Password changing feature work as expected but various error message are blinking infinitly - Looping suspected

[CrazyVolnay]

PassCore Server

• OS: [Windows]

• Provider: [Active Directory]

• Settings file (without sensitive information):
  {
  "Logging": {
  "IncludeScopes": false,
  "LogLevel": {
  "Default": "Debug",
  "System": "Information",
  "Microsoft": "Information"
  }
  },
  "WebSettings": {
  "EnableHttpsRedirect": false
  },
  "AppSettings": {
  // The following options for AD Provider (remove if you don't use this Provider)
  "UseAutomaticContext": true, // Set true to allow PassCore to reset password using the same credentials, or false if you will fill the credentials below
  "RestrictedADGroups": [
  "Administrators",
  "Domain Admins",
  "Enterprise Admins"
  ], // Set the AD groups to restrict the use of PassCore
  "AllowedADGroups": ["Domain Users"], // Set the AD Groups to allow PassCore, if the array is empty all the groups no-restricted above are allowed
  "IdTypeForUser": "UPN", // Possible values are "DN", "GUID", "Name", "SAM", "SID" and "UPN" (Default UPN)
  "UpdateLastPassword": true, // Set true to allow PassCore to update the last password timestamp
  // General options (valid for both providers)
  "LdapHostnames": [ "ad01.domain.local", "ad02.domain.local" ], // Set your hostname(s)
  "LdapPort": 389, // Default for AD is 389, for LDAPS 636
  "LdapUsername": "", // Set the username or distinguish name (DN) to bind the LDAP server
  "LdapPassword": "", // Set the password for the username
  "DefaultDomain": "" // Set your default AD domain here, or non "@" logins will not work! Use empty value to allow user to set the domain. This option is ONLY available with UPN.
  },
  "ClientSettings": {
  "ValidationRegex": {
  "EmailRegex": "^[a-zA-Z0-9.!#$%&’+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)$",
  "UsernameRegex": "^[a-zA-Z0-9._-]{3,20}$"
  },
  "UsePasswordGeneration": false, //Set true to let PassCore create a new password for the current account. If true the user can not customize its new password.
  "MinimumDistance": 0, //The minimum distance beetween the old and the new password, this is used to enforce the edit distance using the levenshtein distance algorithm.
  "PasswordEntropy": 16, // the number of bytes of entropy to use for generated passwords
  "ShowPasswordMeter": true,
  "MinimumScore": 0, //The minimum acceptable score that the user's new password needs to get at being evaluated by ZXCVBN to be established as the new password.
  "Recaptcha": {
  "SiteKey": "", // ReCAPTCHA public key: replace this! or leave empty if you don't need ReCAPTCHA
  "PrivateKey": "", // ReCAPTCHA private key: replace this! or leave empty if you don't need ReCAPTCHA
  "LanguageCode": "en"
  },
  "UseEmail": "true",
  "ApplicationTitle": "Change Account Password | Self-Service Account Management Tools",
  "ChangePasswordTitle": "Change Account Password",
  "ChangePasswordForm": {
  "HelpText": "If you are having trouble with this tool, please contact IT Support",
  "UsernameLabel": "Username",
  "UsernameHelpblock": "Your organization's email address",
  "UsernameDefaultDomainHelperBlock": "Your organization's username",
  "CurrentPasswordLabel": "Current Password",
  "CurrentPasswordHelpblock": "Enter your current password",
  "NewPasswordLabel": "New Password",
  "NewPasswordHelpblock": "Enter a strong password. You can use this tool to help you create one; use the XKCD (random sep, pad digit), or NTLM, options.",
  "NewPasswordVerifyLabel": "Re-enter New Password",
  "NewPasswordVerifyHelpblock": "Enter your new password again",
  "ChangePasswordButtonLabel": "Change Password"
  },
  "ErrorsPasswordForm": {
  "FieldRequired": "This field is required",
  "UsernamePattern": "Please enter a valid username",
  "UsernameEmailPattern": "Please enter a valid email address",
  "PasswordMatch": "Passwords do not match"
  },
  "Alerts": {
  "SuccessAlertTitle": "You have changed your password successfully.",
  "SuccessAlertBody": "Please note it may take a few hours for your new password to reach all domain controllers.",
  "ErrorPasswordChangeNotAllowed": "You are not allowed to change your password. Please contact your system administrator.",
  "ErrorInvalidCredentials": "You need to provide the correct current password.",
  "ErrorInvalidDomain": "You have supplied an invalid domain to logon to.",
  "ErrorInvalidUser": "We could not find your user account.",
  "ErrorCaptcha": "Could not verify you are not a robot.",
  "ErrorFieldRequired": "Fulfill all the fields.",
  "ErrorFieldMismatch": "The passwords do not match.",
  "ErrorComplexPassword": "Failed due to password complex policies: New password length is shorter than AD minimum password length",
  "ErrorConnectionLdap": "Unhandled error connecting to the LDAP server.",
  "ErrorScorePassword": "The password you are trying to set is not secure enough.",
  "ErrorDistancePassword": "The password you are trying to set is not diferent enough of your last password.",
  "ErrorPwnedPassword": "The password you are trying to use is publicly known and can be used in dictionary attacks."
  }
  }
  }

