444 lines
17 KiB
C#
444 lines
17 KiB
C#
using System;
|
|
using System.Linq;
|
|
using System.Security.Claims;
|
|
using System.Threading.Tasks;
|
|
using IdentityOIDCWebApplicationSample.Identity.Models;
|
|
using IdentityOIDCWebApplicationSample.Identity.Models.AccountViewModels;
|
|
using IdentityOIDCWebApplicationSample.Identity.Services;
|
|
using Microsoft.AspNetCore.Authentication;
|
|
using Microsoft.AspNetCore.Authorization;
|
|
using Microsoft.AspNetCore.Identity;
|
|
using Microsoft.AspNetCore.Identity.Service;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using Microsoft.AspNetCore.Mvc.Filters;
|
|
using Microsoft.AspNetCore.Mvc.Rendering;
|
|
using Microsoft.Extensions.Logging;
|
|
using Microsoft.Net.Http.Headers;
|
|
|
|
namespace IdentityOIDCWebApplicationSample.Identity.Controllers
|
|
{
|
|
[Area("IdentityService")]
|
|
[Route("tfp/IdentityService/[controller]/[action]")]
|
|
[Authorize(IdentityServiceOptions.LoginPolicyName)]
|
|
[AllowAnonymous]
|
|
public class AccountController : Controller
|
|
{
|
|
private readonly UserManager<ApplicationUser> _userManager;
|
|
private readonly SignInManager<ApplicationUser> _signInManager;
|
|
private readonly IEmailSender _emailSender;
|
|
private readonly ISmsSender _smsSender;
|
|
private readonly ILogger _logger;
|
|
|
|
public AccountController(
|
|
UserManager<ApplicationUser> userManager,
|
|
SignInManager<ApplicationUser> signInManager,
|
|
IEmailSender emailSender,
|
|
ISmsSender smsSender,
|
|
ILoggerFactory loggerFactory)
|
|
{
|
|
_userManager = userManager;
|
|
_signInManager = signInManager;
|
|
_emailSender = emailSender;
|
|
_smsSender = smsSender;
|
|
_logger = loggerFactory.CreateLogger<AccountController>();
|
|
}
|
|
|
|
[HttpGet]
|
|
[MsalFilter]
|
|
public async Task<IActionResult> Login(string returnUrl = null)
|
|
{
|
|
// Clear the existing external cookie to ensure a clean login process
|
|
await HttpContext.SignOutAsync(IdentityConstants.ExternalScheme);
|
|
|
|
ViewData["ReturnUrl"] = returnUrl;
|
|
return View();
|
|
}
|
|
|
|
[AttributeUsage(System.AttributeTargets.Method, Inherited = false, AllowMultiple = false)]
|
|
sealed class MsalFilterAttribute : Attribute, IResultFilter
|
|
{
|
|
public void OnResultExecuted(ResultExecutedContext context)
|
|
{
|
|
}
|
|
|
|
public void OnResultExecuting(ResultExecutingContext context)
|
|
{
|
|
if(context.HttpContext.Request.Headers.TryGetValue(HeaderNames.UserAgent, out var header) &&
|
|
header.Equals("Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Tablet PC 2.0)") &&
|
|
context.Result is ViewResult view &&
|
|
view.ViewName == null)
|
|
{
|
|
view.ViewName = "Login.MSAL";
|
|
}
|
|
}
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> Login(LoginViewModel model, string returnUrl = null)
|
|
{
|
|
ViewData["ReturnUrl"] = returnUrl;
|
|
if (ModelState.IsValid)
|
|
{
|
|
// This doesn't count login failures towards account lockout
|
|
// To enable password failures to trigger account lockout, set lockoutOnFailure: true
|
|
var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
|
|
if (result.Succeeded)
|
|
{
|
|
_logger.LogInformation(1, "User logged in.");
|
|
return RedirectToLocal(returnUrl);
|
|
}
|
|
if (result.RequiresTwoFactor)
|
|
{
|
|
return RedirectToAction(nameof(SendCode), new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
|
|
}
|
|
if (result.IsLockedOut)
|
|
{
