2 using System.Globalization;
4 using System.Security.Claims;
5 using System.Threading.Tasks;
8 using Microsoft.AspNet.Identity;
9 using Microsoft.AspNet.Identity.Owin;
10 using Microsoft.Owin.Security;
11 using Projects.Models;
13 namespace Projects.Controllers
16 public class AccountController : Controller
18 private ApplicationSignInManager _signInManager;
19 private ApplicationUserManager _userManager;
21 public AccountController()
25 public AccountController(ApplicationUserManager userManager, ApplicationSignInManager signInManager )
27 UserManager = userManager;
28 SignInManager = signInManager;
31 public ApplicationSignInManager SignInManager
35 return _signInManager ?? HttpContext.GetOwinContext().Get<ApplicationSignInManager>();
39 _signInManager = value;
43 public ApplicationUserManager UserManager
47 return _userManager ?? HttpContext.GetOwinContext().GetUserManager<ApplicationUserManager>();
56 // GET: /Account/Login
58 public ActionResult Login(string returnUrl)
60 ViewBag.ReturnUrl = returnUrl;
65 // POST: /Account/Login
68 [ValidateAntiForgeryToken]
69 public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
71 if (!ModelState.IsValid)
76 // This doesn't count login failures towards account lockout
77 // To enable password failures to trigger account lockout, change to shouldLockout: true
78 var result = await SignInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, shouldLockout: false);
81 case SignInStatus.Success:
82 return RedirectToLocal(returnUrl);
83 case SignInStatus.LockedOut:
84 return View("Lockout");
85 case SignInStatus.RequiresVerification:
86 return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
87 case SignInStatus.Failure:
89 ModelState.AddModelError("", "Invalid login attempt.");
95 // GET: /Account/VerifyCode
97 public async Task<ActionResult> VerifyCode(string provider, string returnUrl, bool rememberMe)
99 // Require that the user has already logged in via username/password or external login
100 if (!await SignInManager.HasBeenVerifiedAsync())
102 return View("Error");
104 return View(new VerifyCodeViewModel { Provider = provider, ReturnUrl = returnUrl, RememberMe = rememberMe });
108 // POST: /Account/VerifyCode
111 [ValidateAntiForgeryToken]
112 public async Task<ActionResult> VerifyCode(VerifyCodeViewModel model)
114 if (!ModelState.IsValid)
119 // The following code protects for brute force attacks against the two factor codes.
120 // If a user enters incorrect codes for a specified amount of time then the user account
121 // will be locked out for a specified amount of time.
122 // You can configure the account lockout settings in IdentityConfig
123 var result = await SignInManager.TwoFactorSignInAsync(model.Provider, model.Code, isPersistent: model.RememberMe, rememberBrowser: model.RememberBrowser);
126 case SignInStatus.Success:
127 return RedirectToLocal(model.ReturnUrl);
128 case SignInStatus.LockedOut:
129 return View("Lockout");
130 case SignInStatus.Failure:
132 ModelState.AddModelError("", "Invalid code.");
138 // GET: /Account/Register
140 public ActionResult Register()
146 // POST: /Account/Register
149 [ValidateAntiForgeryToken]
150 public async Task<ActionResult> Register(RegisterViewModel model)
152 if (ModelState.IsValid)
154 var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
155 var result = await UserManager.CreateAsync(user, model.Password);
156 if (result.Succeeded)
158 await SignInManager.SignInAsync(user, isPersistent:false, rememberBrowser:false);
160 // For more information on how to enable account confirmation and password reset please visit http://go.microsoft.com/fwlink/?LinkID=320771
161 // Send an email with this link
162 // string code = await UserManager.GenerateEmailConfirmationTokenAsync(user.Id);
163 // var callbackUrl = Url.Action("ConfirmEmail", "Account", new { userId = user.Id, code = code }, protocol: Request.Url.Scheme);
164 // await UserManager.SendEmailAsync(user.Id, "Confirm your account", "Please confirm your account by clicking <a href=\"" + callbackUrl + "\">here</a>");
166 return RedirectToAction("Index", "Home");
171 // If we got this far, something failed, redisplay form
176 // GET: /Account/ConfirmEmail
178 public async Task<ActionResult> ConfirmEmail(string userId, string code)
180 if (userId == null || code == null)
182 return View("Error");
184 var result = await UserManager.ConfirmEmailAsync(userId, code);
185 return View(result.Succeeded ? "ConfirmEmail" : "Error");
189 // GET: /Account/ForgotPassword
191 public ActionResult ForgotPassword()
197 // POST: /Account/ForgotPassword
200 [ValidateAntiForgeryToken]
201 public async Task<ActionResult> ForgotPassword(ForgotPasswordViewModel model)
203 if (ModelState.IsValid)
205 var user = await UserManager.FindByNameAsync(model.Email);
206 if (user == null || !(await UserManager.IsEmailConfirmedAsync(user.Id)))
208 // Don't reveal that the user does not exist or is not confirmed
209 return View("ForgotPasswordConfirmation");
212 // For more information on how to enable account confirmation and password reset please visit http://go.microsoft.com/fwlink/?LinkID=320771
213 // Send an email with this link
214 // string code = await UserManager.GeneratePasswordResetTokenAsync(user.Id);
215 // var callbackUrl = Url.Action("ResetPassword", "Account", new { userId = user.Id, code = code }, protocol: Request.Url.Scheme);
216 // await UserManager.SendEmailAsync(user.Id, "Reset Password", "Please reset your password by clicking <a href=\"" + callbackUrl + "\">here</a>");
217 // return RedirectToAction("ForgotPasswordConfirmation", "Account");
220 // If we got this far, something failed, redisplay form
