Tukukkk

I would like to implement the following flow for two factor authentication in asp.net mvc:

var res = sign.PasswordSignIn("myusername", "mypassword", false, false);

if(res == SignInStatus.RequiresVerification)

   sign.SendTwoFactorCode("EmailCode");

However I'm finding that the SendTwoFactorCode function is returning false and not sending the email because internally it is checking if the user is verified. See this line in the source. If I make a second request the call to SendTwoFactorCode works as I'm expecting.

Is there a way to make SendTwoFactorCode work correctly immediately after a call to PasswordSignIn?

Is there a way to make SendTwoFactorCode work correctly immediately after a call to PasswordSignIn?

Short answer: No

Suggested alternative:

The flow usually suggested in documentation is

1. Authenticate user via username and password.


2. If valid user and password, and requires additional verification because 2FA is enabled then redirect to the page to Send the code.


3. If user initiates the sending of the code, the code is sent and the user is then redirected to the verification page.

The second step is usually to confirm a provider, if there are multiple (ie SMS, email,...etc), to use for 2nd factor verification.

For example, the following does the redirect on RequiresVerification result

Account/Login

//...



var result = await signInManager.PasswordSignInAsync(username, password, false, false);

switch (result) {

    case SignInStatus.Success:

        return RedirectToLocal(returnUrl);

    case SignInStatus.LockedOut:

        return View("Lockout");

    case SignInStatus.RequiresVerification:

        return RedirectToAction("VerifyCode", new { ReturnUrl = returnUrl });

    case SignInStatus.Failure:

    default:

        ModelState.AddModelError("", "Invalid login attempt.");

        return View(model);

}

But since you have already determined that you are going to send the code via email then you can skip the second step and redirect directly to the verify code which can be where the code is sent and verified.

Account/VerifyCode

[AllowAnonymous]

public async Task<ActionResult> VerifyCode(string returnUrl) {

    var provider = "EmailCode";

    // Require that the user has already logged in via username/password

    var userId = await signInManager.GetVerifiedUserIdAsync();

    if (userId == null) {

        return View("Error");

    }

    // Generate the token and send it

    if(!await signInManager.SendTwoFactorCodeAsync(provider)) {

        return View("Error");

    }



    var model = new VerifyCodeViewModel { 

        ReturnUrl = returnUrl

    };



    return View(model);

}



[HttpPost]

[AllowAnonymous]

[ValidateAntiForgeryToken]

public async Task<ActionResult> VerifyCode(VerifyCodeViewModel model) {

    var provider = "EmailCode";

    if (!ModelState.IsValid) {

        return View(model);

    }



    var result = await signInManager.TwoFactorSignInAsync(provider, model.Code, false, false);

    switch (result) {

        case SignInStatus.Success:

            return RedirectToLocal(returnUrl);

        case SignInStatus.LockedOut:

            return View("Lockout");

        case SignInStatus.RequiresVerification:

            return RedirectToAction("VerifyCode", new { ReturnUrl = returnUrl });

        case SignInStatus.Failure:

        default:

            ModelState.AddModelError("", "Invalid login attempt.");

            return View(model);

    }

}

This should allow the TwoFactorCookie to be included in the next request so that GetVerifiedUserIdAsync behaves as expected.

/// <summary>

/// Get the user id that has been verified already or null.

/// </summary>

/// <returns></returns>

public async Task<TKey> GetVerifiedUserIdAsync()

{

    var result = await AuthenticationManager.AuthenticateAsync(DefaultAuthenticationTypes.TwoFactorCookie).WithCurrentCulture();

    if (result != null && result.Identity != null && !String.IsNullOrEmpty(result.Identity.GetUserId()))

    {

        return ConvertIdFromString(result.Identity.GetUserId());

    }

    return default(TKey);

}

Source

Just like when you indicated

If I make a second request the call to SendTwoFactorCode works as I'm expecting.

That second request is important as it will include the cookie set in the previous request.

Reference How SignInManager checks for 2FA requirement