Scenario
Using the supplied credentials from the user I need to validate them over a web service. Create a user object and maintain that object throughout the site. If the user navigates or closes the browser and then comes back to the site it should remember them. The webservice goes behind a firewall to validate the user. So the site will never talk to an actual DB directly.
To me this seem very routine but I am having troubles understanding the difference with all the new types of Authentication that MVC 5 has to offer. And what would the best route for me to take on this. I would just use Forms Authenication in my old asp.net apps but not sure if this is what I should be using now.
Below is my code I have so far. But I think I may need to go a different direction. Everything works except for Remember Me. If I close out the browser then go back to the page I need to log back in.
AccountController.cs
[HttpPost, AllowAnonymous, ValidateAntiForgeryToken, RequireHttps]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl) {
if (!ModelState.IsValid) { return View(model); }
var user = await PMyUserManager.FindAsync(model.UserName, model.Password);
if (user == null) {
ModelState.AddModelError("", "Invalid login attempt."); return View(model);
}
await SignInAsync(user, model.RememberMe);
return RedirectToLocal(returnUrl);
}
private async Task SignInAsync(ApplicationUser user, bool isPersistent) {
AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
var identity = await PMyUserManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
AuthenticationManager.SignIn(new AuthenticationProperties() {
IsPersistent = isPersistent,
AllowRefresh = true,
}, identity);
}
MyUserManager.cs
public class MyUserManager : UserManager<ApplicationUser> {
public MyUserManager() : base(new MyUserStore<ApplicationUser>()) {
//We can retrieve Old System Hash Password and can encypt or decrypt old password using custom approach.
//When we want to reuse old system password as it would be difficult for all users to initiate pwd change as per Idnetity Core hashing.
this.PasswordHasher = new OldSystemPasswordHasher();
}
public override System.Threading.Tasks.Task<ApplicationUser> FindAsync(string userName, string password) {
Task<ApplicationUser> taskInvoke = Task<ApplicationUser>.Factory.StartNew(() => {
//First Verify Password...
PasswordVerificationResult result = this.PasswordHasher.VerifyHashedPassword(userName, password);
if (result == PasswordVerificationResult.SuccessRehashNeeded) {
//Return User Profile Object...
return ((OldSystemPasswordHasher)PasswordHasher).AppUser;
}
return null;
});
return taskInvoke;
}
}
/// <summary>
/// Use Custom approach to verify password
/// </summary>
public class OldSystemPasswordHasher : PasswordHasher
{
internal ApplicationUser AppUser { get; set; }
public override string HashPassword(string password)
{
return base.HashPassword(password);
}
public override PasswordVerificationResultVerifyHashedPassword(string un, string pw) {
UVServive.ValidateVPDMUserRequest request = new UVServive.ValidateVPDMUserRequest() {
UserName = un,
Password = pw,
Region = ""
};
UVServive.MyMWebServiceClient cl = new UVServive.MyWebServiceClient();
UVServive.ValidateVPDMUserResponse respond = cl.ValidateVPDMUser(request);
if (respond.StatusCode != "200") { throw new Exception(respond.StatusMessage); }
AppUser = new ApplicationUser() {
UserName = un,
Name = respond.EDIName,
AssociatedVendors = respond.VendCodes.Split(SiteToolz.vm),
ErrorMessage = !respond.Result ? "Account Credentials Are Invalid." : ""
};
return respond.Result ? PasswordVerificationResult.SuccessRehashNeeded : PasswordVerificationResult.Failed;
}
}
MyUserStore
public class MyUserStore<T> : IUserStore<T> where T : ApplicationUser {
System.Threading.Tasks.Task IUserStore<T>.CreateAsync(T user) {
//Create /Register New User
throw new NotImplementedException();
}
System.Threading.Tasks.Task IUserStore<T>.DeleteAsync(T user) {
//Delete User
throw new NotImplementedException();
}
System.Threading.Tasks.Task<T> IUserStore<T>.FindByIdAsync(string userId) {
throw new NotImplementedException();
}
System.Threading.Tasks.Task<T> IUserStore<T>.FindByNameAsync(string userName) {
throw new NotImplementedException();
}
System.Threading.Tasks.Task IUserStore<T>.UpdateAsync(T user) {
//Update User Profile
throw new NotImplementedException();
}
void IDisposable.Dispose() {
// throw new NotImplementedException();
}
}
Aucun commentaire:
Enregistrer un commentaire