ASP Identity Issue not authenticting - asp.net

Question

So I'm using ASP Identity. I customized the profile with adding isEnabled so that I know if a user is Active or not. This works fine and the database is updated without issue.
So after research, I saw that I need to override "public async override Task PasswordSignInAsync" that I can check for the isEnabled property. This works fine as well because it's passing the proper SigninStatus that I need to the Login Page.
The IdentifyConfig.cs File:
public async override Task<SignInStatus> PasswordSignInAsync(string userName, string password, bool rememberMe, bool shouldLockout)
{
var user = UserManager.FindByEmailAsync(userName).Result;
if (user.IsEnabled != false)
{
return await Task.FromResult<SignInStatus>(SignInStatus.Success);
}
return await Task.FromResult<SignInStatus>(SignInStatus.LockedOut);
}
The Login Page:
protected void LogIn(object sender, EventArgs e)
{
if (IsValid)
{
// Validate the user password
var manager = Context.GetOwinContext().GetUserManager<ApplicationUserManager>();
var signinManager = Context.GetOwinContext().GetUserManager<ApplicationSignInManager>();
// This doen't count login failures towards account lockout
// To enable password failures to trigger lockout, change to shouldLockout: true
//var result = signinManager.PasswordSignIn(Email.Text, Password.Text, RememberMe.Checked, shouldLockout: false);
var result = signinManager.PasswordSignInAsync(Email.Text, Password.Text, RememberMe.Checked, shouldLockout: false);
switch (result.Result)
{
case SignInStatus.Success:
//IdentityHelper.RedirectToReturnUrl(Request.QueryString["ReturnUrl"], Response);
Response.Redirect("/Account/Dashboard");
break;
case SignInStatus.LockedOut:
Response.Redirect("/Account/Lockout");
break;
case SignInStatus.RequiresVerification:
Response.Redirect(String.Format("/Account/TwoFactorAuthenticationSignIn?ReturnUrl={0}&RememberMe={1}",
Request.QueryString["ReturnUrl"],
RememberMe.Checked),
true);
break;
case SignInStatus.Failure:
default:
//FailureText.Text = "Invalid login attempt";
//ErrorMessage.Visible = true;
break;
}
}
}
The switch case goes into the right case, but here's the issue. When it goes into the case SignInStatus.Success: it just stays in a loop and keeps presenting the Login Screen as if the user is not authenticated. Now, I'm sure i am missing something on the Override for
public async override Task PasswordSignInAsync(string userName, string password, bool rememberMe, bool shouldLockout)
function, but I thought if Success came back that the user is authorized.
If I uncomment
//var result = signinManager.PasswordSignIn(Email.Text, Password.Text, RememberMe.Checked, shouldLockout: false);
function it works fine, but I can't get the IsEnabled value to check. Please any advice would be appreciated on this issue.

Answer 1

I believe that we have a few issues that are compounding for you, making this process a bit hard to dissect
Your async implementation could cause some thread issues
We want to be sure to handle a null situation on user lookup, for a bad username
We want to be sure that we actually validate the password
We need to call the method necessary to login the user as well, as that is a responsibility of this method
I'm going to assume that you are using the non ASP.NET Core version of things. As such, this modified version should help. I have not been able to 100% validate.
public async override Task<SignInStatus> PasswordSignInAsync(string userName, string password, bool rememberMe, bool shouldLockout)
{
var user = await UserManager.FindByEmailAsync(userName);
//User not found
if (user == null)
return SignInStatus.Failure;
//User not enabled
if (user.IsEnabled != false)
return SignInStatus.Failure;
//Now, validate that the password was correct
var isValidPassword = await UserManager.CheckPasswordAsync(user, password);
if (!isValidPassword)
return SignInStatus.Failure;
//Now we know they are valid and enabled, login and return
await base.SignInAsync(user, isPersistent, false);
return SignInStatus.Success;
}
This above code SHOULD work for you, without issue. The only question is on the type that is used to pass into the CheckPassword asyc, I don't have a project ready to validate. But this should get you there.