Configuring Password Requirements in ASP.net Core 3 Identity Doesn't Work

Question

I've created a fresh .net Core 3.1 solution with ASP.net Identity.

The Register page requires a minimum of 6 characters.

I want to configure these requirements thus

// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
    services.Configure<IdentityOptions>(options =>
    {
        options.Password.RequiredLength = 1;
        options.Password.RequireUppercase = true;
        options.Password.RequireLowercase = true;
        options.Password.RequireDigit = false;
        options.Password.RequireNonAlphanumeric = false;
        options.Password.RequiredUniqueChars = 5;
    });

    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(
            Configuration.GetConnectionString("DefaultConnection")));

    services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
        .AddEntityFrameworkStores<ApplicationDbContext>();


    services.AddControllersWithViews();

    services.AddRazorPages();
}

I've added the password options at the top there, but they are being ignored. 6 to 100 characters are still required to be entered when registering.

I've found many articles, eg:

Saying this should work. There isn't even an error so not sure how to problem solve this.

How can I get this working? Thanks.

Answer 1

Hi @niico this identity password option will work when you submit the form and and Createasync function will return false. and it will jump to the

foreach (var error in result.Errors)
                {
                    ModelState.AddModelError(string.Empty, error.Description);
                }

and bind the validation message and return to the page and will show in the top.

Thanks

Answer 2

A simple thing that you can double-check, is if you are indeed passing the password when creating the user. If you do not pass the password, Identity doesn't run any of its password validation rules, but still creates the user without errors.

 result = await _userManager.CreateAsync(user, Input.Password);