title: Manually validating a password reset token in ASP.NET Identity
body: <p>I would like to manually validate a password reset token in ASP.NET Identity 2.0. I'm trying to create my own version of <code>UserManager.ResetPasswordAsync(string userId, string token, string newPassword)</code> that takes and <code>IdentityUser</code> instead of <code>userId</code> like this:</p>
  
  <pre><code>UserManager.ResetPasswordAsync(IdentityUser user, string token, string newPassword)
  </code></pre>
  
  <p>Not sure if I am doing this right, but here I am attempting to validate the code that was emailed to the user in an earlier step. I have not modified the code/token that sends the email to the user and generates the code. I am assuming this is the correct method to call, but the <code>purpose</code> argument is incorrect. (I tried passing "ASP.NET Identity" but no dice.)</p>
  
  <pre><code>if (await userManager.UserTokenProvider.ValidateAsync(purpose: "?", token: code, manager: userManager, user: user))
  {
      return IdentityResult.Success;
  }
  else
  {
      return new IdentityResult("Invalid code.");
  }
  </code></pre>
  
  <p>If someone could fill me in on the details of how it works out of the box, or point me at Microsoft's source code for <code>UserManager.ResetPasswordAsync(IdentityUser user, string token, string newPassword)</code> that would be most appreciated!</p>