dotnet / dotnet/aspnetcore

Offer backward compatible Identity rule mechanism

Open
#39,194 6 comments 3 reactions 0 assignees View on GitHub
area-identity enhancement triaged
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

It's unclear to me, unfortunately, if this is a design flaw (in which case it would be a feature request to fix that) or if there is a built-in solution (in which case this is a question).

### Is your feature request related to a problem? Please describe.

ASP.NET Core Identity has the possibility to define rules for e.g. usernames, which is usually widely used.
However, it is also often the case in the real world that these rules can change - for example, special characters are subsequently banned in the username.

But, if the rules are changed, many identity operations can end with exceptions on existing users.
For example, a **password** can no longer be changed if a **username** does not match the new rules....(!).

> Password change exception: Identity Error InvalidUserName: Username 'User Name' is invalid, can only contain letters or digits.

It is forced to update all usernames when the rules are changed. Why?

Unfortunately, this only becomes apparent when the corresponding updates have been rolled out. And then a manual intervention of the developers in the production system is necessary, e.g. to be able to fight password leaks (current case).
The user himself is blocked.

### Describe the solution you'd like
A backward compatible solution would be better or a way to hook into the validation process for such cases.

Or just dont validate the username if the user just changes the password.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.