Password auditing requirements. #3475

10 Answer(s)

• 

  0

  alper created 7 years ago

  Support Team

  Hi,

  Currently there's no such password policy. We are planning to implement those features in the future but there's no timeline for now.

  Save Cancel
• 

  0

  velu created 7 years ago

  OK then tell me that, How can i archive this functionality.

  Some other related query's.

  1. how can i encrypt decrypt password using apb framework.
  2. we are thinking that to create login audit table( at database end )- then how can i check password is exist in that table.
  3. where can i implement this logic..... (Log in page, which controller)

  Save Cancel
• 

  0

  velu created 7 years ago

  We want to get last log in datetime(at the time of user log in ) from database but some difficulties over there.

  see url (pdf) for more info

  [https://drive.google.com/file/d/0BzSirtYGe7EHRUE2OVNlQ3FQZ0E/view?usp=sharing])

  Save Cancel
• 

  0

  ismcagdas created 7 years ago

  Support Team

  Hi @velu,

  For your last question, you need to get user from database before this line:

  var loginResult = await GetLoginResultAsync(loginModel.UsernameOrEmailAddress, loginModel.Password, GetTenancyNameOrNull());
  

  You can do it by using AbpSession.TenantId and given username/email address.

  Thanks.

  Save Cancel
• 

  0

  ismcagdas created 7 years ago

  Support Team

  Hi @velu,

  I will try to answer your questions:

  1. how can i encrypt decrypt password using apb framework. You can inject

  private readonly IPasswordHasher<User> _passwordHasher;
  

  and then use

  var hashedPassword = _passwordHasher.HashPassword(user, plainPassword);
  

  2. we are thinking that to create login audit table( at database end )- then how can i check password is exist in that table. You can hash given password and query db with it.

  3. where can i implement this logic..... (Log in page, which controller) Yes, you need to implement it in Account Controller's Login action.

  Thanks.

  Save Cancel
• 

  0

  velu created 7 years ago

  <cite>ismcagdas: </cite> Hi @velu,

  For your last question, you need to get user from database before this line:

  var loginResult = await GetLoginResultAsync(loginModel.UsernameOrEmailAddress, loginModel.Password, GetTenancyNameOrNull());
  

  You can do it by using AbpSession.TenantId and given username/email address.

  Thanks.

  Dear Sir,

  as per your reply

  You are not providing any code for accessing database record.

  I found that in your code or database The field name LastLogintime [Table : abpusers] is a current login time not lastlog in time.

  Also i check through code

  var lstLogTime = UserManager.FindByIdAsync((long)AbpSession.UserId);
                  var retTime = (lstLogTime).Result.LastLoginTime;
  

  in above code "retTime " is current log in time.

  and also this line of code has current login time.

  var loginResult = await GetLoginResultAsync(loginModel.UsernameOrEmailAddress, loginModel.Password, GetTenancyNameOrNull());
  

  ---

  Save Cancel
• 

  0

  velu created 7 years ago

  <cite>ismcagdas: </cite> Hi @velu,

  I will try to answer your questions:

  1. how can i encrypt decrypt password using apb framework. You can inject

  private readonly IPasswordHasher<User> _passwordHasher;
  

  and then use

  var hashedPassword = _passwordHasher.HashPassword(user, plainPassword);
  

  2. we are thinking that to create login audit table( at database end )- then how can i check password is exist in that table. You can hash given password and query db with it.

  3. where can i implement this logic..... (Log in page, which controller) Yes, you need to implement it in Account Controller's Login action.

  Thanks.

  how can i validate hashed password on the database.

  Save Cancel
• 

  0

  ismcagdas created 7 years ago

  Support Team

  Hi @velu,

  When you run this line:

  var loginResult = await GetLoginResultAsync(loginModel.UsernameOrEmailAddress, loginModel.Password, GetTenancyNameOrNull());
  

  And if it is successfull, it updates user's LastLoginTime as well.

  You can use UserManager's "FindByNameOrEmailAsync" method to find user before this line. In that way, you can get correct LastLoginTime.

  how can i validate hashed password on the database.

  Can you explain this a bit more ?

  Thanks.

  Save Cancel
• 

  0

  velu created 7 years ago

  Dear all,

  We are implemented following functionalities in our application.

  User should get prompt to change the password after 30 days (if log in after 30 days).. User should not allow to use last five password .

  thanks :idea:

  Save Cancel
• 

  0

  ismcagdas created 7 years ago

  Support Team

  Thanks for the feedback @velu :)

  Save Cancel