Maintaining Password History in SharePoint 2013 (FBA)

Question

I am working on a SharePoint 2013 (on premise) application where I have implemented Forms Based Authentication (FBA) wherein usernames and passwords are saved (in encrypted format) in SQL membership database. Now when any user changes his/her password (via custom login page), the old password gets overrides and hence the last five passowrds are not saved in the database.

I just want to know if SQL membership database provides any functionality to store/save the previous passwords.

Quick help would be highly appreciable!

Answer 1

Unfortunately there's nothing built into the SQL Membership provider, so you will have to customize it yourself.

Answer 2

By default, the user password cannot be retrieved in the Membership database.

In the machine.config

<add name="FBAMembershipProvider"
 type="System.Web.Security.SqlMembershipProvider, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
 connectionStringName="FBADB"
 enablePasswordRetrieval="false"
 enablePasswordReset="true"
 requiresQuestionAndAnswer="false"
 applicationName="/"
 requiresUniqueEmail="true"
 passwordFormat="Hashed"
 maxInvalidPasswordAttempts="5"
 minRequiredPasswordLength="7"
 minRequiredNonalphanumericCharacters="1"
 passwordAttemptWindow="10"
 passwordStrengthRegularExpression="" />

Note:passwordFormat=Clear/Hashed/Encrypted

• Clear stores the password in the database as plain text, so anybody with access to the database can read the user’s password.
• Encrypted encrypts the user’s password, so although the password isn’t human readable in the database, it can still be decrypted and the user’s actual password retrieved.
• Hashed stores a one way hash of the password. When a user authenticates, the password they enter is hashed as well and matched against the stored hashed value. Using this method, the user’s password can never be retrieved (even if your database is stolen),only reset.

Generally, recommend using “Hashed” as it is the most secure way of storing the user’s password.