How do I manually "log a user in" using WebSecurity + SimpleMembership?

Question

I'd like to use WebSecurity+SimpleMembership, but implement the ability to (optionally) login users via a custom/alternative authentication method.

WebSecurity.Login only has one method signature, which requires both a username and a password. I'd like to skip the password check, e.g.:

if (MyCustomAuthenticationMethod.Authenticate(username, customData)) {
    WebSecurity.Login(username); // Login without password check, method doesn't exist though
}

I assume custom-auth-methods are possible given OAuthWebSecurity exists, but I'm not sure how to go about implementing my own.

score 8 · Accepted Answer · edited May 23 '17 at 12:10

8

Well, you could simply go back to root of authentication and call directly

FormsAuthentication.SetAuthCookie

This will create cookie and authenticate your user. See Asp.net Memebership Authorization without password

edited May 23 '17 at 12:10

Community

1
1

answered Oct 22 '13 at 08:14

Kek

3,145
2
20
26

FINALLY! -- This works like a charm, thank you so much! – BrainSlugs83 Apr 06 '17 at 22:09
2

It does log the user in, in terms of browser, but it does not change WebSecurity.CurrentId – Ariel Kruger May 11 '17 at 20:07

score 1 · Answer 2 · answered Apr 02 '13 at 09:29

They didn't make it easy to login without a password. One method could be to make your own custom OAuth plug-in and simply call it with your own token like this:

OAuthWebSecurity.Login("google", "token", true);

You can find here how to create a custom OAuth provider: http://www.codeguru.com/columns/experts/implementing-oauth-features-in-asp.net-mvc-4.htm

And you can browse the code here: https://github.com/ASP-NET-MVC/aspnetwebstack/blob/master/src/Microsoft.Web.WebPages.OAuth/OAuthWebSecurity.cs

Here is a snippet from OAuthWebSecurity.cs file that shows the internals of how to user is authenticated without password:

 internal static bool LoginCore(HttpContextBase context, string providerName, string providerUserId, bool createPersistentCookie)
    {
        var provider = GetOAuthClient(providerName);
        var securityManager = new OpenAuthSecurityManager(context, provider, OAuthDataProvider);
        return securityManager.Login(providerUserId, createPersistentCookie);
    }

Perhaps someone out there already made this plugin.

How do I manually "log a user in" using WebSecurity + SimpleMembership?

2 Answers2

Linked