225 // GET: /Account/ForgotPasswordConfirmation
227 public ActionResult ForgotPasswordConfirmation()
233 // GET: /Account/ResetPassword
235 public ActionResult ResetPassword(string code)
237 return code == null ? View("Error") : View();
241 // POST: /Account/ResetPassword
244 [ValidateAntiForgeryToken]
245 public async Task<ActionResult> ResetPassword(ResetPasswordViewModel model)
247 if (!ModelState.IsValid)
251 var user = await UserManager.FindByNameAsync(model.Email);
254 // Don't reveal that the user does not exist
255 return RedirectToAction("ResetPasswordConfirmation", "Account");
257 var result = await UserManager.ResetPasswordAsync(user.Id, model.Code, model.Password);
258 if (result.Succeeded)
260 return RedirectToAction("ResetPasswordConfirmation", "Account");
267 // GET: /Account/ResetPasswordConfirmation
269 public ActionResult ResetPasswordConfirmation()
275 // POST: /Account/ExternalLogin
278 [ValidateAntiForgeryToken]
279 public ActionResult ExternalLogin(string provider, string returnUrl)
281 // Request a redirect to the external login provider
282 return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
286 // GET: /Account/SendCode
288 public async Task<ActionResult> SendCode(string returnUrl, bool rememberMe)
290 var userId = await SignInManager.GetVerifiedUserIdAsync();
293 return View("Error");
295 var userFactors = await UserManager.GetValidTwoFactorProvidersAsync(userId);
296 var factorOptions = userFactors.Select(purpose => new SelectListItem { Text = purpose, Value = purpose }).ToList();
297 return View(new SendCodeViewModel { Providers = factorOptions, ReturnUrl = returnUrl, RememberMe = rememberMe });
301 // POST: /Account/SendCode
304 [ValidateAntiForgeryToken]
305 public async Task<ActionResult> SendCode(SendCodeViewModel model)
307 if (!ModelState.IsValid)
312 // Generate the token and send it
313 if (!await SignInManager.SendTwoFactorCodeAsync(model.SelectedProvider))
315 return View("Error");
317 return RedirectToAction("VerifyCode", new { Provider = model.SelectedProvider, ReturnUrl = model.ReturnUrl, RememberMe = model.RememberMe });
321 // GET: /Account/ExternalLoginCallback
323 public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
325 var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
326 if (loginInfo == null)
328 return RedirectToAction("Login");
331 // Sign in the user with this external login provider if the user already has a login
332 var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
335 case SignInStatus.Success:
336 return RedirectToLocal(returnUrl);
337 case SignInStatus.LockedOut:
338 return View("Lockout");
339 case SignInStatus.RequiresVerification:
340 return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = false });
341 case SignInStatus.Failure:
343 // If the user does not have an account, then prompt the user to create an account
344 ViewBag.ReturnUrl = returnUrl;
345 ViewBag.LoginProvider = loginInfo.Login.LoginProvider;
346 return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = loginInfo.Email });
351 // POST: /Account/ExternalLoginConfirmation
354 [ValidateAntiForgeryToken]
355 public async Task<ActionResult> ExternalLoginConfirmation(ExternalLoginConfirmationViewModel model, string returnUrl)
357 if (User.Identity.IsAuthenticated)
359 return RedirectToAction("Index", "Manage");
362 if (ModelState.IsValid)
364 // Get the information about the user from the external login provider
365 var info = await AuthenticationManager.GetExternalLoginInfoAsync();
368 return View("ExternalLoginFailure");
370 var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
371 var result = await UserManager.CreateAsync(user);
372 if (result.Succeeded)
374 result = await UserManager.AddLoginAsync(user.Id, info.Login);
375 if (result.Succeeded)
377 await SignInManager.SignInAsync(user, isPersistent: false, rememberBrowser: false);
378 return RedirectToLocal(returnUrl);
384 ViewBag.ReturnUrl = returnUrl;
389 // POST: /Account/LogOff
391 [ValidateAntiForgeryToken]
392 public ActionResult LogOff()
394 AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
395 return RedirectToAction("Index", "Home");
399 // GET: /Account/ExternalLoginFailure
401 public ActionResult ExternalLoginFailure()
406 protected override void Dispose(bool disposing)
410 if (_userManager != null)
412 _userManager.Dispose();
416 if (_signInManager != null)
418 _signInManager.Dispose();
419 _signInManager = null;
423 base.Dispose(disposing);
427 // Used for XSRF protection when adding external logins
428 private const string XsrfKey = "XsrfId";
430 private IAuthenticationManager AuthenticationManager
434 return HttpContext.GetOwinContext().Authentication;
438 private void AddErrors(IdentityResult result)
440 foreach (var error in result.Errors)
442 ModelState.AddModelError("", error);
446 private ActionResult RedirectToLocal(string returnUrl)
448 if (Url.IsLocalUrl(returnUrl))
450 return Redirect(returnUrl);
452 return RedirectToAction("Index", "Home");
455 internal class ChallengeResult : HttpUnauthorizedResult
457 public ChallengeResult(string provider, string redirectUri)
458 : this(provider, redirectUri, null)
462 public ChallengeResult(string provider, string redirectUri, string userId)
464 LoginProvider = provider;
465 RedirectUri = redirectUri;
469 public string LoginProvider { get; set; }
470 public string RedirectUri { get; set; }
471 public string UserId { get; set; }
473 public override void ExecuteResult(ControllerContext context)
475 var properties = new AuthenticationProperties { RedirectUri = RedirectUri };
478 properties.Dictionary[XsrfKey] = UserId;
480 context.HttpContext.GetOwinContext().Authentication.Challenge(properties, LoginProvider);