AspNetSqlMembershipProvider 和 PasswordRecovery 控件
我的场景是我有一个 asp.net 2.0 应用程序 Web 应用程序，其 AspNetSqlMembershipProvider 属性为：
enablePasswordRetrieval=“false”和passwordFormat=“Hashed”
但现在需要将未加密的用户密码存储为明文并将其显示给超级用户。 我通过将 AspNetSqlMembershipProvider 属性更改为：
enablePasswordRetrieval=“true”和passwordFormat=“Clear”
问题在于PasswordRecovery 控件的行为方式。 根据我的阅读，它会检查 AspNetSqlMembershipProvider 标记的属性，如果enablePasswordRetrieval =“true”且passwordFormat =“Clear”，它将尝试检索密码，当密码仍然有效地存储为散列密码时，这会导致问题。 当 AspNetSqlMembershipProvider 属性为enablePasswordRetrieval =“true”和passwordFormat =“Clear”时，是否有任何方法可以强制PasswordRecovery控件重置而不检索密码？
抱歉冗长的解释，一如既往地非常感谢所有帮助/指示。 谢谢。
My scenario is I have a asp.net 2.0 application web application which had the AspNetSqlMembershipProvider properties as:
enablePasswordRetrieval="false" and passwordFormat="Hashed"
But now the need has risen to store user's passwords unencrypted as clear text and display them to Superusers. I have done this by changing the AspNetSqlMembershipProvider properties to:
enablePasswordRetrieval="true" and passwordFormat="Clear"
The problem is the way the PasswordRecovery control behaves. From what I have read it checks the properties of the AspNetSqlMembershipProvider tag if enablePasswordRetrieval="true" and passwordFormat="Clear" it will attempt to retrieve the password this is causing a problem when the password is effectively still stored as a hashed one. Is there any way of forcing the PasswordRecovery control to reset not retrieve the password when AspNetSqlMembershipProvider properties are enablePasswordRetrieval="true" and passwordFormat="Clear"?
Sorry for the long winded explanation, all help / pointers very much appreciated as always. Thank you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为尝试使用两种方法在数据库中存储密码不会有任何运气。
我的建议是更改具有哈希密码的帐户的密码，以便它们以纯文本形式存储并从那里继续。
或者，如果您必须存储一些散列密码和一些明文密码，则必须考虑扩展会员资格提供程序来支持这一点。 根据我的经验，这往往带来的麻烦大于其价值。
I don't think you'll have any luck trying to use two methods for storing passwords in the database.
My advice is to change the passwords on the accounts that have hashed passwords so they get stored as plain text and move on from there.
Alternatively, if you must store some hashed and some clear-text passwords, you'll have to look at extending the membership provider to support this. In my experience, this is often more trouble than it's worth.
根据我的经验，更改密码格式是有问题的——我认为没有办法让提供商自动为您处理这个问题。
您可能需要考虑强制哈希用户在下次登录时更改密码，或者只是编写一个在数据库中执行并重置其密码的过程。 密码表中有一列（我现在看不到）描述了格式，因此您可以将该值从散列更改为明文，然后散列值将是其明文密码，并且应该适用于登录。
From what I've experienced changing password formats is problematical -- I don't think there's a way to make the provider automatically handle this for you.
You might want to consider forcing the hash-users to change their passwords the next time they login or simply write a process that goes through and resets their passwords in the database. There's a column in the password table (I can't look at one right now) that describes the format, so you could change that value from hash to clear and then the hash-value would be their clear-text password and should work to login.
另外，请记住，以明文形式存储密码会产生法律影响。 如果这些密码被滥用或泄露，您将对所有受到损害的数据负责（包括通过您不拥有但用户使用相同密码的任何其他服务访问的数据）。
Also, remember that there are legal implications of storing passwords in plaintext. If those passwords are abused or leaked, you are responsible for all the data that is compromised (including data accessed through any other services that you do not own, but the user used the same password for).