{"record":{"id":"61b4d42d1578350b","repo":"TechnitiumSoftware/DnsServer","slug":"cannot-change-username-when-using-old-password-has","errorCode":null,"errorMessage":"Cannot change username when using old password hash scheme. Change password once and try again.","messagePattern":"Cannot change username when using old password hash scheme\\. Change password once and try again\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/User.cs","lineNumber":223,"sourceCode":"                    continue;\n\n                if (throwException)\n                    throw new ArgumentException(\"Username can contain only alpha numeric, '@', '-', '_', or '.' characters.\", nameof(Username));\n\n                return false;\n            }\n\n            return true;\n        }\n\n        #endregion\n\n        #region internal\n\n        internal void SetUsername(string username)\n        {\n            if (_passwordHashType == UserPasswordHashType.OldScheme)\n                throw new InvalidOperationException(\"Cannot change username when using old password hash scheme. Change password once and try again.\");\n\n            IsUsernameValid(username, true);\n\n            _username = username.ToLowerInvariant();\n        }\n\n        internal void RenameGroup(string oldName)\n        {\n            if (_memberOfGroups.TryRemove(oldName.ToLowerInvariant(), out Group renamedGroup))\n                _memberOfGroups.TryAdd(renamedGroup.Name.ToLowerInvariant(), renamedGroup);\n        }\n\n        #endregion\n\n        #region public\n\n        public string GetPasswordHashFor(string password)\n        {","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/User.cs#L205-L241","documentation":"Thrown by User.SetUsername when the user's password is still stored using the legacy UserPasswordHashType.OldScheme. It is an InvalidOperationException because renaming is permitted in principle, but blocked while the account is on the old hash scheme — the username change must happen after a password reset upgrades the hash. This prevents corrupting legacy auth state.","triggerScenarios":"Calling user.SetUsername(newName) on a user whose _passwordHashType == OldScheme, i.e. an account that has not logged in / changed password since the hash scheme was upgraded.","commonSituations":"Renaming a long-standing user who never reset their password after a server upgrade that introduced the new hash scheme; a bulk-rename operation that does not skip legacy-hash users; importing users with their old hashes intact.","solutions":["Have the user change their password once (this migrates the hash off OldScheme), then retry the rename.","As administrator, force a password reset for the user to upgrade the hash, then rename.","Skip legacy-hash users in bulk rename and process them after they reset their password."],"exampleFix":"// before\nuser.SetUsername(newUsername);\n\n// after\nif (user.PasswordHashType == UserPasswordHashType.OldScheme)\n    return Error(\"Change password once before renaming the user.\");\nuser.SetUsername(newUsername);","handlingStrategy":"validation","validationCode":"if (user.PasswordHashType == UserPasswordHashType.OldScheme)\n    return Error(\"Change the user's password once to migrate off the old hash scheme, then rename.\");\nuser.SetUsername(newUsername);","typeGuard":null,"tryCatchPattern":"try { user.SetUsername(newUsername); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"old password hash\"))\n{ /* instruct password reset, then retry rename */ }","preventionTips":["Force a password reset for legacy-hash users before renaming.","Skip OldScheme users in bulk rename and process them post-reset.","After upgrades, prompt all users to reset their password once to migrate the hash scheme."],"tags":["auth","user-management","password-hash","migration"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}