you need to set this attribute

allowManuallyChangingPassword="true" on the UmbracoMembershipProvider node in your web.config

Thanks for the quick response Huw!

Unfortunately, that change had no bearing on whether or not my overridden methods were called. I still can't hit my breakpoint in PerformChangePassword, regardless of if the password is changed via reset or through the Backoffice. To make matters worse, it also causes the call to PostChangePassword made on the front-end to return a 400 whenever a user tries to update their password through the Backoffice.

After initially writing this post, I discovered the UpdatePassword method in the BackOfficeUserManager. I'm hoping I can just override that, then get rid of my custom membership provider all together.

Unfortunately, the alternative approach I mentioned in my previous comment (leveraging the BackOfficeUserManager in lieu of my custom provider) did not pan out. I cannot encrypt and hash the user's new password in the overridden UpdatePassword() method in the same fashion that Umbraco does, so my comparisons of the user's new password to their history consistently fails. Regardless of what method I use, my hashes are always different than what Umbraco ultimately writes to the DB.

Based on the source code, particularly seeing the protected modifier on the EncryptOrHashNewPassword() method in the MembershipProviderBase class, leads me to believe Umbraco wants you to create a custom membership provider. Protected means I can't access it unless I'm inheriting from UsersMembershipProvider, which my manager is not. More over, I believe the reason the hashes never match is because the salt is constantly changing and the method responsible for generating it is also protected.

My next approach will more than likely be something that Umbraco HQ won't recommend, and that's to salt, encrypt and hash the passwords using a custom approach, then updating my manager to store those values instead of fetching and storing the hash from the umbracoUser table. That is, unless I can figure out why:

1. My custom UsersMembershipProvider is not firing
2. Setting "allowManuallyChangingPassword" to true results in a 400 when changing the password in the Backoffice

The alternative approach in my previous comment panned out from a functional perspective, however, the Backoffice user's experience is not ideal. Umbraco doesn't store the reused password, as expected, but there is no indication of an error (or success for that matter) displayed to the user.

I already have a custom DelegatingHandler for a different feature that adds custom notifications for when the user publishes a specific type of content. I figured I could leverage that in the same way. Despite being able to detect the request made to /umbraco/backoffice/umbracoapi/currentuser/postchangepassword and parse a custom error that's set in the custom BackOfficeUserManager, I haven't found a way to add the notification. In the case of the pre-existing feature, I'm left with an instance of a ContentItemDisplay, which has a Notifications property that I can add to. In the case of the new feature, I'm left with an instance of System.Web.Http's HttpError.

Is there a way to fail my overridden UpdatePassword() method such that it returns a model that implements the INotificationModel interface? This looks promising but trying to cast the response content as an instance of that results in the variable being null.

Below is my overridden UpdatePassword() method in my BackOfficeUserManager:

    protected override async Task<IdentityResult> UpdatePassword(IUserPasswordStore<BackOfficeIdentityUser, int> passwordStore, BackOfficeIdentityUser user, string newPassword)
    {
        var saltBytes = Convert.FromBase64String(_salt);
        var passwordBytes = Convert.FromBase64String(newPassword);
        var hashedBytes = GenerateSaltedHash(passwordBytes, saltBytes);
        var hashedPassword = Convert.ToBase64String(hashedBytes);

        var service = PasswordServiceFactory.Create();
        // Ensure password is not the same as the last 6 passwords
        var validPassword = service.CheckPasswordDuplicates(user.UserName, hashedPassword);

        if (!validPassword)
        {
            var error = new string[] { "Your password cannot be the same as your last 6 passwords|", user.UserName };
            return IdentityResult.Failed(error);
        }

        service.SetPasswordHistory(user.Id, hashedPassword);

        return await base.UpdatePassword(passwordStore, user, newPassword);
    }