A Wat. wrote:
I thought that by enabling these values in the web.config:
Original behaviour can be restored by altering your Web.config-file. Look for the "enablePasswordRetrieval"-attribute and set it to "true". Also, on the same line, alter the "passwordFormat"-attribute to "Clear" or "Encrypted"
I would get a "Retrieve password" link on the login - allowing users to have their password emailed to them. however, when I change the web.config as above I still just have a "reset password" button
Are my expectations off base?
I'm afraid they are -let me give some background.
Originally (since dnn 3.0 when we introduced Microsofts memberrole component that the web.config settings apply to) we used encryption as the default. As encryption is a reversible (decryption) operation it meant that an encrypted password could be retrieved. As such Microsoft decided to support retrieving your password i.e an email with your password would be sent out. They realised that this is not very secure as emails are plain text and can be intercepted/read, so added the option to send out a new (reset) password. Realistically that isn't much more secure as it also goes over email but it was slightly better.
With the 7.0.0 release DNN changed to using hashed passwords -hashing is a one way operation so password emails are not possible (in fact if you set hashing and password retrieval the Microsoft component throws an exception). As such we could have simply gone with password reset - but we wanted to improve on Microsoft's poor design, so we introduced password reset tokens. By doing this the token is 1-time use only (and short lived) and no password is ever emailed.
Our product team considered running with both systems (ie allowing password retrieval for encryption, but password reset link for hashing), but that is not ideal due to the additional code and checking - and doesn't address Microsofts original poor design. As such we decided that all passwords will only be able to use password reset links - this does mean that some of the settings such as passwordretrieval no longer really apply, but it means that the overall system is better, no passwords are ever sent my email and it meant we could integrate with other subsystems such as password history (you can't really integrate password history/banned passwords when you generate random passwords on reset)