Hi,

Is there a way to avoid special characters like "@#$%^: " from the password generation and restrict the password generation to allow numbers and alphabets. I have loooked into web.config's "minRequiredNonalphanumericCharacters" property, which only gives an option either to have it or not. Can setup a pattern to allow only numbers and alphabets?

Thanks,
Ramesh

Hi Ramesh,

This is actually a harder problem than it would appear; the Membership.GeneratePassword method only allows specification of the *minimum* number of non-alphanumeric characters in a generated password; there is no way to enforce a maximum here.  A generated password also is not guaranteed to meet the regular expression criteria specified in PasswordStrengthRegularExpression.  See the documentation for more details.

Your sole recourse will be to roll-your-own password generation (which I strongly discourage), or implement your own membership provider (by decorating the ASP.NET membership provider) and overriding GeneratePassword.  You must be very careful here to not interfere with the cryptographically-valid entropy used in the underlying generation mechanism; this is a very dangerous area to be playing in.

I've long meant to blog about this and distribute a properly-constructed password generator with a maximum non-alphanumeric threshold that decorates any other membership provider, but my plate has been full of late.  Maybe someday I'll be able to get to it!

Brandon