Skip to content

Instantly share code, notes, and snippets.

@StefanoChiodino
Created December 20, 2018 14:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save StefanoChiodino/42f0c4b7ac548316bc198e3dcb170b5b to your computer and use it in GitHub Desktop.
Save StefanoChiodino/42f0c4b7ac548316bc198e3dcb170b5b to your computer and use it in GitHub Desktop.
Umbraco - set strong password policy
using Microsoft.Owin;
using Owin;
using Umbraco.Core;
using Umbraco.Core.Security;
using Umbraco.Web.Security.Identity;
using Umbraco.Core.Models.Identity;
using Website.Web;
using Umbraco.Web;
//To use this startup class, change the appSetting value in the web.config called
// "owin:appStartup" to be "UmbracoCustomOwinStartup"
[assembly: OwinStartup("UmbracoCustomOwinStartup", typeof(UmbracoCustomOwinStartup))]
namespace Website.Web
{
/// <summary>
/// A custom way to configure OWIN for Umbraco
/// </summary>
/// <remarks>
/// The startup type is specified in appSettings under owin:appStartup - change it to "UmbracoCustomOwinStartup" to use this class
///
/// This startup class would allow you to customize the Identity IUserStore and/or IUserManager for the Umbraco Backoffice
/// </remarks>
public class UmbracoCustomOwinStartup : UmbracoDefaultOwinStartup
{
public new void Configuration(IAppBuilder app)
{
app.SanitizeThreadCulture();
this.ConfigureServices(app);
this.ConfigureMiddleware(app);
}
/// <summary>
/// Configures services to be created in the OWIN context (CreatePerOwinContext).
/// </summary>
/// <param name="app"></param>
protected new void ConfigureServices(IAppBuilder app)
{
app.SetUmbracoLoggerFactory();
this.ConfigureUmbracoUserManager(app);
}
/// <summary>
/// Configure the Identity user manager for use with Umbraco Back office.
/// Additionaly also sets stronger password requirements.
/// </summary>
protected new void ConfigureUmbracoUserManager(IAppBuilder app)
{
var applicationContext = ApplicationContext.Current;
app.ConfigureUserManagerForUmbracoBackOffice<BackOfficeUserManager, BackOfficeIdentityUser>(
applicationContext,
(options, context) =>
{
var membershipProvider = MembershipProviderExtensions
.GetUsersMembershipProvider()
.AsUmbracoMembershipProvider();
var settingContent = Umbraco.Core.Configuration.UmbracoConfig.For.UmbracoSettings().Content;
var userManager = BackOfficeUserManager.Create(options,
applicationContext.Services.UserService,
applicationContext.Services.EntityService,
applicationContext.Services.ExternalLoginService,
membershipProvider,
settingContent);
SetPasswordRequirements(userManager);
return userManager;
});
}
private void SetPasswordRequirements(BackOfficeUserManager backOfficeUserManager)
{
// If this doesn't work we want to fail hard.
var membershipProviderPasswordValidator = (MembershipProviderPasswordValidator)backOfficeUserManager.PasswordValidator;
// Set strong password policy.
membershipProviderPasswordValidator.RequireDigit = true;
membershipProviderPasswordValidator.RequireLowercase = true;
membershipProviderPasswordValidator.RequireNonLetterOrDigit = true;
membershipProviderPasswordValidator.RequireUppercase = true;
membershipProviderPasswordValidator.RequiredLength = 9;
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment