Hello. Just thought I would document some testing I did today. I upgraded a very basic 4.9.5 test site to v5.5.0, which seems to have gone well.

One thing I have often wanted to implement, but just never worked correctly is hashed passwords. You could always do it, but the user had no way to reset their password and the question answer mechanism didn't work properly.

So I thought I would try this on v5.5.0, and it actually works. Set these attributes in web.config for "AspNetSqlMembershipProvider"
enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="true" passwordFormat="Hashed"

Now a new user registration will include fields for a user defined Question & Answer
If a user forgets their pass phrase, they can now reset it (not retrive it) via the forgot password link. It will prompt them for the answer to their question.
The system generates a random password and emails it to the user.
The user can then login and change their pass prhase to something they can remember.

So this now seems to work like a charm. However (there's always an "however"), if you require a question/answer, which I personally feel is only sensible to avoid abuse, this prevents an administrator from creating any user accounts via the user manager. You can try, but it will stop you with a warning:
 "Your configuration requires the user to enter a Password reminder Question and Answer. This is incompatible with Administrators adding users, so has been disabled for this portal".

Even if you configure user settings to require a valid profile for logon, which for a newly created user, could potentially prompt the user to provide a question/answer when they log in, you cannot create accounts.

While in general, most portals will have the majority of users self-register, there are always exceptions. It seems like this is so close to being completely functional. An obvious work around is to simply register the user on their behalf, and create a dummy question/answer for them, and a crazy password so they will want to change it after their first login.

Bottom line, it is at least usable now. Not sure in which version of 5.x it was fixed to this point, but I am glad it has been.

Rob Ralston

---

Rob Ralston, SilverBullet Technologies LLC, www.silverbullettech.com