Btukfyl

I have a project at work were I need to use Google and Microsoft Account for login. So far it works as it should on local host, however SignInManager<IdentityUser>.ExternalLoginSignInAsync fails for both in the same way when deployed on the server. The user gets through the external login dialog as if it worked but fails in the callback.

The SignInResult offers no explanation other than "Failed". Note that this is first time I'm using ASP.Net Core, so I wouldn't be surprised if I missed something vital. The site doesn't use the autogenerated login pages.

public class Startup

{

    public Startup(IConfiguration configuration)

    {

        Configuration = configuration;

    }



    public IConfiguration Configuration { get; }



    public void ConfigureServices(IServiceCollection services)

    {

        services.Configure<IISOptions>(options =>

        {

            options.ForwardClientCertificate = false;

        });



        services.Configure<CookiePolicyOptions>(options =>

        {

            options.CheckConsentNeeded = context => true;

            options.MinimumSameSitePolicy = SameSiteMode.None;

        });



        services.AddAuthentication().AddGoogle(options =>

        {

            options.ClientId = Configuration["Authentication:Google:ClientId"];

            options.ClientSecret = Configuration["Authentication:Google:ClientSecret"];

        });



        services.AddAuthentication().AddMicrosoftAccount(options =>

        {

            options.ClientId = Configuration["Authentication:Microsoft:ClientId"];

            options.ClientSecret = Configuration["Authentication:Microsoft:ClientSecret"];

        });



        services.AddDbContext<ApplicationDbContext>(options => options.UseSqlServer(SqlConfigurationDatabase.Credentials));



        services.AddDefaultIdentity<IdentityUser>().AddEntityFrameworkStores<ApplicationDbContext>();



        services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);

    }



    public void Configure(IApplicationBuilder app, IHostingEnvironment env)

    {

        if (env.IsDevelopment())

        {

            app.UseDeveloperExceptionPage();

            app.UseDatabaseErrorPage();

        }

        else

        {

            app.UseExceptionHandler("/Home/Error");

            app.UseHsts();

        }



        app.UseHttpsRedirection();

        app.UseStaticFiles();

        app.UseCookiePolicy();



        app.UseAuthentication();



        app.UseMvc(routes =>

        {

            routes.MapRoute(name: "default", template: "{controller=Home}/{action=Index}/{id?}");

            routes.MapRoute(name: "add", template: "{controller=Product}/{action=Add}");

        });

    }

}

EDIT: I forgot to include the rest of login code. As for the markup:

<form asp-controller="Home" asp-action="ExternalLogin" asp-route-returnurl="@ViewData["ReturnUrl"]" method="post" target="_blank" class="form-horizontal">

@{

    foreach (var provider in await SignInManager.GetExternalAuthenticationSchemesAsync())

    {

        var name = provider.DisplayName + ".png";

        <button type="submit" name="provider" value="@provider.DisplayName" title="Log in using your @provider.DisplayName account">

            <img src="~/images/@name" />

            @provider.DisplayName

        </button>

    }

}

</form>

The Home controller is the only one that talks with the external login services.

public class HomeController : Controller

{

    private readonly UserManager<IdentityUser> users;



    private readonly SignInManager<IdentityUser> signIn;



    public HomeController(UserManager<IdentityUser> userManager, SignInManager<IdentityUser> signInManager)

    {

        users = userManager;

        signIn = signInManager;

    }



    public IActionResult Index()

    {

        if (signIn.IsSignedIn(User))

            return RedirectToLocal("/Product/Abc123");



        return View();

    }



    public IActionResult Gdpr()

    {

        return View();

    }



    [HttpPost]

    [AllowAnonymous]

    [ValidateAntiForgeryToken]

    public IActionResult ExternalLogin(string provider, string returnUrl = null)

    {

        var redirectUrl = Url.Action(nameof(ExternalLoginCallback), "Home", new { ReturnUrl = returnUrl });

        var properties = signIn.ConfigureExternalAuthenticationProperties(provider, redirectUrl);



        return Challenge(properties, provider);

    }



    [HttpGet]

    [AllowAnonymous]

    public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)

    {

        if (remoteError != null)

        {

            ModelState.AddModelError("", $"Error from external provider: {remoteError}");



            return RedirectToAction(nameof(HomeController.Index), "Home");

        }



        var info = await signIn.GetExternalLoginInfoAsync();

        if (info == null)

            return RedirectToLocal(returnUrl);



        var result = await signIn.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, isPersistent: false);

        if (result.Succeeded)

            return RedirectToLocal(returnUrl);

        else

            return RedirectToLocal(returnUrl);

    }



    private IActionResult RedirectToLocal(string returnUrl)

    {

        if (Url.IsLocalUrl(returnUrl))

            return Redirect(returnUrl);

        else

            return RedirectToAction(nameof(HomeController.Index), "Home");

    }



    [HttpPost]

    [ValidateAntiForgeryToken]

    public async Task<IActionResult> Logout()

    {

        await signIn.SignOutAsync();



        return RedirectToAction(nameof(HomeController.Index), "Home");

    }



    [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]

    public IActionResult Error()

    {

        return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });

    }

}

There is no load-balancing, clustering, web farms or any other fancy stuff going on at this time. I have basically just tweaked the example site created by Visual Studio (ASP.NET Core 2.1 Web Application with authentication set to Individual User Accounts).