User change own password

[ghost]

Hi Thomas,

I have a concern regarding how a user can change his own password.
From my understanding, the APIs are more or less designed for an user admin. While this is fine probably for most use cases, an user might want to change his own password since he does not want the admin to know his password. At the moment, it seems to me that it is not possible for a non-admin role, or did I miss something?

Best regards,

Xiaoyang

[browrp]

@x19chen OpenIddict uses ASP.Net Core Identity for user management. You wouldn't necessarily use OpenIddict-ui to allow a user to change their own password; openiddict-ui is for an admin role not a user role.

You can most likely use some of the existing ASP.Net Core Identity functionality to do this. You would just need to write an api endpoint that allows a user to change their password similar to how the existing ASP.Net Core Identity functionality does it.

If you've generated all the Identity code for your project you should have a ChangePassword page somewhere in your solution. For example there is a Change Password page which is most likely located under Areas/Identity/Pages/Account/Manage/ChangePassword. You can see how this is done via the existing ASP.Net Core web application using the following code:

    public async Task<IActionResult> OnPostAsync()
    {
        if (!ModelState.IsValid)
        {
            return Page();
        }

        var user = await _userManager.GetUserAsync(User);
        if (user == null)
        {
            return NotFound($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
        }

        var changePasswordResult = await _userManager.ChangePasswordAsync(user, Input.OldPassword, Input.NewPassword);
        if (!changePasswordResult.Succeeded)
        {
            foreach (var error in changePasswordResult.Errors)
            {
                ModelState.AddModelError(string.Empty, error.Description);
            }
            return Page();
        }

        await _signInManager.RefreshSignInAsync(user);
        _logger.LogInformation("User changed their password successfully.");
        StatusMessage = "Your password has been changed.";

        return RedirectToPage();
    }
}

All you will need to do is create an api endpoint that requires authentication and allows the authenticated user to pass in the data to change their password.

Let me know if this helps.

-Robert

[thomasduft]

@browrp Thanks for answering the question of @x19chen. I couldn't have done it better 👍.

@x19chen For some inspiration you could have a look here or as @browrp mentioned have a look at ASP.NET Core Identity samples.

Have a nice weekend both.

Thomas

[ghost]

@browrp @thomasduft
Thanks for your answer, that was indeed helpful.
It actually confirms my suspicion that I have to create another API for that and the example is clear.

Enjoy your weekend.

Xiaoyang