Maintain ASP.Net membership passwords during machine key change

Question

Is there an utility or code sample that can decrypt with the old key, and then encrypt passwords with a new key for ASP.Net membership users?

Answer 1

None of the workarounds mentioned worked for me. My solution is below. It involves first storing passwords in clear text and then reencrypting them again with new MachineKey.

Machine Key Change

Answer 2

This is my best guess at a solution, but I haven't had a chance to test it. It relies on the following settings for your current provider:

enablePasswordRetrieval="true" requiresQuestionAndAnswer="false" passwordFormat="Encrypted"

It also assumes that the new machinekey is already in the config file.

Create the following class (thanks to mootinator for the jumpstart on this)

using System.Reflection;
using System.Web.Configuration;
using System.Web.Security;
namespace MyNamespace
{
    public class MySqlMembershipProvider : SqlMembershipProvider
    {
        protected override byte[] DecryptPassword(byte[] encodedPassword)
        {
            MachineKeySection section = (MachineKeySection)WebConfigurationManager.GetSection("system.web/machineKey");
            section.DecryptionKey = "oldkey"; // TODO: Set your old key here

            MethodInfo method = typeof(MachineKeySection).GetMethod("EncryptOrDecryptData", BindingFlags.Instance | BindingFlags.NonPublic);

            return (byte[])method.Invoke(section, new object[] { encodedPassword, null, 0, encodedPassword.Length, 0, false, false });
        }
    }
}

In your web.config:

<membership defaultProvider="DefaultSqlMembershipProvider">
  <providers>
    <clear/>
    <add name="DefaultSqlMembershipProvider" connectionStringName="MembershipConnectionString" enablePasswordRetrieval="true" requiresQuestionAndAnswer="false" applicationName="TODO" passwordFormat="Encrypted" type="System.Web.Security.SqlMembershipProvider"/>
    <add name="MySqlMembershipProvider" connectionStringName="MembershipConnectionString" enablePasswordRetrieval="true" requiresQuestionAndAnswer="false" applicationName="TODO" passwordFormat="Encrypted" type="MyNamespace.MySqlMembershipProvider"/>
  </providers>
</membership>

Change the passwords with the following code:

MembershipProvider retrievePasswordProvider = Membership.Providers["MySqlMembershipProvider"];

foreach (MembershipUser user in Membership.GetAllUsers())
{
    MembershipUser retrievePassworedUser = retrievePasswordProvider.GetUser(user.UserName, false);
    string password = retrievePassworedUser.GetPassword(); // get password using old key

    user.ChangePassword(password, password); // change password to same password using new key
}

Let me know if that works for you.

Answer 3

I think you could do this by setting the key on the fly:

You might have to extend the SqlMembershipProvider (or whatever you use) to get access to the protected DecryptPassword method.

    MachineKeySection section = (MachineKeySection)WebConfigurationManager.GetSection("system.web/machineKey");

section.DecryptionKey = "old";
// Read old password
section.DecryptionKey = "new";
// Store new password