PasswordSignInAsync 未设置 User.Identity

Question

I'm using Net Core 3.1 and doing the below code for login:

     public async Task LoginAsync(string username, string pass) {            
        _logger.LogDebug("Attempting Login... {0}", username);
        var result = await _signInManager.PasswordSignInAsync(username,
                       pass, true, lockoutOnFailure: true);   
        if (result.Succeeded && !result.IsLockedOut && !result.IsNotAllowed) {
            var user = await _signInManager.UserManager.FindByNameAsync(username);
            await _signInManager.SignInAsync(user, false);

            _logger.LogDebug("{0} Logged in successfully. {1}", username, System.DateTime.Now);
            _logger.LogDebug("{0} {1}", User.Identity.IsAuthenticated, user.UserName);
            _logger.LogDebug("{0}", User.Identity.Name);
            Response.Redirect("/Dashboard");
        } else {
            _logger.LogDebug("{0} Wrong Credentials.", username);
            Response.Redirect("/?error=wrong-credentials");
        }
    }

When I try to use User.Identity.IsAuthenticated , this always returns false.

What am I missing here?

Adding config files below.

Let me know if anything could be missing from the config files.

Startup.cs

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddDbContext<GazelleIdentityContext>(options =>
            options.UseSqlServer(Configuration.GetConnectionString("GazelleCS")));

        services.AddRazorPages();
    }

IdentityHostingStartup.cs

    public void Configure(IWebHostBuilder builder)
    {
        builder.ConfigureServices((context, services) => {
            services.AddDbContext<GazelleIdentityContext>(options =>
                options.UseSqlServer(context.Configuration.GetConnectionString("GazelleCS"))
            );
            services.AddDefaultIdentity<IdentityUser>().AddEntityFrameworkStores<GazelleIdentityContext>();

            services.Configure<IdentityOptions>(options =>
            {
                // Password settings.
                options.Password.RequireDigit = false;
                options.Password.RequireLowercase = true;
                options.Password.RequireNonAlphanumeric = true;
                options.Password.RequireUppercase = false;
                options.Password.RequiredLength = 6;
                options.Password.RequiredUniqueChars = 1;

                // Lockout settings.
                options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(60);
                options.Lockout.MaxFailedAccessAttempts = 3;
                options.Lockout.AllowedForNewUsers = true;

                // User settings.
                options.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+";
                options.User.RequireUniqueEmail = true;
            });

            services.ConfigureApplicationCookie(options =>
            {
                // Cookie settings
                options.Cookie.Name = "GACOOKIE_USER";
                options.Cookie.HttpOnly = true;
                options.ExpireTimeSpan = TimeSpan.FromMinutes(2);
                options.LoginPath = "/";
                options.LogoutPath = "/Logout";
                options.AccessDeniedPath = "/LoginFailed";
                options.SlidingExpiration = true;
                options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
                options.Cookie.SameSite = SameSiteMode.Lax;
            });

            services.AddAuthentication(options =>
            {
                options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            }).AddCookie();
        });
    }

This is my configuration files used to configuration.

Answer 1

Cookie-auth obviously requires setting a cookie. That is done via the Set-Cookie response header, which will be sent with the response once you return it. Once the browser receives the response with that header, it will set the cookie, and then on subsequent requests will send that cookie back to re-authenticate the user for each request.

Until you send the response, none of this has happened, yet, and therefore, User is not populated. Long and short, you can't get at things like User.Identity.IsAuthenticated() or User.Identity.Name until the next request .

That said, since all you're doing is logging here, you can just log those values from the information you already have. Obviously the user is authenticated or they wouldn't have reached this point in the control flow, so just return true there, instead of User.Identity.IsAuthenticated . For User.Identity.Name , use user.UserName , etc.

Answer 2

.Net core 2.1 or higher on is built-in supports GDPR (General Data Protection Regulation).

and until you accept the cookie, cookie does not set in the browser and User.Identity.IsAuthenticated always return false .

You must set IsEssential to true to ignore GDPR

services.Configure<CookiePolicyOptions>(options =>
            {
                options.ConsentCookie.IsEssential = true;//<-- NOTE THIS
                options.CheckConsentNeeded = context => false;
                options.MinimumSameSitePolicy = SameSiteMode.None;
            });

Or add this line to ConfigureApplicationCookie method to ignore GDRP and save cookie in the browser

 options.Cookie.IsEssential = true;