1

I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server and MembershipReboot).

A substantial number of existing users have non-unique or null email addresses. These will all be seeded from the existing app to MembershipReboot's database.

The forgotten password process (using a username field to generate and send an OTP via SMS) is being replaced with MembershipReboot's forgotten credential process using email addresses to generate a URL for users to reset their password.

For those users with a shared email address should I include a separate step to capture the username after capturing the users email address to generate a URL for the correct user? Or is there a reasonable alternative that doesn't require any proactive user change?

Improve this question
2
  • What, you can't keep it using the SMS option? A lot of people are starting to appreciate out-of-band options. Note that using the SMS option is really the only way to safely authenticate users in the shared-email case: send password reset, ask for username/mobile, send SMS code. Anything else is vulnerable to brute force or (worse) trivial guesses. How do you know the emails are "shared", and not that someone has multiple accounts?
    – Clockwork-Muse
    May 26, 2014 at 10:35
  • @Clockwork-Muse MembershipReboot uses email addresses as a standard way to reset security information. It's a great authentication solution and I don't want to customise the code too much. Shared emails I can tell from the (relatively clean) CRM data. The problem I want to solve here is figuring out the best pattern to identify which account to reset for the user, or the best way to manage an exception like this (which won't apply to new users who are forced to have unique emails).
    – mirfaan
    May 26, 2014 at 12:59

1 Answer 1

Reset to default
1

For shared email addresses, I would generate a reset link only after the user has entered a valid username and email. The reset procedure would also require a new, unique email address that must be separately verified.

Presumably the users that share an email address already have some level of trust between them. If not then you would need to find an alternate piece of information that identifies each user.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.