MembershipUser class CreateUser password paramter

Question

I'm using the ASP.NET Configuration for my users and their roles. I'm also using the MembershipUser class with its function CreateUser. I have it working, but was curious about something.

When I add a new user and pass this function its password parameter (which in this case is coming from a textbox on the page). It seems like it only finds and accepts that textbox value when it is 6 chars or more. For example, if I type in ab123 it'll say object not set to instance of an object. However if I do abc123 it works fine. Where is that being told to do that. I didn't know if this was something I could change or where it might be doing that.

Thanks.

Answer 1

this is being defined in the web.config

<membership>
            <providers>
                <clear/>
                <add name="AspNetSqlMembershipProvider"
                                 type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" 
                                 connectionStringName="ASPNetMembership"
                                 enablePasswordRetrieval="false" 
                                 enablePasswordReset="true" 
                                 requiresQuestionAndAnswer="false" 
                                 requiresUniqueEmail="false" 
                                 passwordFormat="Hashed" 
                                 maxInvalidPasswordAttempts="5" 
                                 minRequiredPasswordLength="6"   
                                 minRequiredNonalphanumericCharacters="0"           
                                 passwordAttemptWindow="10" 
                                 passwordStrengthRegularExpression="" 
                                 applicationName="/"/>
            </providers>
        </membership>

Answer 2

In web.config, under membership/providers, the <add ...> element for your membership provider can have, among other things, minRequiredPasswordLength="some number".

There's also a default provider in machine.config, apparently (according to MSDN: see http://msdn.microsoft.com/en-us/library/1b9hw62f.aspx , second code snippet from the bottom), So if you don't see an <add> line, you may be using the default one, which has a minimum length of 7. In order to change that one, you'd either have to copy that machine.config line into your web.config, change the name, and edit the param that way....or change the default for the whole server and watch it possibly break on upgrades.