Unable to change installation administrator's password

[nackler]

Which Umbraco version are you using? (Please write the exact version, example: 10.1.0)

14.1.1

Bug summary

Unable to change the umbraco administrator password. This is the main admin username/password that is configured during an initial install.

Specifics

Logged in to the backoffice as the original administrator.

Tried to change my own password by clicking my user-icon in the top right corner and choosing 'Change Password'. I was prompted for my old and new passwords. After submitting the form the dialog disappears with no confirmation that the password was changed. Nothing in the logs, no browser console error.

When I log out, then try to log in again using the new password it is evident that the new password was not saved.

I also tried changing my own password by going in to the 'Users' section of the backoffice, clicking my name to drill into my user details, then choosing 'change password' from that screen. When doing it this way, even though I enter my old password in the field provided, I get a visible error in the bottom right hand corner and in the javascript console

{
"type": "Error",
"title": "Old password required",
"status": 400,
"detail": "The old password is required to change your own password.",
"operationStatus": "SelfOldPasswordRequired"
}

If I log in as a different user in the administrators group, the original 'admin user' doesn't show up in the list of editable users so I cannot try changing its password

Steps to reproduce

Log in to the backoffice as the original installation admin user
Attempt to change your own password by choosing 'Change Password' from your profile dropdown in the top right corner.
Enter the old and new passwords, submit the form.
Log out.
Log in using the new password.

Expected result / actual result

Expected to be able to login using the new password.
Instead, the old password was the only password that worked.

[github-actions]

Hi there @nackler!

Firstly, a big thank you for raising this issue. Every piece of feedback we receive helps us to make Umbraco better.

We really appreciate your patience while we wait for our team to have a look at this but we wanted to let you know that we see this and share with you the plan for what comes next.

• We'll assess whether this issue relates to something that has already been fixed in a later version of the release that it has been raised for.
• If it's a bug, is it related to a release that we are actively supporting or is it related to a release that's in the end-of-life or security-only phase?
• We'll replicate the issue to ensure that the problem is as described.
• We'll decide whether the behavior is an issue or if the behavior is intended.

We wish we could work with everyone directly and assess your issue immediately but we're in the fortunate position of having lots of contributions to work with and only a few humans who are able to do it. We are making progress though and in the meantime, we will keep you in the loop and let you know when we have any questions.

Thanks, from your friendly Umbraco GitHub bot 🤖 🙂

[nackler]

I have seen docs

https://docs.umbraco.com/umbraco-cms/reference/security/reset-admin-password

suggesting that to change this original admin password the trick is to change the configured connection string in appsettings to an empty string (""). When I do this my site does not run but I get an error in my logs. Perhaps some piece of middleware is getting in the way before that workflow can kick in. If that is the case is there something I can do in appsettings to prevent this? I don't want to have to deploy a temporary version of the application with a simplified Program.cs to production.

"The factory has not been configured with a proper connection string."

