Add new security features to the Login System

[angelogl]

Hello everyone. I hope you have a wonderful day. I would like to know if any of you have improved the Login by adding the following improvements:

• Change password when you first log in.

• Reset password.

I would really appreciate your comments or ideas about it.

Best regards.

[LSNicholls]

Isn't reset password on the login page already? Choose "Forgot my password" link and you go there, right?

To implement "change password at first login", here is how I would do it:

1. add a flag field indicating "password has been reset" to the user table.
2. write a new UserPasswordValidator whose ValidateExistingUser method returned a new PasswordValidationResult enum value (such as PasswordValidationResult.NeedsPasswordResset) in the case where the flag has not been set so far for this user. Register this new implementation in Startup.cs instead of the default one.
3. when this enum value is returned, AccountPage.cs should redirect to ~/Account/ChangePassword page.
4. change AccountPasswordActionsPage.cs to set the flag
5. possibly change the UserSaveHandler.cs to unset the flag on admin password change, or maybe just expose the flag so that the admin can require the password resetting on next login if they have to change it. Depends on whether you always want this to happen, or want it to be under admin's control to decide whether they need to reset again.