Looking for clarification/confirmation on my issue. My environment is DNN 6.1.5, Win Server 2008 R2, IIS 7.5, .Net 4.0, SQL Server 2008. I'm using Integrated pipeline with a custom service account for app pool identity. Custom service account has full rights to DNN root.
I've run AD authentication on prior systems but always with the default "ENCRYPTED" passwords option. I've also previously used the "HASHED" password store option in conjunction with the default DNN Authentication.
Now, though, I'm setting up a new installation using AD authentication (latest module/provider version 05.00.04 from CodePlex) and attempting to use "HASHED" password store option. Password retrieval is set to "FALSE" since the password format is "HASHED".
The first time an AD user logs in all is fine. A new DNN account is created and the user is logged in.
Subsequent login attempts do not work, however. I get an error that the membership provider is not configured to retrieve passwords:
This Membership Provider has not been configured to support password retrieval.
If I set retrieval to "TRUE", I get an undefined error:
Sys.WebFroms.PageRequestManagerServerErrorException: An unknown error occurred while processing the request on the server. The status code returned from the server was: 500
If I set password retrieval = "TRUE" and set password format = "ENCRYPTED" then all is fine for new AD logins. AD accounts already created with "HASHED" passwords must be deleted and then recreated via a new login attempt but all is fine thereafter.
QUESTION #1:
Do my errors reflect expected behavior? Does the AD provider require password retrieval to be set to "TRUE" (and, therefore, exclude the possibility of using "HASHED" password storage)?
QUESTION #2:
When using AD authentication, does the password value stored in the ASPNET_MEMBERSHIP table reflect the actual password (encrypted or otherwise) or is it a random value (adding security and forcing the AD provider to query AD for password confirmation)? I've seen a few posts suggesting the value stored is random for AD-based accounts.