I have a .NET project, MVC 5, EF 6. We connect to an external project / database for user authentication, so all we need to implement is the login and logout methods, not the usual CRUD methods. I know that EF is correctly mapped to external database tables; I see that he is getting users.
I'm trying to use OWIN for authentication to use attributes like [Authorize] for all controller methods. I follow this as my guide.
In Startup.Auth.cs, I have:
app.CreatePerOwinContext<CustomUserManager>(CustomUserManager.Create); app.CreatePerOwinContext<CustomSignInManager>(CustomSignInManager.Create); app.UseCookieAuthentication(new CookieAuthenticationOptions { AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie, LoginPath = new PathString("/Account/Login"), Provider = new CookieAuthenticationProvider { OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>( validateInterval: TimeSpan.FromMinutes(30), regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager) ) }, CookieSecure = CookieSecureOption.Always });
I also have classes implementing the IUserStore<User> , UserManager<User> and SignInManager<User, string> interfaces. My CustomUserStore implements the following method, because the source reports that it is logging in. I have implemented dummy methods for other functions (i.e. DeleteAsync() , UpdateAsync() , etc.) which do not need to be implemented because we have read-only access to these external db users ...
public async Task<User> FindByIdAsync(string id) { using (ExternalDBContext context = new ExternalDBContext()) { return await Task.Run(() => context.Users.Where(u => u.Id == id).ToList().FirstOrDefault() ); } }
Then in my AccountController.Login () I have:
await CustomSignInManager.SignInAsync(model, true, true); return RedirectToAction("Index", "Dashboard");
But after SignInAsync() , User.Identity.IsAuthenticated is still false , and therefore, none of the authorization attributes will work.
# 1 Possible problem: I am wondering if there is a problem with the AuthenticationManager that SignInManager relies SignInManager . This is how I implement it in Startup.Auth.cs:
public class CustomSignInManager : SignInManager<User, string> { public CustomSignInManager(CustomUserManager userManager, IAuthenticationManager authenticationManager) : base(userManager, authenticationManager) { } public static CustomSignInManager Create(IdentityFactoryOptions<CustomSignInManager> options, IOwinContext context) { return new CustomSignInManager(context.GetUserManager<CustomUserManager>(), context.Authentication); } }
It gets Microsoft.Owin.Security.AuthenticationManager from the context.
So: do I need to do something else to implement authentication?
# 2 Possible problem: I noticed that my CustomUserManager has the property SupportsUserLogin = false . This property requires an implementation of IUserLoginStore . I do not want to implement another useless interface full of methods that I do not use!
So: does it matter if SupportsUserLogin = false ? Do I need to implement this interface or is there a way around this?
Summary: In general, it is too complicated for a project where all I want to do is LOG THE USER IN. And he went out. I do not want to create / update / delete users. I just want to register the user and User.Identity.IsAuthenticated = true before logging out. Thus, any ideas on how to step back to a simpler use of the Identity system will be greatly appreciated. My biggest question is: I'm generally on the right track.
Edit: I definitely don't want to do # 2 (implement IUserLoginStore) because it is for external authentication .