Skip to content

Commit a97478f

Browse files
Rick-AndersonRick-Anderson
authored
AccessDeniedPath (#17679)
* AccessDeniedPath * AccessDeniedPath * AccessDeniedPath * AccessDeniedPath * AccessDeniedPath
1 parent 6120e5e commit a97478f

5 files changed

Lines changed: 147 additions & 20 deletions

File tree

‎aspnetcore/security/authentication/social/facebook-logins.md‎

Lines changed: 32 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ uid: security/authentication/facebook-logins
1313

1414
By [Valeriy Novytskyy](https://github.com/01binary) and [Rick Anderson](https://twitter.com/RickAndMSFT)
1515

16+
<!-- per @rick-anderson and scott addie, don't update images. Remove images and point the customer to the FB set up page. FB needs to maintain instructions to get key and secret.
17+
-->
18+
1619
This tutorial with code examples shows how to enable your users to sign in with their Facebook account using a sample ASP.NET Core 3.0 project created on the [previous page](xref:security/authentication/social/index). We start by creating a Facebook App ID by following the [official steps](https://developers.facebook.com).
1720

1821
## Create the app in Facebook
@@ -82,35 +85,49 @@ services.AddAuthentication().AddFacebook(facebookOptions =>
8285

8386
[!INCLUDE [default settings configuration](includes/default-settings.md)]
8487

85-
[!INCLUDE[](includes/chain-auth-providers.md)]
88+
## Sign in with Facebook
8689

87-
See the [FacebookOptions](/dotnet/api/microsoft.aspnetcore.builder.facebookoptions) API reference for more information on configuration options supported by Facebook authentication. Configuration options can be used to:
90+
* Run the app and select **Log in**.
91+
* Under **Use another service to log in.**, select Facebook.
92+
* You are redirected to **Facebook** for authentication.
93+
* Enter your Facebook credentials.
94+
* You are redirected back to your site where you can set your email.
8895

89-
* Request different information about the user.
90-
* Add query string arguments to customize the login experience.
96+
You are now logged in using your Facebook credentials:
9197

92-
## Sign in with Facebook
98+
<a name="react"></a>
9399

94-
Run your application and click **Log in**. You see an option to sign in with Facebook.
100+
## React to cancel authorize external sign-in
95101

96-
![Web application: User not authenticated](index/_static/DoneFacebook.png)
102+
<xref:Microsoft.AspNetCore.Authentication.RemoteAuthenticationOptions.AccessDeniedPath> can provide a redirect path to the user agent when the user doesn't approve the requested authorization demand.
97103

98-
When you click on **Facebook**, you are redirected to Facebook for authentication:
104+
The following code sets the `AccessDeniedPath` to `"/AccessDeniedPathInfo"`:
99105

100-
![Facebook authentication page](index/_static/FBLogin.png)
106+
[!code-csharp[](~/security/authentication/social/social-code/StartupAccessDeniedPath.cs?name=snippetFB)]
101107

102-
Facebook authentication requests public profile and email address by default:
108+
We recommend the `AccessDeniedPath` page contain the following information:
103109

104-
![Facebook authentication page consent screen](index/_static/FBLoginDone.png)
110+
* Remote authentication was canceled.
111+
* This app requires authentication.
112+
* To try sign-in again, select the Login link.
105113

106-
Once you enter your Facebook credentials you are redirected back to your site where you can set your email.
114+
### Test AccessDeniedPath
107115

108-
You are now logged in using your Facebook credentials:
109-
110-
![Web application: User authenticated](index/_static/Done.png)
116+
* Navigate to [facebook.com](https://www.facebook.com/)
117+
* If you are signed in, you must sign out.
118+
* Run the app and select Facebook sign-in.
119+
* Select **Not now**. You are redirected to the specified `AccessDeniedPath` page.
111120

121+
<!-- End of React -->
112122
[!INCLUDE[Forward request information when behind a proxy or load balancer section](includes/forwarded-headers-middleware.md)]
113123

124+
[!INCLUDE[](includes/chain-auth-providers.md)]
125+
126+
See the [FacebookOptions](/dotnet/api/microsoft.aspnetcore.builder.facebookoptions) API reference for more information on configuration options supported by Facebook authentication. Configuration options can be used to:
127+
128+
* Request different information about the user.
129+
* Add query string arguments to customize the login experience.
130+
114131
## Troubleshooting
115132

116133
* **ASP.NET Core 2.x only:** If Identity isn't configured by calling `services.AddIdentity` in `ConfigureServices`, attempting to authenticate will result in *ArgumentException: The 'SignInScheme' option must be provided*. The project template used in this tutorial ensures that this is done.

