允许电子邮件和用户名进行身份验证答案

【问题标题】：Allowing both email and username for authentication允许电子邮件和用户名进行身份验证
【发布时间】：2016-01-25 02:23:11
【问题描述】：

我正在使用 ASP.Net Identity 2.1 创建两个项目（MVC 5 和 Web API），但我找不到如何同时使用电子邮件和用户名进行身份验证（名为 Admin 的区域必须使用用户名和公共区域必须使用电子邮件地址进行身份验证）。

问题是只有一种身份验证方法，它不允许您指定是否将与电子邮件地址或用户名进行比较。

SignInHelper.PasswordSignIn

我应该怎么做才能做到这一点？

【问题讨论】：

标签： asp.net-identity-2

【解决方案1】：

SignInManager 你不会帮忙，你需要使用UserManager 和更多的玩转（这是技术术语！）：

这就是我在这个场景中所拥有的：

var unauthUserByUsername = await userManager.FindByNameAsync(command.UserName);
var unauthUserByEmail = await userManager.FindByEmailAsync(command.UserName);

var unauthenticatedUser = unauthUserByUsername ?? unauthUserByEmail;
if (unauthenticatedUser == null)
{
    logger.Warn("User {0} is trying to login but username is not correct", command.UserName);
    return View(); // stop processing
}

var loggedInUser = await userManager.FindAsync(unauthenticatedUser.UserName, command.Password);
if (loggedInUser == null)
{
    // username is correct, but password is not correct
    logger.Warn("User {0} is trying to login with incorrect password", command.UserName);
    await userManager.AccessFailedAsync(unauthenticatedUser.Id);
    return View(); // stop processing
}

// Ok, from now on we have user who provided correct username and password.

// and because correct username/password was given, we reset count for incorrect logins.
await userManager.ResetAccessFailedCountAsync(loggedInUser.Id);

if (!loggedInUser.EmailConfirmed)
{
    logger.Warn("User {0} is trying to login, entering correct login details, but email is not confirmed yet.", command.UserName);
    return View("Please confirm your email"); // stop processing
}

if (await userManager.IsLockedOutAsync(loggedInUser.Id))
{
    // when user is locked, but provide correct credentials, show them the lockout message
    logger.Warn("User {0} is locked out and trying to login", command.UserName);
    return View("Your account is locked");
}

logger.Info("User {0} is logged in", loggedInUser.UserName);

// actually sign-in.
var authenticationManager = HttpContext.Current.GetOwinContext().Authentication;
await userManager.SignInAsync(authenticationManager, loggedInUser, false);

这将检查用户是否已确认电子邮件、用户是否被锁定并在尝试一定次数后确实将用户锁定（假设所有其他锁定设置都已启用）。

【讨论】：

【解决方案2】：

这种方式都允许

  var userEmail = await UserManager.FindByEmailAsync(model.Login);

            if (userEmail == null)
            {
                var user = await UserManager.FindByNameAsync(model.Login);
                if (user == null)
                {
                    model.Login = "";
                }

            }
            else
            {
                model.Login = userEmail.UserName;
            }

var result = await SignInManager.PasswordSignInAsync(model.Login, model.Password, model.RememberMe, shouldLockout: false);

【讨论】：