|
|
_logger.LogWarning(2, "User account locked out.");
|
|
return View("Lockout");
|
|
}
|
|
else
|
|
{
|
|
ModelState.AddModelError(string.Empty, "Invalid login attempt.");
|
|
return View(model);
|
|
}
|
|
}
|
|
|
|
// If we got this far, something failed, redisplay form
|
|
return View(model);
|
|
}
|
|
|
|
[HttpGet]
|
|
public IActionResult Register(string returnUrl = null)
|
|
{
|
|
ViewData["ReturnUrl"] = returnUrl;
|
|
return View();
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> Register(RegisterViewModel model, string returnUrl = null)
|
|
{
|
|
ViewData["ReturnUrl"] = returnUrl;
|
|
if (ModelState.IsValid)
|
|
{
|
|
var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
|
|
var result = await _userManager.CreateAsync(user, model.Password);
|
|
if (result.Succeeded)
|
|
{
|
|
// For more information on how to enable account confirmation and password reset please visit https://go.microsoft.com/fwlink/?LinkID=532713
|
|
// Send an email with this link
|
|
//var code = await _userManager.GenerateEmailConfirmationTokenAsync(user);
|
|
//var callbackUrl = Url.Action(nameof(ConfirmEmail), "Account", new { userId = user.Id, code = code }, protocol: HttpContext.Request.Scheme);
|
|
//await _emailSender.SendEmailAsync(model.Email, "Confirm your account",
|
|
// $"Please confirm your account by clicking this link: <a href='{callbackUrl}'>link</a>");
|
|
await _signInManager.SignInAsync(user, isPersistent: false);
|
|
_logger.LogInformation(3, "User created a new account with password.");
|
|
return RedirectToLocal(returnUrl);
|
|
}
|
|
AddErrors(result);
|
|
}
|
|
|
|
// If we got this far, something failed, redisplay form
|
|
return View(model);
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> Logout()
|
|
{
|
|
await _signInManager.SignOutAsync();
|
|
_logger.LogInformation(4, "User logged out.");
|
|
return Redirect("/");
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public IActionResult ExternalLogin(string provider, string returnUrl = null)
|
|
{
|
|
// Request a redirect to the external login provider.
|
|
var redirectUrl = Url.Action(nameof(ExternalLoginCallback), "Account", new { ReturnUrl = returnUrl });
|
|
var properties = _signInManager.ConfigureExternalAuthenticationProperties(provider, redirectUrl);
|
|
return Challenge(properties, provider);
|
|
}
|
|
|
|
[HttpGet]
|
|
public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
|
|
{
|
|
if (remoteError != null)
|
|
{
|
|
ModelState.AddModelError(string.Empty, $"Error from external provider: {remoteError}");
|
|
return View(nameof(Login));
|
|
}
|
|
var info = await _signInManager.GetExternalLoginInfoAsync();
|
|
if (info == null)
|
|
{
|
|
return RedirectToAction(nameof(Login));
|
|
}
|
|
|
|
// Sign in the user with this external login provider if the user already has a login.
|
|
var result = await _signInManager.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, isPersistent: false);
|
|
if (result.Succeeded)
|
|
{
|
|
_logger.LogInformation(5, "User logged in with {Name} provider.", info.LoginProvider);
|
|
return RedirectToLocal(returnUrl);
|
|
}
|
|
if (result.RequiresTwoFactor)
|
|
{
|
|
return RedirectToAction(nameof(SendCode), new { ReturnUrl = returnUrl });
|
|
}
|
|
if (result.IsLockedOut)
|
|
{
|
|
return View("Lockout");
|
|
}
|
|
else
|
|
{
|
|
// If the user does not have an account, then ask the user to create an account.
