Password update failure #27
Description
I start by updating user's password in UI
This results in Http Put request to following URL [https://localhost:44340/idm/api/users/ab879063-a184-495b-a99b-4a85e8c96144/properties/cGFzc3dvcmQ]
It then goes to await this.idmService.SetUserPropertyAsync(subject, type, value) and to
SetUserProperty(metadata.UserMetadata.UpdateProperties, user, type, value) in IdentityManager.AspNetIdentity.AspNetIdentityManagerService and eventually to
public virtual IdentityManagerResult SetPassword(TUser user, string password)
{
var token = this.userManager.GeneratePasswordResetToken(user.Id);
var result = this.userManager.ResetPassword(user.Id, token, password);
if (!result.Succeeded)
{
return new IdentityManagerResult(result.Errors.First());
}
return IdentityManagerResult.Success;
}However, this.userManager.ResetPassword(user.Id, token, password) will be executed on a different thread, so when public Task SetPasswordHashAsync(TUser user, string passwordHash) in UserStore is called, it'll have another version of user object. Thus when execution successfully returns to SetUserPropertyAsync in IdentityManager.AspNetIdentity.AspNetIdentityManagerService and code about to execute var result = await userManager.UpdateAsync(user); we have original version of user object with old value for PasswordHash property. Thus we endup overwriting PasswordHash again to original value. Password change doesn't work.
Since execution of this.userManager.ResetPassword(user.Id, token, password) is controlled by Microsoft's code how is this problem solved? Am I the only one facing this problem? I'm using MySQL store.