0

Is it possible to check for the current user's password in a programmatic fashion with Apex?

My current use case is that management wants the current user to authorize a certain procedure, and to authenticate that they need to provide their password.

Improve this question
2
  • Nice Q&A, but this is kind of an X-Y Problem if you don't say why you needed this. For example, if you're just trying to log in, Site.login() might be more appropriate. It should be incredibly rare to need to actually check a user's password.
    – sfdcfox ♦
    Commented Jan 10 at 20:39
  • Not in a community. Added the snippet with the use case (even though I agree its an unusual thing to ask for).
    – Renato Oliveira
    Commented Jan 10 at 20:50

1 Answer 1

Reset to default
2

It is possible to check the user's password with Apex through the UserManagement class:

Auth.VerificationResult res = UserManagement.verifyVerificationMethod(
    null,
    'the actual password',
    Auth.VerificationMethod.PASSWORD
);
System.debug(res);

The output is a Auth.VerificationResult object in which you can check the message and the success:

16:50:55:055 USER_DEBUG [6]|DEBUG|VerificationResult:[message=FailedInvalidPassword, redirect=null, success=false]

If the success attribute returns true, then the password matches.

Improve this answer
1
  • 1
    An alternative implementation to consider here is to force the user to prove their identity through high assurance session functionality and the generateVerificationUrl method.
    – Mark Pond
    Commented Jan 10 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .