I want to implement email confirmation with digit code for my .net core web app. I make use of the GenerateEmailConfirmationTokenAsync from the UserManager class, but it returns a token instead of a digit code. I think I should create a custom implementation using the IUserTokenProvider interface, but I cant find any example.
How can I implement this using the IUserTokenProvider?
There is an existing implementation in ASP.NET Core Identity that does that.
The TotpSecurityStampBasedTokenProvider class (implementation of IUserTwoFactorTokenProvider interface) generates 6-digit tokens that expire.
TotpSecurityStampBasedTokenProvider is further inherited by EmailTokenProvider, but GenerateAsync method is reused from TotpSecurityStampBasedTokenProvider (not overridden).
These classes use user's security stamp to generate tokens, and provide their own modifiers, but the actual token generation is done by GenerateCode method from Rfc6238AuthenticationService class.
So, you can use the existing implementations:
TotpSecurityStampBasedTokenProviderEmailTokenProvider (it does the same as the above one)Rfc6238AuthenticationService if you really want to customize the token
You use that token to generate a action callback url
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Register(RegisterViewModel model)
{
if (ModelState.IsValid)
{
var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
var result = await UserManager.CreateAsync(user, model.Password);
if (result.Succeeded)
{
var code = await UserManager.GenerateEmailConfirmationTokenAsync(user.Id);
var callbackUrl = Url.Action(
"ConfirmEmail", "Account",
new { userId = user.Id, code = code },
protocol: Request.Url.Scheme);
await UserManager.SendEmailAsync(user.Id,
"Confirm your account",
"Please confirm your account by clicking this link: <a href=\""
+ callbackUrl + "\">link</a>");
// ViewBag.Link = callbackUrl; // Used only for initial demo.
return View("DisplayEmail");
}
AddErrors(result);
}
// If we got this far, something failed, redisplay form
return View(model);
}
To build on Marko's answer;
We also have to tell Identity what token providers we want to use for the different kinds of tokens to make the UserManager-convenience methods like GenerateEmailConfirmationTokenAsync() or ConfirmEmailAsync() use a specific provider.
We do this by configuring the identity TokenOptions:
builder.Services.Configure<IdentityOptions>(options =>
{
// Token settings.
options.Tokens.EmailConfirmationTokenProvider = "MyCustomEmailTokenProvider";
...
});
Or together when registering the new provider using the fluent API:
services.AddDefaultIdentity<ApplicationUser>(options =>
{
options.Tokens.EmailConfirmationTokenProvider = "MyCustomEmailTokenProvider"
})
.AddTokenProvider<MyCustomEmailConfirmationTokenProvider>("MyCustomEmailTokenProvider");
The implementations Marko mentions and a few more providers gets added by default by .AddDefaultTokenProviders() that can be used without registering any additional providers by using their names:
TokenOptions.DefaultProvider, uses DataProtectorTokenProvider (the default provider used when no explicit configuration existTokenOptions.DefaultEmailProvider uses EmailTokenProviderTokenOptions.DefaultPhoneProvider uses PhoneNumberTokenProviderTokenOptions.DefaultAuthenticatorProvider uses AuthenticatorTokenProviderFor those folks who have read the replies (above) and are scratching their heads, I've thought I'd step through a solution.
I used the code from jmichas (see above) which worked "out of the box" in a .net.core project.
I was using the default email token provider that returns a URL. There are lots of tuts out there advocating this method, but its main drawback is that it create an orphaned browser window. It also doesn't play well with a PWA work flow.
Step one, add your new classes from the link above. There was already a directory called TokenProvider in my project, so I created them in there.
Copy across the code from the url (above)
Step two, find your startup.cs file and I commented out the existing provider
// options.Tokens.EmailConfirmationTokenProvider = "emailconf";
// .AddTokenProvider<EmailConfirmationTokenProvider<ApplicationUser>>("emailconf")
And added the new ones...
options.Tokens.ChangePhoneNumberTokenProvider = FourDigitTokenProvider.FourDigitPhone;
options.Tokens.EmailConfirmationTokenProvider = FourDigitTokenProvider.FourDigitEmail;
.AddTokenProvider<FourDigitTokenProvider>(FourDigitTokenProvider.FourDigitEmail)
.AddTokenProvider<FourDigitTokenProvider>(FourDigitTokenProvider.FourDigitPhone)
Build and check it compiles.
Step three, I was using the default MVC controller to handle the validation. We don't really need this any more so I just created a new endpoint to handle the validation from my site. Something like this:
[Produces("application/json")]
[HttpGet]
[Route("validateemailtoken/{token}/{email}")]
public async Task<IActionResult> ValidateEmailToken(string token, string email)
{
var user = await _userManager.FindByEmailAsync(email);
if (user != null)
{
if (user.EmailConfirmed)
{
return Ok(false);
}
var result = await _userManager.ConfirmEmailAsync(user, token);
if (result.Succeeded)
{
user.IsEnabled = true;
await _userManager.UpdateAsync(user);
return Ok(result.Succeeded);
} else
{
return Ok(false);
}
}
return BadRequest();
}
Step four, Ok, your user now will get an email with a four digit code, so you'll need your front end to input that code into your site (where they have been waiting for the email).
Grab the four digits and send it to your token server, so something like this...
GET http://localhost:xxxx/api/account/validateemailtoken/xxxx/[email protected]
It will return true if the user has been validated. You can log them in from there.
I hope all this helps.