MVC 5 Identity (v2) Authentication Without Creating an Application User

Question

Is there a way to authenticate a session without creating an ApplicationUser in MVC 5 identity?

For various reasons, I ended up using a two layered authentication system. I parse a "user" object from my custom db into session, and in various places all over the site, the existence of this object is how the logged-in status of a user is determined.

I use Identity user stuff (e.g. claims, logins, etc.) at various places of the site. But at this one specific instance, I need to log in an anonymous Identity user and parse whatever user object is requested to the session. So how can I create an anonymously authenticated session with Identity V2?

Sam FarajpourGhamari · Accepted Answer · 2015-10-06 13:54:27Z

1

In Identity you don't need to have user object to authenticate. You could create some claims on the fly and use them to authenticate. Consider this simple example:

[HttpPost]
public ActionResult AnonymousLogin()
{
    var ident = new ClaimsIdentity(
        new[] 
        {
            // adding following 2 claim just for supporting default antiforgery provider
            new Claim(ClaimTypes.NameIdentifier, "AnonymousUserID"),
            new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity", "http://www.w3.org/2001/XMLSchema#string"),

            new Claim(ClaimTypes.Name, "AnonymousUserID"),
         },
         DefaultAuthenticationTypes.ApplicationCookie);

    HttpContext.GetOwinContext().Authentication.SignIn(
       new AuthenticationProperties { IsPersistent = false }, ident);
    return RedirectToAction("MyAction"); // auth succeed 
}

Now you have authenticated an anonymous user just like a real user:

[Authorize]
public ActionResult MyAction()
{
    // all authorized users could use this method don't matter how have been authenticated
    // you have access current user principal
    var username=HttpContext.User.Identity.Name;
}

edited Oct 6, 2015 at 13:54

answered Oct 6, 2015 at 12:47

Sam FarajpourGhamari

14.8k4 gold badges57 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

A. Burak Erbora Over a year ago

Awesome, exactly what I needed to know. I can't get rid of a user object in the session because I'm working on a site that already uses this, but I layered my approach to separate this object from Identity. Thanks a lot this indeed helped.

Christophe Gigax Over a year ago

Thanks guys ! About your solution, this means you have to reference OWIN in your project ?

Collectives™ on Stack Overflow

MVC 5 Identity (v2) Authentication Without Creating an Application User

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related