I have an MVC 4 web application that requires user to login. Most of the users don't have email accounts. If someone forgot his password, how do I reset it? All the reset password systems I find require some sort of email account. I just want something simple, such as reset it to a default password, and the user can change his password once he logon using that default password. The problem is the password is encrypted in SQL Server. I can't find a tool that encrypt password.
First off the most widely used authentication implementations go to considerable lengths to prevent user credentials being stored in a reversible (i.e. plane text, or something that could be encrypted) format. Instead you should hash & salt plane text credentials and compare with a stored value.
Next to securely reset a users credentials you need to authenticate them through some other means, this is as you mention most commonly achieved through email, but if this isn't possible you should look at other out-of-band methods of authentication, perhaps send the user a SMS with a one time code, or make them answer a series of security questions. Once you have validated the users identity, force them to set a new password and override your stored hash for the user.
Related
My use case is something like this.
I'm developing a rest api and single page web application.
But I don't want to store my user credentials (email, password) with me.
I want to store it in more secure place. From that place I need to verify credentials and issue tokens, as well as first time user register with the system that user's email ID should be verified and also If an user forgot his password there should be a way to reset it as well.
Finally in my node.js back-end I need to protect my routes from unauthorized accesses.
Do I can achieve all this things using a authentication service provider.
I go through the firebase docs and found It is little bit harder to implement my what I want using the firebase.
Is authentication services capable to provide reset password and email verification and store user credentials.
Or it just a token generator only?
If you are asking if Firebase Auth provides the ability to generate tokens for verified email/pass credentials it securely stores with email verification and password reset, the answer is yes. Learn more from their official documentation: https://firebase.google.com/docs/auth/web/password-auth
They also provide the ability to issue session cookies better suited for a Node.js server side managed sessions: https://firebase.google.com/docs/auth/admin/manage-cookies
You don't need to store the credentials. Firebase Auth will store them for you using industry best practices.
I have a Ruby on rails application, i have integrated AWS Cognito to achieve SSO. It's all working.Earlier to that I was using devise for authentication and to achieve password_expirable and password_archivable.I searched through Amazon docs for ruby but could not find any way to achieve it.
I am looking for some example or guidance to achieve the same using AWS Cognito.
Thanks for the help
Currently there is no in built support for password expiry in Cognito. Something which can be considered for future releases.
For security reasons Cognito only stores SRP password verifier, so there is no way to check the history of saved passwords and match is against the new one. So this is unlikely to be implemented in future.
By nature of SSO, the users will likely be authenticating with their Facebook, Google+, Microsoft accounts. You don't want to force them to reset their password on these accounts do you?
Would Multi-Factor-Authentication (MFA) better suit your security requirements?
If so, you you can set up a User Pool with Amazon Cognito. With a User Pool, you can get programmatic access to the User Pool and enforce MFA. Then, via Amazon SNS or email, the users can be authenticated via phone or email.
To force users to reset their passwords, Cognito's pre-authentication trigger event can be used. Have a field in user pool, which checks password's age. If it exceeds the determined age, then have a Lamdba trigger generate an event to force the user to change the password by using AdminResetUserPassword API. Make sure to update password's age, whenever user updates his/her password, as part of other password change flows (Forgot Password flow) as well.
I'm well aware that passwords should be hashed and then saved to the database. But in my situation, I need to get the User's Username and Password in order to activate their accounts on my Linux VPS.
Depending on which server they subscribe on, they'll be reactivated on a monthly basis, so I'll need access to user passwords at all times (not just when they register).
Is there a way to store the passwords in the database unhashed or would that be too risky?
In my iOS app I have my user authenticate against our Domino server and store the username and password. I have some web pages that I want the user to see and am loading them in a UIWebView. However, every time I try to go to the page I am being challenged for authentication. I think I need to send a post to the server with my username and password but I am not sure how to do that?
I've never done that with iOS, so take this with a grain of salt, but I think there are generally two ways to do it:
You can likely pass the UN/password combination along as HTTP Basic authentication in each request. I believe it's the case that Domino will honor those credentials even when session auth is enabled.
If you're using session auth, you can do what you intimate: POST to a Domino URL containing the ?Login command (typically, "/names.nsf?Login" is a good choice) with Username and Password parameters (along the lines of How can I login to Domino via Ajax? ). The resultant value of a successful login will contain an authentication token cookie (typically DomAuthSessId or LtpaToken, depending on whether or not you're using SSO). By including that in the Cookie header in future requests, you should be able to continue the login.
I have an ASP.NET MVC web app which requires the user to login with their domain username and password by validating against ActiveDirectoryMembershipProvider.
On login I use ValidateUser(username, password) to validate the user's credentials, and I then set the forms auth cookie so that in future requests the user is not asked to enter their username and password again
FormsAuthentication.SetAuthCookie(m.Username, true);
This is fine, but I need to periodically re-validate the user to make sure their domain password has not changed, and I don't want them to have to enter their credentials again.
One way of doing this would just be to store the user's password in plain text in the session object, or perhaps encrypting it then later decrypting it. Then I could call ValidateUser once more, and log the user out if necessary.
In other web apps where I've rolled my own auth I would simply store a hash of the user's password and compare that to the hash stored in the database.
There doesn't appear to be a single method on ActiveDirectoryMembershipProvider which would let me do that.
What is the logical thing to do here?
The answer is to periodically (every 30 minutes or so) check User.IsApproved and User.LastPasswordChangedDate to make sure the users credentials are still valid.
To do this you need to manually create the FormsAuthenticationTicket and cookie, rather than using FormsAuthentication.SetAuthCookie.
Put the date you validated the user inside UserData and compare this against LastPasswordChangedDate.
I've implemented this and it works perfectly.
More information here
Check if Active Directory password is different from cookie