|
|
ViewData["ReturnUrl"] = returnUrl;
|
|
ViewData["LoginProvider"] = info.LoginProvider;
|
|
var email = info.Principal.FindFirstValue(ClaimTypes.Email);
|
|
return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = email });
|
|
}
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> ExternalLoginConfirmation(ExternalLoginConfirmationViewModel model, string returnUrl = null)
|
|
{
|
|
if (ModelState.IsValid)
|
|
{
|
|
// Get the information about the user from the external login provider
|
|
var info = await _signInManager.GetExternalLoginInfoAsync();
|
|
if (info == null)
|
|
{
|
|
return View("ExternalLoginFailure");
|
|
}
|
|
var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
|
|
var result = await _userManager.CreateAsync(user);
|
|
if (result.Succeeded)
|
|
{
|
|
result = await _userManager.AddLoginAsync(user, info);
|
|
if (result.Succeeded)
|
|
{
|
|
await _signInManager.SignInAsync(user, isPersistent: false);
|
|
_logger.LogInformation(6, "User created an account using {Name} provider.", info.LoginProvider);
|
|
return RedirectToLocal(returnUrl);
|
|
}
|
|
}
|
|
AddErrors(result);
|
|
}
|
|
|
|
ViewData["ReturnUrl"] = returnUrl;
|
|
return View(model);
|
|
}
|
|
|
|
[HttpGet]
|
|
public async Task<IActionResult> ConfirmEmail(string userId, string code)
|
|
{
|
|
if (userId == null || code == null)
|
|
{
|
|
return View("Error");
|
|
}
|
|
var user = await _userManager.FindByIdAsync(userId);
|
|
if (user == null)
|
|
{
|
|
return View("Error");
|
|
}
|
|
var result = await _userManager.ConfirmEmailAsync(user, code);
|
|
return View(result.Succeeded ? "ConfirmEmail" : "Error");
|
|
}
|
|
|
|
[HttpGet]
|
|
public IActionResult ForgotPassword()
|
|
{
|
|
return View();
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> ForgotPassword(ForgotPasswordViewModel model)
|
|
{
|
|
if (ModelState.IsValid)
|
|
{
|
|
var user = await _userManager.FindByEmailAsync(model.Email);
|
|
if (user == null || !(await _userManager.IsEmailConfirmedAsync(user)))
|
|
{
|
|
// Don't reveal that the user does not exist or is not confirmed
|
|
return View("ForgotPasswordConfirmation");
|
|
}
|
|
|
|
// For more information on how to enable account confirmation and password reset please visit https://go.microsoft.com/fwlink/?LinkID=532713
|
|
// Send an email with this link
|
|
//var code = await _userManager.GeneratePasswordResetTokenAsync(user);
|
|
//var callbackUrl = Url.Action(nameof(ResetPassword), "Account", new { userId = user.Id, code = code }, protocol: HttpContext.Request.Scheme);
|
|
//await _emailSender.SendEmailAsync(model.Email, "Reset Password",
|
|
// $"Please reset your password by clicking here: <a href='{callbackUrl}'>link</a>");
|
|
//return View("ForgotPasswordConfirmation");
|
|
}
|
|
|
|
// If we got this far, something failed, redisplay form
|
|
return View(model);
|
|
}
|
|
|
|
[HttpGet]
|
|
public IActionResult ForgotPasswordConfirmation()
|
|
{
|
|
return View();
|
|
}
|
|
|
|
[HttpGet]
|
|
public IActionResult ResetPassword(string code = null)
|
|
{
|
|
return code == null ? View("Error") : View();
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> ResetPassword(ResetPasswordViewModel model)
|
|
{
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return View(model);
|
|
}
|
|
var user = await _userManager.FindByEmailAsync(model.Email);
|
|
if (user == null)
|
|
{
|
|
// Don't reveal that the user does not exist
|
|
return RedirectToAction(nameof(AccountController.ResetPasswordConfirmation), "Account");
|
|
}
|
|
var result = await _userManager.ResetPasswordAsync(user, model.Code, model.Password);
|
|
if (result.Succeeded)
|
|
{
|
|
return RedirectToAction(nameof(AccountController.ResetPasswordConfirmation), "Account");
