PasswordCompatMode

This property gets the password compatibility mode.

Declaration

// C#
public string PasswordCompatMode {get;}

Property Value

A string.

Remarks

The default value is Framework20. The other acceptable value is Framework40. The string value is case-sensitive.

To customize a provider, ASP.NET developers can set a string value for this property through the web.config file using the case-sensitive passwordCompatMode attribute.

When passwordFormat attribute is set to Hashed, the value of System.Web.Security.Membership.HashAlgorithmType property is used to hash password for a Membership user during the creation and validation of the user.

The value for HashAlgorithmType property can be set in the web.config file through the case-sensitive attribute hashAlgorithmType, as in the following example: 

<membership defaultProvider="OracleMembershipProvider" hashAlgorithmType="SHA1"/>

If hashAlgorithmType attribute is not specified in the web.config file, SHA1 will be used. With .NET Framework 2.0, the other valid value for hashAlgorithmType is MD5.

With .NET Framework 4, Oracle recommends that applications using ASP.NET Membership hashed passwords migrate from passwordCompatMode="Framework20" to passwordCompatMode="Framework40". When passwordCompatMode is set to Framework40 and no application-specific hashAlgorithmType is configured, then ASP.NET uses the default HMACSHA256 hash algorithm defined in machine.config. Framework20 is retained for compatibility with existing applications, but it uses the legacy SHA1 hashing algorithm by default, or MD5 when MD5 is explicitly configured.

To use stronger SHA or HMACSHA password hashing algorithms in .NET Framework 4, applications must set passwordCompatMode to Framework40. If the application explicitly configures hashAlgorithmType, then Oracle recommends using a stronger algorithm such as SHA256, HMACSHA256, HMACSHA384, or HMACSHA512. Although SHA1 and MD5 are still supported for backward compatibility, they are legacy algorithms and are not recommended for new applications or migrations.

Changing passwordCompatMode from Framework20 to Framework40, or changing the configured hashAlgorithmType, prevents existing password hashes from validating successfully because passwords are hashed differently. Application administrators should plan a password migration strategy before making these changes. Microsoft provides guidance for migrating ASP.NET Membership applications, including the use of a forced password reset to avoid validation failures:

https://devblogs.microsoft.com/dotnet/hash-passwords-with-asp-net-membership-providers/

Microsoft recommends clearing stored password values to force users to reset their passwords during migration. For Oracle Membership Provider repositories, setting the Password column to an empty string is not supported because Oracle Database treats empty strings as NULL, and the Password column is defined with a NOT NULL constraint. Instead, use the following SQL statement to invalidate existing password hashes and require users to reset their passwords:

UPDATE ora_aspnet_Membership
   SET Password = '!';
 
COMMIT;

Note:

Existing passwords cannot be recovered or rehashed because ASP.NET Membership stores hashed passwords as one-way hashes. Users must reset their passwords after migration unless the application implements a custom migration strategy.

Example

The following is a web.config example that sets hashAlgorithmType to HMACSHA256 and passwordCompatMode to Framework40. 

<!-- Enable and customize OracleMembershipProvider settings -->
<membership defaultProvider="MyOracleMembershipProvider" hashAlgorithmType="HMACSHA256">
             <providers>
    <add name="MyOracleMembershipProvider"
    type="Oracle.Web.Security.OracleMembershipProvider, Oracle.Web,
    Version=4.112.2.0, Culture=neutral, PublicKeyToken=89b483f429c47342"
    ConnectionStringName="my_membership_app_con_string"
    applicationName="my_membership_app"
    enablePasswordRetrieval="false"
    enablePasswordReset="true"
    requiresQuestionAndAnswer="true"
    requiresUniqueEmail="true"
    passwordFormat="Hashed"
    maxInvalidPasswordAttempts="4"
    minRequiredPasswordLength="9"
                passwordCompatMode="Framework40"
    passwordAttemptWindow="8"/>
          </providers>
</membership>

See Also: