is created. Then the DNN user controller method "ChangePasswordByToken" is used to change the users password. HOWEVER, now the enablePasswordReset attribute must be set to true in web.config to allow this. If false then an exception will be thrown, tears shed, etc.
Conclusion,
For this module to work correctly, you must:
set enablePasswordRetrieval = false & set passwordFormat = hashed & set enablePasswordReset = true
set enablePasswordRetrieval = true & set passwordFormat = clear or encrypted
Next pull request will include a new check for passwordFormat = hashed so that if it is set to hashed no password retrieval will be attempted.