Password and User table issues

[Brewhaus]

We have suddenly run into a problem with people logging in. Even when we confirm that the password is correct, the system is not letting select customers (I do not know how many) log in. And, after the select number of attempts, it locks those same customers for considerably more than 10 minutes (one is going on a day now).

Of the three accounts that we tried, we had the following issues:

Account 1- locked, despite confirming that the password is correct. This customer is still locked out a day later.

Account 2- Could not log in or reset password (kept receiving a notice that the old password was incorrect). Account got locked for too many attempts, but an hour later it allows us in.

Account 3- no issues at all

There does not seem to be any rhyme or reason, so if anyone has any ideas please let me know.

The other question is that we found, when opening the Users table to see about the password problems, that there are several times as many entries as there are registered customers (I gave up running down the list when we hit around 30 times as many entries as registered users). They have a username such as 83ec30ac-15f3-4a9b-a082-4c0c6517a2ac, and are listed as 'anonymous'. Does the keep a user listing for every person that visits the site? If so, will this not, in time, slow the system down?

[jmestep]

You can change the setting in the store for the days to save anonymous users. Configure-->Store

[Brewhaus]

Thanks, Judy. That part is fixed.

I did more digging and found that we had three accounts entirely locked out. Two of the lockouts go back to October, and the accounts could still not be accessed. I managed to free them up by changing the lockout time to zero, changing the customer's password to something that we knew, and then logging in as the customer from the front end. I could not find any other way around this.

This leaves me with two questions:

1) What would cause an account to be permanently locked out?
2) How can we correct this issue? Obviously this will result in lost customers (if they cannot access their account).

[jmestep]

I'm not sure, but I know we have had admin locks in the past and have had to go to the database to unlock users. Maybe mazhar could come up with a snippet to run to unlock all users if hacking isn't as much of a problem as lost customers.

[Brewhaus]

Did you find an easier way to unlock the accounts? My method was a bit harsh, but it was the only way I could find that worked, as I could not simply change the lock value from 1 to 0.

[jmestep]

No, I never found an easier way. I don't have contact with customers, so I don't know if it happens to them. I've just locked myself out with so many passwords to remember.

[mazhar]

Code: Select all

UserCollection users = UserDataSource.LoadForStore();
        foreach (User user in users)
        {
            if (user.IsLockedOut)
            {
                user.IsLockedOut = false;
                user.Save();
            }
        }

You can use the above code to unlock all the locked users.

[Brewhaus]

Where would we place this code?

Also, do you know why the system may permanently lock an account / not release an account from being locked after 10 minutes?

[mazhar]

Here is the updated page. You need to replace the Admin/People/Users/Default.aspx with this one.
Don't forget to backup your existing page files.

[Brewhaus]

I notice that the Users menu in 7.0.2 has several more features, so we do not want to over-write it with the old 7.0 files. Is it possible to get an updated version of the Users files with the unlock code to be used with 7.0.2?

[mazhar]

Updated page for 7.0.2 version