{"@t":"2024-08-21T18:27:42.0270162Z","@mt":"An unhandled exception has occurred while executing the request.","@l":"Error","@x":"System.InvalidOperationException: The factory has not been configured with a proper connection string.
   at Umbraco.Cms.Infrastructure.Persistence.UmbracoDatabaseFactory.Initialize()   at System.Threading.LazyInitializer.EnsureInitializedCore[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory)
   at Umbraco.Cms.Infrastructure.Persistence.UmbracoDatabaseFactory.EnsureInitialized()   at Umbraco.Cms.Infrastructure.Persistence.UmbracoDatabaseFactory.CreateDatabase()
   at Umbraco.Cms.Infrastructure.Scoping.Scope.get_Database()   at Umbraco.Cms.Infrastructure.Persistence.Repositories.Implement.CacheInstructionRepository.Exists(Int32 id)
   at Umbraco.Cms.Infrastructure.Services.CacheInstructionService.IsColdBootRequired(Int32 lastId)   at Umbraco.Cms.Infrastructure.Sync.SyncBootStateAccessor.InitializeColdBootState(Int32 lastId)
   at Umbraco.Cms.Infrastructure.Sync.SyncBootStateAccessor.<GetSyncBootState>b__8_0()   at System.Threading.LazyInitializer.EnsureInitializedCore[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory)
   at System.Threading.LazyInitializer.EnsureInitialized[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory)   at Umbraco.Cms.Infrastructure.Sync.SyncBootStateAccessor.GetSyncBootState()
   at Umbraco.Cms.Infrastructure.PublishedCache.PublishedSnapshotService.<EnsureCaches>b__56_0()   at System.Threading.LazyInitializer.EnsureInitializedCore[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory)
   at System.Threading.LazyInitializer.EnsureInitialized[T](T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory)
   at Umbraco.Cms.Infrastructure.PublishedCache.PublishedSnapshotService.EnsureCaches()   at Umbraco.Cms.Infrastructure.PublishedCache.PublishedSnapshotService.CreatePublishedSnapshot(String previewToken)
   at Umbraco.Cms.Web.Common.UmbracoContext.UmbracoContext.<>c__DisplayClass12_0.<.ctor>b__0()
   at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)   at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
   at System.Lazy`1.CreateValue()   at Umbraco.Cms.Web.Common.UmbracoContext.UmbracoContext.get_PublishedSnapshot()
   at Umbraco.Cms.Web.Common.UmbracoContext.UmbracoContext.get_Content()   at Umbraco.Cms.Web.Website.Routing.UmbracoRouteValueTransformer.TransformAsync(HttpContext httpContext, RouteValueDictionary values)
   at Microsoft.AspNetCore.Mvc.Routing.DynamicControllerEndpointMatcherPolicy.ApplyAsync(HttpContext httpContext, CandidateSet candidates)
   at Microsoft.AspNetCore.Routing.Matching.DfaMatcher.SelectEndpointWithPoliciesAsync(HttpContext httpContext, IEndpointSelectorPolicy[] policies, CandidateSet candidateSet)
   at Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware.<Invoke>g__AwaitMatch|10_1(EndpointRoutingMiddleware middleware, HttpContext httpContext, Task matchTask)
   at StackExchange.Profiling.MiniProfilerMiddleware.Invoke(HttpContext context) in C:\\projects\\dotnet\\src\\MiniProfiler.AspNetCore\\MiniProfilerMiddleware.cs:line 112
   at Umbraco.Cms.Web.Common.Middleware.UmbracoRequestMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
   at Umbraco.Cms.Web.Common.Middleware.UmbracoRequestMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---   at Umbraco.Cms.Web.Common.Middleware.PreviewAuthenticationMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---   at Umbraco.Cms.Web.Common.Middleware.UmbracoRequestLoggingMiddleware.InvokeAsync(HttpContext context, RequestDelegate next)
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.InterfaceMiddlewareBinder.<>c__DisplayClass2_0.<<CreateMiddleware>b__0>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl.<Invoke>g__Awaited|10_0(ExceptionHandlerMiddlewareImpl middleware, HttpContext context, Task task)","@tr":"f175bcce1d73a25f1714a7a2cd04549e","@sp":"3cdf909d19ed0aee","EventId":{"Id":1,"Name":"UnhandledException"},"SourceContext":"Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware","RequestId":"0HN621RNQKNVU:00000427","RequestPath":"/umbraco/management/api/v1/server/status","ConnectionId":"0HN621RNQKNVU","ProcessId":21680,"ProcessName":"SomeCompany.Public.Web","ThreadId":22,"ApplicationId":"d1898851af5beed01f3fcfa9e5d9bbb2a1b7f431","MachineName":"PC1124","Log4NetLevel":"ERROR"}

[nackler]

Ok, through trial and error after examining the call-stack above, I found that removing my "Umbraco/CMS/Global/ReservedPaths' setting in appsettings.json got me past the error and I was able to get to the installation page.

Perhaps:

• A note concerning temporarily commenting out 'ReservedPaths" should be added to the document at https://docs.umbraco.com/umbraco-cms/reference/security/reset-admin-password
• We should hide the 'Change Password' button in the UI for the original admin user in both places so this doesn't seem a bug but instead would have prompted me to keep searching for the docs article.

[nackler]

Just getting to the installation page has only been part of the problem. I need to use a connection string for this connection. but when I enter one I keep getting an immediate error when clicking install. I can get through the installer using 'SQL Server' as my connection type, with or without integrated security, but if I choose 'Custom' as my connection type and enter my connection string I get the following error:

Obviously there is a database name provided in that connection string. It is just a simple example. Any connection string fails with the same message.

[NguyenThuyLan]

Hi @nackler , thank you for reporting this issue. I can see there are a lot of issues in one here 😥

1. Can not change password when click "Change password" by clicking my user-icon in the top right corner
2. Got error when click change password on User section
3. Validation error "No valid database selected"

For the docs https://docs.umbraco.com/umbraco-cms/reference/security/reset-admin-password, You only need to use it when you forget the password for the super admin account specifically. So if you remember your password and want to change it, you can still use the button "Change password" (of course, we will fix it). Btw, I couldn't reproduce ""The factory has not been configured with a proper connection string." error like you got on V14.1.2

[madsrasmussen]

Fixed in: umbraco/Umbraco.CMS.Backoffice#2244