title: UserManager.FindAsync returns null after password reset
body: <p>Following the official documentation (<a href="https://github.com/rustd/AspnetIdentitySample" rel="nofollow">https://github.com/rustd/AspnetIdentitySample</a>) and NuGet package, I'm having issues with logging in after a password reset for my MVC5 application. It seems as though Entity Framework doesn't refresh its context in the process, it's only after I restart my application that I can login with the correct credentials.</p>
  
  <p>As far as I can work out, I've done everything that the code samples have done as well. Only I have much more code and settings (e.g. Unity). </p>
  
  <p>This is the problem area:</p>
  
  <pre><code>public async Task&lt;ActionResult&gt; Login(LoginViewModel model, string returnUrl)
  {
      try
      {
          if (ModelState.IsValid)
          {
              ApplicationUser user = await UserManager.FindAsync(model.UserName, model.Password);
              if (user != null)
              {
                  await this.SignInAsync(user, false);
                  return RedirectToLocal(returnUrl);
              }
              else
              {
                  model.State = ViewModelState.Error;
                  model.Messages = new List&lt;string&gt;() { "No access buddy!" };
              }
          }
  
          // If we got this far, something failed, redisplay form
          return View(model);
  
      }
      catch (Exception ex)
      {
          throw;
      }
  }
  private async Task SignInAsync(ApplicationUser user, bool isPersistent)
  {
      AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
  
      ClaimsIdentity identity = await UserManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
      AuthenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent }, identity);
  }
  </code></pre>
  
  <p>This part works perfectly when I log on for the first time. However, after I have reset my password, logging in with the new credentials isn't possible (it still takes the old version).</p>
  
  <p>Here is my configuration:</p>
  
  <pre><code>public class ApplicationUserManager : UserManager&lt;ApplicationUser&gt;
  {
      #region Constructor
  
      public ApplicationUserManager(IUserStore&lt;ApplicationUser&gt; store)
          : base(store)
      {
          this.UserTokenProvider = new TotpSecurityStampBasedTokenProvider&lt;ApplicationUser, string&gt;();
  
      }
      #endregion Constructor
  
      #region Methods
  
      public static ApplicationUserManager Create(IdentityFactoryOptions&lt;ApplicationUserManager&gt; options, IOwinContext context)
      {
          ApplicationUserManager manager = new ApplicationUserManager(new UserStore&lt;ApplicationUser&gt;(context.Get&lt;SecurityDbContext&gt;()));
          manager.UserValidator = new UserValidator&lt;ApplicationUser&gt;(manager)
          {
              AllowOnlyAlphanumericUserNames = false,
              RequireUniqueEmail = true
          };
  
          // Configure validation logic for passwords
          manager.PasswordValidator = new PasswordValidator
          {
              RequiredLength = 6,
              RequireNonLetterOrDigit = true,
              RequireDigit = true,
              RequireLowercase = true,
              RequireUppercase = true,
          };
  
          // Configure user lockout defaults
          manager.UserLockoutEnabledByDefault = true;
          manager.DefaultAccountLockoutTimeSpan = TimeSpan.FromMinutes(5);
          manager.MaxFailedAccessAttemptsBeforeLockout = 5;
  
          // Register two factor authentication providers. This application uses Phone and Emails as a step of receiving a code for verifying the user
          // You can write your own provider and plug it in here.
          manager.RegisterTwoFactorProvider("Phone Code", new PhoneNumberTokenProvider&lt;ApplicationUser&gt;
          {
              MessageFormat = "Your security code is {0}"
          });
  
          manager.RegisterTwoFactorProvider("Email Code", new EmailTokenProvider&lt;ApplicationUser&gt;
          {
              Subject = "Security Code",
              BodyFormat = "Your security code is {0}"
          });
  
          manager.EmailService = new EmailService();
          manager.SmsService = new SmsService();
          var dataProtectionProvider = options.DataProtectionProvider;
          if (dataProtectionProvider != null)
          {
              manager.UserTokenProvider = new DataProtectorTokenProvider&lt;ApplicationUser&gt;(dataProtectionProvider.Create("ASP.NET Identity"));
          }
          return manager;
      }
  
      #endregion Methods
  }
  </code></pre>
  
  <p>This is what I've configured during Startup: </p>
  
  <pre><code>// Configure the db context, user manager and signin manager to use a single instance per request
  app.CreatePerOwinContext(SecurityDbContext.Create);
  app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);
  app.CreatePerOwinContext&lt;ApplicationSignInManager&gt;(ApplicationSignInManager.Create);
  
  // Enable the application to use a cookie to store information for the signed in user
  // and to use a cookie to temporarily store information about a user logging in with a third party login provider
  // Configure the sign in cookie
  app.UseCookieAuthentication(new CookieAuthenticationOptions
  {
      AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
      LoginPath = new PathString("/Account/Login"),
      Provider = new CookieAuthenticationProvider
      {
          // Enables the application to validate the security stamp when the user logs in.
          // This is a security feature which is used when you change a password or add an external login to your account.
          OnValidateIdentity = SecurityStampValidator.OnValidateIdentity&lt;ApplicationUserManager, ApplicationUser&gt;(
              validateInterval: TimeSpan.FromMinutes(30),
              regenerateIdentity: (manager, user) =&gt; user.GenerateUserIdentityAsync(manager))
      }
  });
  app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
  app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  app.UseCookieAuthentication(new CookieAuthenticationOptions { });
  </code></pre>
  
  <p>Ultimately, after a few screens, here is where the user ultimately ends up to create a new password:</p>
  
  <pre><code>[HttpPost]
  [AllowAnonymous]
  [ValidateAntiForgeryToken]
  public async Task&lt;ActionResult&gt; ResetPassword(ResetPasswordViewModel model)
  {
      if (!ModelState.IsValid)
      {
          return View(model);
      }
      ApplicationUser user = await UserManager.FindByEmailAsync(model.Email);
      if (user == null)
      {
          // Don't reveal that the user does not exist
          return RedirectToAction("ResetPasswordConfirmation", "Account");
      }
  
      IdentityResult result = await UserManager.ResetPasswordAsync(user.Id, model.Code, model.Password);
      if (result.Succeeded)
      {
          return RedirectToAction("ResetPasswordConfirmation", "Account");
      }
      else
      {
          AddErrors(result);
          return View();
      }
  }
  </code></pre>
  
  <p>No errors here either, it stores the new hashed value and security stamp in the database. I'm thinking of some caching, cookies or dbContext that isn't refreshed at the time the password is reset.</p>
  
  <p>Does anyone have any ideas?</p>