Troubleshooting: Unsecured Passwords Format Detected Warning in the Application Event Log

Version Affected: All
 
 

Overview

The Identity Provider (IdP) and its realms continue to function normally, but the Windows Application event log contains a warning similar to the following:

Log Name:      Application
Source:        ASP.NET 4.0.30319.0
Event ID:      1310
Task Category: Web Event
Level:         Warning
Computer:      idp.secureauth.com
Description:
Event message: A configuration error has occurred.
Application information:
    Application Virtual Path: /SecureAuth10
    Application Path: D:\SecureAuth\SecureAuth10\
Exception information:
    Exception type: ConfigurationErrorsException
    Exception message: Unsecured Passwords Format Detected. The Membership Provider that contains the
    unsecure passwords format is: SqlMembershipProvider. The obsoleted password format is: clear.

The example above is for the SqlMembershipProvider, but the same message can also be reported for the ODBCMembershipProvider.

Cause

.NET has detected that the listed membership provider is configured to store passwords as plain text. The IdP ships with some undefined or unused membership providers set to the default password format of clear (plain text).

Resolution:

If the data source the warning refers to is undefined or unused, the warning is safe to ignore -- it refers only to the default configuration and does not pose a security risk.

If the data source is actually configured and in use, review it: Microsoft recommends using hashed as the password format instead of clear. See MembershipProvider.PasswordFormat for more information.

To eliminate the warning by switching the unused provider to hashed format:

1. Back up the realm's web.config, then decrypt it.
2. Open the web.config in a text editor and search for passwordFormat="clear" -- this is usually found in both the ODBC and SQL membership provider sections.
3. If the realm doesn't use that datastore type, change it to passwordFormat="hashed".
4. Save the web.config.
5. By default, IIS auto-generates a new encryption key every time the worker process starts, which never evaluates to the same hash twice. To set a static key instead, go to the realm in the Admin Console, open the Post Authentication tab, and under Machine Key, click Generate New Keys.
6. Save the realm and test.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.