asp.net – 根据角色为某些用户提供更强的密码

第二区(区)受到限制.用户必须申请访问权限.如果用户获得访问权限,则会获得某个角色.因此,每个控制器方法都会根据该角色对用户进行自动调整.

我希望这些用户必须在下次登录时将密码更改为强密码,然后才能进一步访问受限制的内容.

例：

User A applies for access.
Access is granted. The password policy for
that user is changed as long as it has access. They MUST
change their password on the next logon,and they cannot change back
to a weaker password as long as they have that role.

有没有安全的方法来使用ASP.NET实现这一点？

更新

我实际上使用过Chris提出的解决方案并且它可以工作,但是为了处理密码本身的验证,我实际上也从Micah提出的解决方案中获得了一些灵感.然而,事实证明,重写MembershipProvider.OnValidatingPassword确实意味着还必须实现10个抽象方法,我真的不需要解决这个问题.

我眼中的一个更好的解决方案是挂在Membership.ValidatingPassword EVENT上.我这是客栈App_Start,然后我在事件处理程序中实现我自己的密码验证,这解决了我的问题.

只是为了与你分享解决方案,我在这里提出它,与克里斯解决方案一起解决了我的问题,希望对其他人也是如此：

void App_Start()
    {
        //To do custom validation on certain passwords set new event handler
        Membership.ValidatingPassword += Membership_ValidatingPassword;
    }

private void Membership_ValidatingPassword(object sender,ValidatePasswordEventArgs e)
    {
        //If the user is a new user,we let registration happen without strong password
        if (e.IsNewUser) return;


        MembershipUser membershipUser = Membership.GetUser(e.UserName);
        Guid userId = Guid.Parse(membershipUser.ProviderUserKey.ToString());

        //First check if the pwd is strong enough to be flagged,if so we flag it
        //using regex to validate the password (20 char,2 uppercase so on)
        if (MyValidationClass.IsStrongPassword(e.Password,20,2,4,1))
        {
            //if the user does not already have a flag we set one
            MyValidationClass.SetStrongPasswordFlag(userId);
        }
        else
        {
            //If the user needs strong pwd,we cancel the operation and throw exception
            if (MyValidationClass.NeedsStrongPassword(e.UserName))
            {
                e.FailureInformation =
                    new MembershipPasswordException("Password does not satisfy reqirements!");
                e.Cancel = true;
            }
            else
            {
                MyValidationClass.RemoveStrongPasswordFlag(userId);
            }
        }
    }