Dependant upon the permissions associated with a user, different options are available with regards to the passwords used on a DotNetNuke website. Some of the options available are:
- Duration of password before change required
- Required length
- Password strength (number of non-alphanumeric characters
Given below are the password options available to different DotNetNuke accounts.
Host
As a host account we can set the number of days that the password is valid for, before it needs to be changed. A grace period may also be configured.
To make these changes log in to the website using a host account and select from the admin menu User Accounts.
From either the drop down list of actions, or from the list at the foot of the module select User Settings.
The second section covers the password ageing. Enter a value for the number of days before the password expires and the number days before this when a warning e-mail will be sent. For the password expiry a value of ‘0’ is used to imply no expiry date.
Administration
No additional password options are available for the website administrator.
Users
When a new user account is created the user may either enter a password of their choosing, or opt for the automatically generated one.
The automatic option will be more secure. However, it will be harder to remember.
To change your password click on your user name (often located alongside the login/logout link.
Follow the link for Manage Password, the second item in the row of four options. Enter your current password for confirmation and your new password.
Other
A number of options associated with the password are configured in the web.config file, found in the root of the DotNetNuke website.
Note that changes made within this file will also affect the other portals.
To make the change open the web.config file and edit the section of code shown below:
DNN3.2.2
<membership userIsOnlineTimeWindow="15"> <providers> <add name="DNNSQLMembershipProvider" type="DotNetNuke.Security.Membership.DNNSQLMembershipProvider, DNNSQLMembershipProvider" connectionStringName="SiteSqlServer" enablePasswordRetrieval="true" enablePasswordReset="true" requiresQuestionAndAnswer="false" minRequiredPasswordLength="4" minRequiredNonalphanumericCharacters="0" requiresUniqueEmail="false" passwordFormat="Encrypted" applicationName= "/" description="Stores and retrieves membership data from the local Microsoft SQL Server database" /> </providers> </membership>
DNN3.3.7/DNN4.3.7
<membership userIsOnlineTimeWindow="15"> <providers> <add name="AspNetSqlMembershipProvider" type="Microsoft.ScalableHosting.Security.SqlMembershipProvider, MemberRole" connectionStringName="SiteSqlServer" enablePasswordRetrieval="true" enablePasswordReset="true" requiresQuestionAndAnswer="false" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters= "0" requiresUniqueEmail="false" passwordFormat= "Encrypted" applicationName="DotNetNuke" description= "Stores and retrievesmembership data from the local MicrosoftSQL Serverdatabase" /> </providers> </membership>
As an example to change the number of required characters for the password to 8 and to require a strong password set the minRequiredPasswordLength to be 8 characters and set minRequiredNonalphanumericCharacters to be 1.
