c# - ASP.NET Membership change password not working -

i have code changing user's password when click password reset button (with code log elmah can try figure out going wrong).

this in asp.net mvc 2, using standard aspnet membership provider, simple view this:

new password:     ______ confirm password: ______ [reset] [cancel] 

the route view /account/reset/guid, guid user's id in aspnet membership database.

the key portion of code calls user.changepassword(). can see logs message when successful. problem users, success message logged, can not log in new password. other users logs success message , can log in.

if (user.changepassword(pwd, confirmpassword)) {     errorsignal.fromcurrentcontext().raise(         new exception("resetpassword - changed successfully!"));     return json(new {          msg = "you have reset password successfully." },          jsonrequestbehavior.allowget);  } 

the full code listing is:

[httppost] public jsonresult resetpassword(string id, string newpassword, string confirmpassword) {     errorsignal.fromcurrentcontext().raise(new exception("resetpassword started " + id));      viewdata["passwordlength"] = membership.minrequiredpasswordlength;      if (string.isnullorwhitespace(newpassword))     {         errorsignal.fromcurrentcontext().raise(             new exception("resetpassword - new password blank."));         modelstate.addmodelerror("_form", "please enter new password.");         return json(new { errors = modelstate.errors() }, jsonrequestbehavior.allowget);     }      if (newpassword.length < membership.minrequiredpasswordlength)     {         errorsignal.fromcurrentcontext().raise(             new exception("resetpassword - new password less minimum length."));         modelstate.addmodelerror("_form",              string.format("the password must @ least {0} characters long.",              membership.minrequiredpasswordlength));         return json(new { errors = modelstate.errors() }, jsonrequestbehavior.allowget);     }      if (string.isnullorwhitespace(confirmpassword))     {         errorsignal.fromcurrentcontext().raise(             new exception("resetpassword - confirm password blank."));         modelstate.addmodelerror("_form",              "please enter same new password in confirm password textbox.");         return json(new { errors = modelstate.errors() }, jsonrequestbehavior.allowget);     }      if (confirmpassword.length < membership.minrequiredpasswordlength)     {         errorsignal.fromcurrentcontext().raise(             new exception("resetpassword - confirm password less minimum length."));         modelstate.addmodelerror("_form",              string.format("the password must @ least {0} characters long.",              membership.minrequiredpasswordlength));         return json(new { errors = modelstate.errors() }, jsonrequestbehavior.allowget);     }      if (confirmpassword != newpassword)     {         errorsignal.fromcurrentcontext().raise(             new exception("resetpassword - new password did not match confirm password."));         modelstate.addmodelerror("_form", "please enter same password again.");         return json(new { errors = modelstate.errors() }, jsonrequestbehavior.allowget);     }      bool ismatch = validationhelper.isguid(id);     if (string.isnullorwhitespace(id) || !ismatch)     {         errorsignal.fromcurrentcontext().raise(             new exception("resetpassword - id not guid."));         modelstate.addmodelerror("_form", "an invalid id value passed in through url");     }     else     {         //id exists , kosher, see if user approved         //get id sent in querystring         guid userid = new guid(id);          try         {             //get information user             membershipuser user = membership.getuser(userid);             if (user == null)             {                 //could not find user                 errorsignal.fromcurrentcontext().raise(                     new exception("resetpassword - not find user id " + id));                 modelstate.addmodelerror("_form",                      "the user account can not found in system.");             }             else             {                 errorsignal.fromcurrentcontext().raise(                     new exception("resetpassword - user " + user.username));                 string pwd = user.resetpassword();                  if (user.changepassword(pwd, confirmpassword))                 {                     errorsignal.fromcurrentcontext().raise(                         new exception("resetpassword - changed successfully!"));                     return json(new {                          msg = "you have reset password successfully." },                          jsonrequestbehavior.allowget);                 }                 errorsignal.fromcurrentcontext().raise(                     new exception("resetpassword                      - failed change password, unknown reason"));             }         }         catch (exception ex)         {             errorsignal.fromcurrentcontext().raise(                 new exception("resetpassword: " + ex));             return json(new { error = ex.message + " -> "                  + ex.innerexception.message }, jsonrequestbehavior.allowget);         }     }      return json(new { errors = modelstate.errors() }, jsonrequestbehavior.allowget); } 

edit: adding bounty try solved. 1 of annoying problems on issue list, , have no idea how proceed.

if user needs reset password, there chance account has been locked out many invalid attempts. if case, password being reset successfully, user cannot log in until lockout condition cleared.

try checking membershipuser.islockedout:

users commonly locked out , cannot validated validateuser method when maxinvalidpasswordattempts reached within passwordattemptwindow.

to set property false , let user try log in again, can use unlockuser method.

edit

did check isapproved? authentication fail false user.

also, assuming default membership provider, mean sqlmembershipprovider, can run following query against database , make sure looks correct?

select isapproved, islockedout, failedpasswordattemptcount aspnet_membership applicationid = @yourapplicationid , userid = @userid 

try executing query before attempting sign in verify isapproved , islockedout ok. note value failedpasswordattemptcount.

try signing in, , run query again. if signin fails, has value failedpasswordattemptcount been incremented?

you @ passwordformat in aspnet_membership table , make sure correct value depending on format using (0 clear, 1 hashed, , 2 encrypted).