Admin password

Hi, at first i want to thank you for fast replies each time i asked about something.

We faced another problem last time. We lost our administrator password to the project and we need some help with restoring/resetting it. 

We've tried setting up smtp server in the web.config as well as tried copying admin's passwd and salt columns from a known username's and password database into problematic database with no luck. We need to know:


1. How to configure SMTP server without having access to the admin panel?
2. How to configure a custom membership provider in order to auth. as admin?
3. How to reset user_name, passwd and salt columns in sf_users for admin?
4. Which of the above is the preferred method? Anything to be aware of?

Hi Maciej,

To resent the password

1. Open sf_users
2. Set password format to 0
3.Remove the salt
4. Type new password


1. How to configure SMTP server without having access to the admin panel?

This could be done if you write to the SystemConfig.config

<smtpSettings host="somehost" userName="name" password="pwd" />

You can use ConfigManager to do this programmatically

var smtpSettings = Config.Get<SystemConfig>()

2.How to configure a custom membership provider in order to auth. as admin?

You can add an OpenAccess provider through the Membership configurations or standard ASP.NET membership provider declared in the web.config

<membership>
      <providers>
        <clear />
        <add name="Default" type="Telerik.Sitefinity.Security.Data.SitefinityMembershipProvider, Telerik.Sitefinity" />
        <add connectionStringName="AspNetMembership" enablePasswordRetrieval="false"
          enablePasswordReset="true" requiresQuestionAndAnswer="false"
          requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6"
          minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
          applicationName="/" name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" />
      </providers>
    </membership>

3. How to reset user_name, passwd and salt columns in sf_users for admin?

Explained above

4. Which of the above is the preferred method? Anything to be aware of?

Database and config files are closely related. So what you can use is a shared provider if you want to get some data from one website to another.

All the best,
Ivan Dimitrov
the Telerik team

Hi Ivan,

Thanks for your reply. Unfortunately it has solved only half of our problems. Right now Sitefinty allows user to log in but immediately notifies that it has no access to see the backend. In the DB for this user I can see that the user has is_backedn_user set to true, so we should be able to access backend.

The message that I see is:

"You were automatically navigated form "/sitefinity/" because you are not authorized to access that page!

What do you want to do?"

What can we do now to access backend?

Regards

Hi Maciej,

It looks like you have changed the SecurityConfig.config of the project. If the user is an admin there could not be a restriction issue. This happens if SecurityConfig has been deleted, modified or you have made changes to the database and roles IDs.
To fix the issue open sf_role and copy the Ids of the roles you see to the SecurityConfig so that the role Id from the database match the role Id from the SecurityConfig.condig.  Note that the database and config files are closely related and you should not touch them unless there is some critical issue like this one.

All the best,
Ivan Dimitrov
the Telerik team

After you reset the admin password by deleting the Salt and setting the format to 0, how do you get the account to encrypt the password and return to the default format (1) ?  I dont want the password in clear text, but if i change the format back to 1 and attempt to reset the password, it fails....

Hi Peter,

The encryption logic is provided from Sitefinity and modifying the database will not force encryption. The easiest fix I can recommend is to delete the user and create a new one with the same credentials since this one`s password is already in clear text and it will be a lot more harder to force an update on the password using the API.

All the best,
Stanislav Velikov
the Telerik team