What is the best way to add a password reminder email?

[tcobbfis]

Currently, I have a custom module to handle some security changes I needed to make to password management.

1. Prevent the use of previous 10 passwords
2. Set an expire date for the passwords
3. Send an email before the password expires

For #1 I'm using a salted hash with OrchardCore.Entities.Properities on the user object. Would that be the best way to do it?

For #3 Should that be a background task? How would I trigger it from code? Or should I be a workflow? (same question).

A general point in the right direction.

[Piedone]

For #1 I'm using a salted hash with OrchardCore.Entities.Properities on the user object. Would that be the best way to do it?

Sounds good to me.

For #3 Should that be a background task? How would I trigger it from code? Or should I be a workflow? (same question).

Yes, a background task is appropriate. That's something that OC triggers, you just have to implement it (see here for a documented example).

Workflows are inherently more restricted than some custom code since Workflows is a kind of visual programming tool that provides a simplified way of extending the behavior of OC. My recommendation generally is that if you're a developer, unless Workflows contains the exact functionality you need and/or you need your logic to be highly configurable by admin users, write custom code.

That being said, password expiration is now viewed as something that reduces rather than increases security.

[tcobbfis]

Thanks. Security governance makes those calls here.