• Log file (without sensitive information):
  stdout_20200914153137_5604.log

Describe the bug
A clear and concise description of what the bug is.
The reset password function works well, but after clicking on 'change password' button, the information message expected 'Password successfully changed, operation may take few minutes to replicate ...' appears but random error messages are blinking on the right bottom like 'complexity no met' or 'incorrect password'. It seems the action to change password is looping in background

Note: If you want to report an issue of passcorepro, please use the proper bug report form at https://store.unosquare.com/passcorepro

To Reproduce
Steps to reproduce the behavior:
Fill Username, Old Password NewPassword and NewPasswordConfirmation fields, then click on Change Password Box

Expected behavior
A clear and concise description of what you expected to happen.
The password should be changed without blinking error messages

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [Windows Server 2016 or Windows 10]
• Browser [Chrome 85.0.4183.102 | Firefox 80.0.1]

Additional context
Add any other context about the problem here.
Web Server is dedicated for that application, runnning Windows Server 2016 Datacenter and IIS. .NET Core 3.1 and PassCore 2.4.2 are installed

[CrazyVolnay]

On Chrome debug console, you can see the looping behavior :

[geoperez]

Probably you are mounting the wrong folder. What folder do you have in IIS?

[CrazyVolnay]

The folder is c:\PassCore424 which is the same configured in advanced binding settings in IIS.
I've tried to rename the folder (c:\PassCore424 to c:\passcore) and remapped the path in IIS (believing there was static bindings in the code ...) but the same behavior happens.

[thedragonkeeper]

can confirm this bug, have seen it appear when using chrome browser

[itijoux]

same thing for me too , password changed successfully , but error message are displaying rapidly ( looping)

[jjblack]

I believe I am getting this too on the following systems:

Passcore 4.2.4
Ubuntu 18.04.5
Nginx 1.14

Client:
Ubuntu 18.04.5
Chrome: 84.0.4147.105

Passcore successfully resets the password. However after doing so it hits these HTTP 400 errors and then reloads the request along with the password reset details. Each attempt (more than 10) successfully hits our Domain Controllers. But since it already reset the password, the controllers return an "Invalid Credentials" error which Passcore detects and shows on the page. Additionally what is making PassCore unusable is that the 10+ subsequent requests with a bad password is triggering the account locking.

You can reset your password, but your account is now locked.

I am also seeing the HTTP 400 errors and the request reloads when the current password is initially incorrect. And again so many requests triggers the account locking.

Here is what the Chrome console looks like after resetting the password.

And the full stack here:
passcore-dev-.com-1603825588512.log

And the snippet of the journal from the passcore daemon right after reseting the password is
here.

Let me know what other logs would help debug this issue

[postheimer]

same problem ... i have many 400 bad request

and user locking , i have passcorepro too and no problem with the pro version

[insignia96]

I am also seeing this behavior, although I am using Firefox. The first password change call succeeds but some errors are still shown because it looks like the request is sent many times, even though it succeeded the first time. Because the password is already changed, the subsequent requests cause the "You need to provide the correct current password." error to show at the same time as the success dialog.

From the first 400 error after the 200 OK response:

Most of the other 400 errors are error code 4

[jjblack]

I am not seeing this issue with version 4.2.3. I will just install and use that version until this is fixed.

For anyone else reverting, I had to update nodejs and npm using these steps and then npm update before running dotnet publish...

I can also confirm that this version is functioning as expected on Ubuntu 20.04

[geoperez]

Try the new version, some users already report the issue was fixed.

[jjblack]

I'm still seeing 4.2.4 as the latest version released. Additionally, the docker container is even worse for me. Where my build from the tar.gz would only loop 10-15 times. The docker container build would get into a infinite loop and I would eventually have to pull the plug on it

[baconsmokeco]

This is still an issue with 4.2.4
Host OS: Server 2012R2

Error message has a spastic blinking. Very noticeable issue.

[master-qwerty]

I am not seeing this issue with version 4.2.3. I will just install and use that version until this is fixed.

For anyone else reverting, I had to update nodejs and npm using these steps and then npm update before running dotnet publish...

I can also confirm that this version is functioning as expected on Ubuntu 20.04

I can confirm that, used 4.2.3 and just copied appsettings.json, previously used in 4.2.4.
Password is changed but no more popup errors and the account is not locked out.

Also working with .NET Core 5.0.1 Windows Server Hosting bundle. after applying fix in #615

Tested in lab on: Windows Server 2019 and IIS.

[valonime]

Unfortunately still having this issue. Is there already a fix in the process?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.