|
|
}
|
|
AddErrors(result);
|
|
return View();
|
|
}
|
|
|
|
[HttpGet]
|
|
public IActionResult ResetPasswordConfirmation()
|
|
{
|
|
return View();
|
|
}
|
|
|
|
[HttpGet]
|
|
public async Task<ActionResult> SendCode(string returnUrl = null, bool rememberMe = false)
|
|
{
|
|
var user = await _signInManager.GetTwoFactorAuthenticationUserAsync();
|
|
if (user == null)
|
|
{
|
|
return View("Error");
|
|
}
|
|
var userFactors = await _userManager.GetValidTwoFactorProvidersAsync(user);
|
|
var factorOptions = userFactors.Select(purpose => new SelectListItem { Text = purpose, Value = purpose }).ToList();
|
|
return View(new SendCodeViewModel { Providers = factorOptions, ReturnUrl = returnUrl, RememberMe = rememberMe });
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> SendCode(SendCodeViewModel model)
|
|
{
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return View();
|
|
}
|
|
|
|
var user = await _signInManager.GetTwoFactorAuthenticationUserAsync();
|
|
if (user == null)
|
|
{
|
|
return View("Error");
|
|
}
|
|
|
|
// Generate the token and send it
|
|
var code = await _userManager.GenerateTwoFactorTokenAsync(user, model.SelectedProvider);
|
|
if (string.IsNullOrWhiteSpace(code))
|
|
{
|
|
return View("Error");
|
|
}
|
|
|
|
var message = "Your security code is: " + code;
|
|
if (model.SelectedProvider == "Email")
|
|
{
|
|
await _emailSender.SendEmailAsync(await _userManager.GetEmailAsync(user), "Security Code", message);
|
|
}
|
|
else if (model.SelectedProvider == "Phone")
|
|
{
|
|
await _smsSender.SendSmsAsync(await _userManager.GetPhoneNumberAsync(user), message);
|
|
}
|
|
|
|
return RedirectToAction(nameof(VerifyCode), new { Provider = model.SelectedProvider, ReturnUrl = model.ReturnUrl, RememberMe = model.RememberMe });
|
|
}
|
|
|
|
[HttpGet]
|
|
public async Task<IActionResult> VerifyCode(string provider, bool rememberMe, string returnUrl = null)
|
|
{
|
|
// Require that the user has already logged in via username/password or external login
|
|
var user = await _signInManager.GetTwoFactorAuthenticationUserAsync();
|
|
if (user == null)
|
|
{
|
|
return View("Error");
|
|
}
|
|
return View(new VerifyCodeViewModel { Provider = provider, ReturnUrl = returnUrl, RememberMe = rememberMe });
|
|
}
|
|
|
|
[HttpPost]
|
|
[ValidateAntiForgeryToken]
|
|
public async Task<IActionResult> VerifyCode(VerifyCodeViewModel model)
|
|
{
|
|
if (!ModelState.IsValid)
|
|
{
|
|
return View(model);
|
|
}
|
|
|
|
// The following code protects for brute force attacks against the two factor codes.
|
|
// If a user enters incorrect codes for a specified amount of time then the user account
|
|
// will be locked out for a specified amount of time.
|
|
var result = await _signInManager.TwoFactorSignInAsync(model.Provider, model.Code, model.RememberMe, model.RememberBrowser);
|
|
if (result.Succeeded)
|
|
{
|
|
return RedirectToLocal(model.ReturnUrl);
|
|
}
|
|
if (result.IsLockedOut)
|
|
{
|
|
_logger.LogWarning(7, "User account locked out.");
|
|
return View("Lockout");
|
|
}
|
|
else
|
|
{
|
|
ModelState.AddModelError(string.Empty, "Invalid code.");
|
|
return View(model);
|
|
}
|
|
}
|
|
|
|
[HttpGet]
|
|
public IActionResult AccessDenied()
|
|
{
|
|
return View();
|
|
}
|
|
|
|
#region Helpers
|
|
|
|
private void AddErrors(IdentityResult result)
|
|
{
|
|
foreach (var error in result.Errors)
|
|
{
|
|
ModelState.AddModelError(string.Empty, error.Description);
|
|
}
|
|
}
|
|
|
|
private IActionResult RedirectToLocal(string returnUrl)
|
|
{
|
|
if (Url.IsLocalUrl(returnUrl))
|
|
{
|
|
return Redirect(returnUrl);
|
|
}
|
|
else
|
|
{
|
|
return Redirect("/");
|
|
}
|
|
}
|
|
|
|
#endregion
|
|
}
|
|
}
|