How to enforce users to change their password on first login.

Question

0.00/5 (No votes)

See more:

I created an application which has 6 kind of users.
There are three tables. The first one is named ROLE that holds the role of user. The second one is named IDENTIFICATION that holds the username and password of a user and finally the third table is named PERSON that holds the detail of a user like first name, last name, date of birth etc.

The problem exists that I'm not using any kind of membership providers.
There are three kind of admins that register other kind of members according to they role.
The table ROLE has only two columns like ID_Role (auto increment property) and RoleName.
The table IDENTIFICATION which has ID_Identification, UserName, Password, and ID_Role.
The table PERSON except person data has the columns of ID_Role and ID_Identification

What is the code in C# or what I have to do when admin registers the user, after the user logs in for the first time to enforce him to change his password.

Thank you in advance for your reply.
Cheers.

Posted 3-Nov-15 3:11am

dr_iton

Add a Solution

Comments

Corporal Agarn 3-Nov-15 9:31am

How is the initial password set?

Krunal Rohit 3-Nov-15 10:58am

I assume you're allowing users to register with password.
Check if the registration password and whatever enters at the login time password is same or not. If it is same redirect to change password page, else redirect to wherever you want.

As you haven't shown your code, it is hard to tell how you can do it. Though it was a basic idea, not you're supposed to implement it.

-KR

dr_iton 3-Nov-15 11:55am

I'm using a data table to check if the user exists in database. If user exists, than he can be logged in and redirected to a specific site.
When I register a user the username is firstname.lastname, if the database has an record with the same first name and last name than his username gets auto increment like firstname1.secondname and so on.
@KrunalRohit according to you, do I have to make another column in the table IDENTIFICATION about the registration time or what do you suggest.
Thank you again.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Joshi, Rushikesh · Accepted Answer · 2015-11-03T05:37:00

You haven't provided other information how you are setting initial password, do you want user to Authenticate to make sure there is no Robot creating user (like Varify Email etc..)...

Simple just add IsAuthenticated column into IDENTIFICATION table.

And keep it false initially, and on first login check this value and if it false then force users to change their password.

also this field can be use in future if you want a user to change their password after every 3 months or want to change password change policy across the all user.

If I wanted to implement a secure website I will definitely go with this way.

Like my 12 years old Google account initially allowing me to provide only 3 chars password then after 5 years they changed to 6 chars and few years back they they are now enforcing to use special characters for all new account, but on old account they are still allowing me login with 6 chars account. Say tomorrow if they want to enforce everyone to change password, they just need to update flag :)

Hope this will help and will give you a direction.

Thanks
Rushi