I've had some success. I've been able to write a PasswordlessExtensionGrant : ITokenExtensionGrant that takes email and token request params, verifies the token against the user and calls:
var principal = await _signInManager.CreateUserPrincipalAsync(user);
return new SignInResult(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme, principal);
This actually returns an access token when I call from the front end:
let result = await this.authService.loginUsingGrant('passwordless-auth2', {token: token, email: email},);
{
"access_token": "...",
"token_type": "Bearer",
"expires_in": 299
}
The problem I'm left with is how I do use the access_token in the response to actually login the user in the angular app? When using a password login, it saves the access_token in the local storage (perhaps amongst other things). I haven't been able to see where in abp code it does that, to be able to mimic something similar.
My second concern is that I don't have a refresh_token, so it won't be able to periodically gain new access_tokens.
Thanks. Let me try and get back to you. Please leave this thread open til at least next weekend.
I am trying to implement a system where the user is sent a OTP to their email address that they can use to login without needing their password. This article doesn't quite follow our use case. Our solution has:
This is what I've done so far, based on the article mentioned above:
It all works up until my stage 3, including validating the OTP token and updating the user's security stamp, but the SignInManager.SignInAsync(user, isPersistent: false) call doesn't log the user into our public site (where this endpoint is being called from) according to angular AuthService.IsAuthenticated. I've also tried using other authenticationMethods, such as OidcConstants.AuthenticationMethods.OneTimePassword, but without success.
What the SignInAsync method does do is provide a Set-Cookie for .AspNetCore.Identity.Application.
Any tips on how to progress? Cheers.
My AppService (which is wrapped in a Controller with HttpPost and Route("login") attributes):
using System;
using System.Threading.Tasks;
using IdentityModel;
using MyCompany.MyProject.Email;
using Microsoft.AspNetCore.Authorization;
using OpenIddict.Abstractions;
using Volo.Abp.Application.Services;
using Volo.Abp.Domain.Entities;
using Volo.Abp.Identity;
using Volo.Abp.Identity.AspNetCore;
namespace MyCompany.MyProject.PasswordlessLogin;
public class PasswordlessLoginAppService : ApplicationService, IPasswordlessLoginAppService
{
private readonly IMyProjectAuthServerEmailManager _emailManager;
private readonly IdentityUserManager _userManager;
private readonly AbpSignInManager _signInManager;
public PasswordlessLoginAppService(IMyProjectAuthServerEmailManager emailManager,
IdentityUserManager userManager, AbpSignInManager signInManager)
{
_emailManager = emailManager;
_userManager = userManager;
_signInManager = signInManager;
}
// [AllowAnonymous]
public async Task SendOtpEmail(SendOtpEmailInputDto input)
{
var user = await _userManager.FindByEmailAsync(input.Email);
if (user is null)
{
throw new EntityNotFoundException(typeof(IdentityUser));
}
var token = await _userManager.GenerateUserTokenAsync(user, tokenProvider: "PasswordlessLoginProvider",
purpose: "passwordless-auth");
await _emailManager.SendOtpEmailAsync(new SendOtpEmailInput()
{
Email = user.Email,
Token = token,
});
}
public async Task Login(PasswordlessLoginInputDto input)
{
var user = await _userManager.FindByEmailAsync(input.Email);
if (user is null)
{
throw new EntityNotFoundException(typeof(IdentityUser));
}
var isValid = await _userManager.VerifyUserTokenAsync(user, "PasswordlessLoginProvider", "passwordless-auth", input.Token);
if (!isValid)
{
throw new UnauthorizedAccessException("The token " + input.Token + " is not valid for the user " + input.Email);
}
await _userManager.UpdateSecurityStampAsync(user);
await _signInManager.SignInAsync(user, isPersistent: false, authenticationMethod: OidcConstants.AuthenticationMethods.OneTimePassword);
}
}
OK thanks. Do you know which version this will be fixed in?
On three occasions I've experienced cases where on submission of a new ABP support question I get an error on the ABP support website. I'm sorry that I don't have a print screen or anything. I think the behaviour occurs once I raise a question, then immediately after submission click the 'Add question' or something button and raise another question rather than starting from scratch and using the top level question button. If you're unable to replicate let me know and please allow me to create a few dummy questions to see if I can diagnose the problem as it's incredibly frustrating since you lose the question that you composed! Thanks.
As a developer
I want to be able to use the record field in PropPredicate and PropCallback properties on Create forms
So that I can dynamically set, for example, the disabled property based on the value of other properties that are currently set in the create form
The syntax would remain identical to how it is now, only that it would actually work. It should be such that the documentation can be changed to say that the record field (and others?) are available on create forms (e.g. create user).
https://docs.abp.io/en/abp/latest/UI/Angular/Dynamic-Form-Extensions
For example, a new extra property that I add to the form can be disabled or enabled based on whether the user has checked IsActive or not.
https://github.com/abpframework/abp/issues/17374
Please let us know when this will be fixed + refund the question. Cheers.
Bug raised here https://support.abp.io/QA/Questions/5126/Bug---Should-change-password-on-next-login-should-enforce-password-to-be-different should have been fixed in 'the preview version for 7.3' but the issue is replicable both in v7.3.2 and the ABP commercial v7.4.0 as of 14/8/23.
Please let us know when this will be fixed + refund the question. Cheers.
Please let us know when this will be fixed + refund the question. Cheers.
Please let us know when this will be fixed + refund the question. Cheers.
