ASP.NET Membership - Retrieve Password and PasswordSalt from Membership Table - Hash UserID

Question

I am so close to get this project done. I need to retrieve the password and passwordSalt from my Membership table to compare it to my 'OldPasswords' table.

The problem is the Membership provider does not let me use the GetPassword method because the password is hashed.

And I can not retrieve it in a normal sqlConnection because the UserID is hashed also.

Does anyone know how to hash the UserID so I can put it in my where clause?

Or maybe there is a different way to get to that data?

Any help is appreciated.

Thank you,

Steve

Solution 1

Steve, the UserId is not hashed. You may be confusing UserName with UserId (ProviderUserKey) which is a Guid.

In the context of your other questions: You should reference this code in both the code that you use to create a new user in order to log the initial password hash, salt and format AND in the OnPasswordChanging so that you can check/reject/insert.

This will get the relevant information for the currently logged in user:

var user = Membership.GetUser();
var userId = user.ProviderUserKey;

MembershipPasswordFormat passwordFormat;
string passwordSalt;
string password;

var cstring = WebConfigurationManager.ConnectionStrings["localSqlServer"];
using (var conn = new SqlConnection(cstring.ConnectionString))
{
    using (var cmd = conn.CreateCommand())
    {
        cmd.CommandText = "select PasswordFormat,PasswordSalt,Password from aspnet_Membership where UserId=@UserId";
        cmd.Parameters.AddWithValue("@UserId", userId);
        conn.Open();
        using (var rdr = cmd.ExecuteReader())
        {
            if (rdr != null && rdr.Read())
            {
                passwordFormat = (MembershipPasswordFormat) rdr.GetInt32(0);
                passwordSalt = rdr.GetString(1);
                password = rdr.GetString(2);
            }
            else
            {
                throw new Exception("An unhandled exception of type 'DoesntWorkException' has occured");
            }
        }
    }
}

//do something interesting hew with passwordFormat, passwordSalt , password 

Solution 2

There seem to be a couple of different things going on here...

• You cannot recover a hashed password. Period. The purpose of hashing is to prevent exactly this kind of recovery.

• You can hash the User ID for a lookup if the User ID value is already hashed in the database for some reason (although, that is a little strange, there is no good reason to hash a User ID). But you need to know how it was hashed. If it's MD5 or SHA1, the quickest way is to use FormsAuthentication.HashPasswordForStoringInConfigFile (but use it on the user name instead of the password).

• The salt should definitely not be hashed, otherwise it's unusable. Salts are appended to the clear-text password before hashing, so whatever value you see in the salt column is the salt.