Yea...

K well FYI it doesn't work with HASHED password...

And it provides no user methods for doing reset passwords.

So the only thing DNN is capable of doing is e-mailing a user a clear text (non secure) version of their password...
Which doesn't seem that cool :(

The only way to enable password reset is to replace the login system with a custom built system.
right?

asp.net has a baked in forgot password feature. That works against the membership provider. It doesn't seem like it'd be that much of a stretch to implement reset password.... It seems like it should just be there but it's not.

So on that note is there a way to just get the forgot password link on the login page to link to a custom page?

Or do I just have to bake up my own entire login control.... just to get the built in .net feature of reset passwords?

AFAIR there is a question/answer option built into tnhe MS membership component, which is now (DNN5) supported by the DNN membership provider - however, I haven't tried yet. For documentation of the feature and web.config settings, check out MSDN.

I haven't checked that this works yet as I don't have a Hashed passsword dev site at the moment, but "in theory" this is what you need to do.

1. First step - ResetPassword must be set to true in the web.config

2. Requires Question and Answer must also be set in the web.config

3. User will then see a "Reset Password option in their "Password" area of their User Account settings

Now - this is not easy to implement with an existing database of users as existing users will not have the Question and Answer set if they signed up before that setting was enabled.

If (1) is enabled and (2) is not - then the Admin can reset the user's password but not the user.  If both are enabled only the user can reset the password

This behaviour is based on the Membership API.