ASP Identity认证失败问题：自定义isEnabled属性后的登录验证故障

Hey there! Let's work through this authentication issue you're hitting after adding the IsEnabled property to your ASP.NET Identity user profile. You mentioned the property works fine in the database, and you've overridden PasswordSignInAsync to check it—but authentication is failing. Here are the most likely culprits and fixes:

1. Fix the Logic Order in Your Overridden Method #

It’s easy to mix up the order of operations here. The key is to verify the user’s IsEnabled status before running the base authentication logic. If you call the base method first, you’re already attempting to authenticate a disabled user, which can lead to unexpected failures.

Here’s a corrected example of the overridden method (in your IdentifyConfig.cs):

public async override Task<SignInStatus> PasswordSignInAsync(string userName, string password, bool isPersistent, bool shouldLockout)
{
    // Step 1: Fetch the user from the database
    var user = await UserManager.FindByNameAsync(userName);
    
    // If user doesn't exist, return failure immediately
    if (user == null)
    {
        return SignInStatus.Failure;
    }

    // Step 2: Check if the user is disabled
    if (!user.IsEnabled)
    {
        // Return a status your login page can handle (e.g., LockedOut or a custom status)
        return SignInStatus.LockedOut;
    }

    // Step 3: Proceed with the standard password authentication flow
    var baseResult = await base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout);
    return baseResult;
}

2. Verify IsEnabled Property Mapping #

Double-check that your ApplicationUser class and database are correctly synced:

• Ensure your ApplicationUser has the property defined:

  public class ApplicationUser : IdentityUser
  {
      public bool IsEnabled { get; set; }
      // Other custom properties...
  }
  

• If using Code First, confirm the migration for the IsEnabled field was applied correctly (it should be a bit type in SQL Server).
• Check that existing users in the database have the correct IsEnabled value (1 for enabled, 0 for disabled).

3. Handle SignInStatus Properly in Your Login Action #

Even if your overridden method returns the right status, your login controller might not be handling it correctly. Make sure you’re checking for the disabled status and displaying the appropriate error message:

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
{
    if (!ModelState.IsValid)
    {
        return View(model);
    }

    var result = await SignInManager.PasswordSignInAsync(model.UserName, model.Password, model.RememberMe, shouldLockout: false);
    switch (result)
    {
        case SignInStatus.Success:
            return RedirectToLocal(returnUrl);
        case SignInStatus.LockedOut:
            // Show a specific message for disabled accounts
            ModelState.AddModelError("", "Your account has been disabled. Please contact support.");
            return View(model);
        case SignInStatus.RequiresVerification:
            return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = model.RememberMe });
        case SignInStatus.Failure:
        default:
            ModelState.AddModelError("", "Invalid username or password.");
            return View(model);
    }
}

If you want a more explicit status (instead of reusing LockedOut), extend the SignInStatus enum:

public enum CustomSignInStatus
{
    Success,
    Failure,
    LockedOut,
    RequiresVerification,
    Disabled // New status for disabled accounts
}

Just ensure your overridden method returns this custom enum and your login action handles it.

4. Validate SignInManager Registration #

Make sure your custom SignInManager is properly registered in your Startup configuration. If ASP.NET uses the default SignInManager instead of your custom one, your overridden method won’t run at all:

// In Startup.cs
services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddUserManager<ApplicationUserManager>()
    .AddSignInManager<ApplicationSignInManager>() // Register your custom SignInManager
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();

Debugging Tips #

• Add breakpoints in your overridden PasswordSignInAsync method to check:
  • Is user being retrieved correctly?
  • What’s the value of user.IsEnabled?
  • Is the base method being called when it should be?
• Check Identity logs (if enabled) for any authentication errors that aren’t being surfaced to the user.

内容的提问来源于stack exchange，提问作者Ronkingjr