IdentityManager.AspNetIdentity icon indicating copy to clipboard operation
IdentityManager.AspNetIdentity copied to clipboard

Password update failure

Open Xakkep opened this issue 8 years ago • 2 comments

I start by updating user's password in UI image This results in Http Put request to following URL [https://localhost:44340/idm/api/users/ab879063-a184-495b-a99b-4a85e8c96144/properties/cGFzc3dvcmQ] It then goes to await this.idmService.SetUserPropertyAsync(subject, type, value) and to SetUserProperty(metadata.UserMetadata.UpdateProperties, user, type, value) in IdentityManager.AspNetIdentity.AspNetIdentityManagerService and eventually to

public virtual IdentityManagerResult SetPassword(TUser user, string password)
{
    var token = this.userManager.GeneratePasswordResetToken(user.Id);
    var result = this.userManager.ResetPassword(user.Id, token, password);
    if (!result.Succeeded)
    {
        return new IdentityManagerResult(result.Errors.First());
    }
    return IdentityManagerResult.Success;
}

However, this.userManager.ResetPassword(user.Id, token, password) will be executed on a different thread, so when public Task SetPasswordHashAsync(TUser user, string passwordHash) in UserStore is called, it'll have another version of user object. Thus when execution successfully returns to SetUserPropertyAsync in IdentityManager.AspNetIdentity.AspNetIdentityManagerService and code about to execute var result = await userManager.UpdateAsync(user); we have original version of user object with old value for PasswordHash property. Thus we endup overwriting PasswordHash again to original value. Password change doesn't work.

Since execution of this.userManager.ResetPassword(user.Id, token, password) is controlled by Microsoft's code how is this problem solved? Am I the only one facing this problem? I'm using MySQL store.

Xakkep avatar Feb 23 '16 02:02 Xakkep