FBA login failed if passwordFormat=“Encrypted” in web.config files

Question

I am using FBA with SqlMembership Provider in sharepoint 2010 and its not working if i set passwordFormat="Encrypted" in all web.configs(web,central,STS) and here is error from ULS Password check on 'cratledge' generated exception: 'System.Configuration.Provider.ProviderException: You must specify a non-autogenerated machine key to store passwords in the encrypted format. Either specify a different passwordFormat, or change the machineKey configuration to use a non-autogenerated decryption key.
at System.Web.Security.MembershipProvider.EncryptPassword(Byte[] password)
at System.Web.Security.MembershipProvider.EncodePassword(String pass, Int32 passwordFormat, String salt)
at System.Web.Security.SqlMembershipProvider.CheckPassword(String username, String password, Boolean updateLastLoginActivityDate, Boolean failIfNotApproved, String& salt, Int32& passwordFormat)
at System.Web.Security.SqlMembershipProvider.ValidateUser(String username, String password)
at Microsoft.SharePoint.IdentityModel.SPFormsUserNameSecurityTokenHandler.ValidateToken(SecurityToken token)'.

Now if i change PasswordFormat from 2(Encrypted) to 0(Clear) then its working.

please advise on this issue

Thanks ROnak

Answer 1

The issue is what the error states: You need to specify the key that is used to encrypt/decrypt the password in machineKey section of the web.config. There is more information here:

http://technology.bauzas.com/programming/net/you-must-specify-a-non-autogenerated-machine-key-to-store-passwords-in-the-encrypted-format-either-specify-a-different-passwordformat-or-change-the-machinekey-configuration-to-use-a-non-autogenera/

Don't forget to make these changes to all web.config files (STS, Central Admin + Web Applications)

I would recommend using the value "Hashed" instead, which does not need this key and is actually more secure than "Encrypted" - as Encrypted passwords can be decrypted while Hashed passwords cannot.

Answer 2

it seems that you should remove the machinekey tag from web config when using hashed format, i noticed that new passwords generates with password format = 2 while its set to hashed format (which suppose to be = 1 in DB), i am not sure if its because the machinekey settings!!