ASP.NET Core中的Google + / Facebook身份验证

Question

I've been reading through a lot of guides for getting basic user authentication going using external authentication services, and I just can't get the freaking thing to work.

I started with a "boiler plate" .NET Core project with user-level security. I have created my Google and Facebook Auth keys, and included the necessary libraries. I set my user class like so:

public class ApplicationUser : IdentityUser<Guid>
{
    public string FirstName { get; set; }
    public string LastName { get; set; }
    public string MiddleName { get; set; }
    public string Nickname { get; set; }
}

My Startup.cs file looks like this:

public class Startup
{
    public Startup(IHostingEnvironment env)
    {
        var builder =
            new ConfigurationBuilder().SetBasePath(env.ContentRootPath)
                .AddJsonFile("appsettings.json", true, true)
                .AddJsonFile($"appsettings.{env.EnvironmentName}.json", true);

        if (env.IsDevelopment())
            builder.AddUserSecrets();

        builder.AddEnvironmentVariables();

        Configuration = builder.Build();
    }

    public IConfigurationRoot Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.

    public void ConfigureServices(IServiceCollection services)
    {
        // Add framework services.
        services.AddDbContext<ApplicationDbContext>(
            options => options.UseNpgsql(Configuration.GetConnectionString("ApplicationDb")));

        services.AddIdentity<ApplicationUser, ApplicationRole>(opt =>
            {
                opt.Password.RequireNonAlphanumeric = false;
                opt.Password.RequireUppercase = false;
                opt.Password.RequireLowercase = false;
                opt.Password.RequireDigit = false;
                opt.Password.RequiredLength = 8;

                opt.User.RequireUniqueEmail = true;
                opt.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-_=+~@.";

                opt.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
                opt.Lockout.MaxFailedAccessAttempts = 5;

                opt.SignIn.RequireConfirmedEmail = true;
                opt.SignIn.RequireConfirmedPhoneNumber = false;
            })
            .AddEntityFrameworkStores<ApplicationDbContext, Guid>()
            .AddDefaultTokenProviders();

        services.AddMvc(options => { options.Filters.Add(new RequireHttpsAttribute()); });

        // Add application services.
        services.AddTransient<IEmailSender, AuthMessageSender>();
        services.AddTransient<ISmsSender, AuthMessageSender>();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        loggerFactory.AddConsole(Configuration.GetSection("Logging"));
        loggerFactory.AddDebug();

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
            app.UseBrowserLink();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
        }

        app.UseStaticFiles();

        app.UseIdentity();

        //Add external authentication middleware below.To configure them please see http://go.microsoft.com/fwlink/?LinkID=532715
        var facebookOptions = new FacebookOptions
        {
            AppId = Configuration["Authentication:Facebook:AppId"],
            AppSecret = Configuration["Authentication:Facebook:AppSecret"]
        };
        app.UseFacebookAuthentication(facebookOptions);

        var googleOptions = new GoogleOptions
        {
            ClientId = Configuration["Authentication:Google:AppId"],
            ClientSecret = Configuration["Authentication:Google:AppSecret"]
        };
        app.UseGoogleAuthentication(googleOptions);

        app.UseMvc(routes =>
        {
            routes.MapRoute("default", "{controller=Home}/{action=Index}/{id?}");
        });
    }
}

So far, so good. I start up the project, click on the "Log In" link, and I can choose to log in with Google or Facebook. I select Google, and... the first time I try, I get prompted for approval by Google, and pointed back to the Register page, where I create my local account with nickname, etc.

Now, I can go add a local password to my account. All is working swimmingly. So I log off and try to log in again using my Google credentials, after deleting my cookie. Surprisingly, I'm brought to the Register page again, but I can't register because I'm already registered. My local password won't work either.

So I dig into this a bit more. In the AccountController there is a method called ExternalLoginCallback where all the magic seems to happen. My method looks like this:

    [HttpGet]
    [AllowAnonymous]
    public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
    {
        if (remoteError != null)
        {
            ModelState.AddModelError(string.Empty, $"Error from external provider: {remoteError}");
            return View(nameof(Login));
        }
        var info = await _signInManager.GetExternalLoginInfoAsync();
        if (info == null)
            return RedirectToAction(nameof(Login));

        // Sign in the user with this external login provider if the user already has a login.
        var result = await _signInManager.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, false);
        if (result.Succeeded)
        {
            _logger.LogInformation(5, "User logged in with {Name} provider.", info.LoginProvider);
            return RedirectToLocal(returnUrl);
        }
        if (result.RequiresTwoFactor)
            return RedirectToAction(nameof(SendCode), new
            {
                ReturnUrl = returnUrl
            });
        if (result.IsLockedOut)
            return View("Lockout");
        // If the user does not have an account, then ask the user to create an account.
        ViewData["ReturnUrl"] = returnUrl;
        ViewData["LoginProvider"] = info.LoginProvider;
        var email = info.Principal.FindFirstValue(ClaimTypes.Email);
        var firstName = info.Principal.FindFirstValue(ClaimTypes.GivenName);
        var lastName = info.Principal.FindFirstValue(ClaimTypes.Surname);
        return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel
        {
            Email = email,
            FirstName = firstName,
            LastName = lastName
        });
    }

I trace the code as it goes through the _signInManager.GetExternalLoginInfoAsync() call, and... the result is NotAllowed ?

NotAllowed is one of 4 possible results, as far as I can tell, the other 3 being Succeeded , RequiresTwoFactor , and IsLockedOut . The other 3 values get sent someplace else, so I must assume NotAllowed is expected when no local account exists... except that a local count exists.

Can someone give me an idea of what is going on here? Once I sign off with Google (or Facebook, the same sort of thing happens there), I cannot log back in with them, and there is almost zero useful feedback to determine what the actual problem is.

Answer 1

Never mind; I'm an idiot.

I thought I was being super cool when I put this line in:

opt.SignIn.RequireConfirmedEmail = true;

...but, since I wasn't confirming the email, guess what wasn't happening? SMH...