‎aspnetcore/security/authentication/social/microsoft-logins.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ If you don't have a Microsoft account, select **Create one**. After signing in,
2323

2424
* Select **New registration**
2525
* Enter a **Name**.
26-
* Select an option for **Supported account types**. <!-- Accounts for any org work with MS domain accounts. Most folks probably want the last option, personal MS accounts -->
26+
* Select an option for **Supported account types**. <!-- Accounts for any org work with MS domain accounts. Most folks probably want the last option, personal MS accounts. It took 24 hours after setting this up for the keys to work -->
2727
* Under **Redirect URI**, enter your development URL with `/signin-microsoft` appended. For example, `https://localhost:5001/signin-microsoft`. The Microsoft authentication scheme configured later in this sample will automatically handle requests at `/signin-microsoft` route to implement the OAuth flow.
2828
* Select **Register**
2929

@@ -37,8 +37,7 @@ If you don't have a Microsoft account, select **Create one**. After signing in,
3737

3838
* Under **Client secrets**, copy the value of the client secret.
3939

40-
> [!NOTE]
41-
> The URI segment `/signin-microsoft` is set as the default callback of the Microsoft authentication provider. You can change the default callback URI while configuring the Microsoft authentication middleware via the inherited [RemoteAuthenticationOptions.CallbackPath](/dotnet/api/microsoft.aspnetcore.authentication.remoteauthenticationoptions.callbackpath) property of the [MicrosoftAccountOptions](/dotnet/api/microsoft.aspnetcore.authentication.microsoftaccount.microsoftaccountoptions) class.
40+
The URI segment `/signin-microsoft` is set as the default callback of the Microsoft authentication provider. You can change the default callback URI while configuring the Microsoft authentication middleware via the inherited [RemoteAuthenticationOptions.CallbackPath](/dotnet/api/microsoft.aspnetcore.authentication.remoteauthenticationoptions.callbackpath) property of the [MicrosoftAccountOptions](/dotnet/api/microsoft.aspnetcore.authentication.microsoftaccount.microsoftaccountoptions) class.
4241

4342
## Store the Microsoft client ID and secret
4443

@@ -62,8 +61,6 @@ Add the Microsoft Account service to the `Startup.ConfigureServices`:
6261
6362
[!INCLUDE [default settings configuration](includes/default-settings.md)]
6463
65-
[!INCLUDE[](includes/chain-auth-providers.md)]
66-
6764
For more information about configuration options supported by Microsoft Account authentication, see the [MicrosoftAccountOptions](/dotnet/api/microsoft.aspnetcore.builder.microsoftaccountoptions) API reference. This can be used to request different information about the user.
6865
6966
## Sign in with Microsoft Account
@@ -74,6 +71,8 @@ Tap **Yes** and you will be redirected back to the web site where you can set yo
7471
7572
You are now logged in using your Microsoft credentials:
7673
74+
[!INCLUDE[](includes/chain-auth-providers.md)]
75+
7776
[!INCLUDE[Forward request information when behind a proxy or load balancer section](includes/forwarded-headers-middleware.md)]
7877
7978
## Troubleshooting

‎aspnetcore/security/authentication/social/social-code/AccessDeniedPathInfo.cshtml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
@page
2+
@model RPgoog2.Pages.AccessDeniedPathInfoModel
3+
@{
4+
ViewData["Title"] = "AccessDeniedPathInfo";
5+
}
6+
7+
<h1>AccessDeniedPathInfo</h1>
8+
9+
<p>
10+
Remote authentication was canceled. This app requires authentication. To try again, select the Login link.
11+
</p>

‎aspnetcore/security/authentication/social/social-code/StartupAccessDeniedPath.cs‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
using Microsoft.AspNetCore.Builder;
2+
using Microsoft.AspNetCore.Hosting;
3+
using Microsoft.AspNetCore.Identity;
4+
using Microsoft.EntityFrameworkCore;
5+
using Microsoft.Extensions.Configuration;
6+
using Microsoft.Extensions.DependencyInjection;
7+
using Microsoft.Extensions.Hosting;
8+
using RPgoog2.Data;
9+
10+
namespace RPgoog2
11+
{
12+
public class StartupAccessDeniedPath
13+
{
14+
public StartupAccessDeniedPath(IConfiguration configuration)
15+
{
16+
Configuration = configuration;
17+
}
18+
19+
public IConfiguration Configuration { get; }
20+
21+
public void ConfigureServices(IServiceCollection services)
22+
{
23+
services.AddDbContext<ApplicationDbContext>(options =>
24+
options.UseSqlServer(
25+
Configuration.GetConnectionString("DefaultConnection")));
26+
services.AddDefaultIdentity<IdentityUser>(
27+
options => options.SignIn.RequireConfirmedAccount = true)
28+
.AddEntityFrameworkStores<ApplicationDbContext>();
29+
services.AddRazorPages();
30+
31+
services.AddAuthentication().AddGoogle(options =>
32+
{
33+
IConfigurationSection googleAuthNSection =
34+
Configuration.GetSection("Authentication:Google");
35+
36+
options.ClientId = googleAuthNSection["ClientId"];
37+
options.ClientSecret = googleAuthNSection["ClientSecret"];
38+
// AccessDeniedPath not supported
39+
// options.AccessDeniedPath = "/AccessDeniedPathInfo";
40+
});
41+
42+
#region snippetFB
43+
services.AddAuthentication().AddFacebook(options =>
44+
{
45+
options.AppId = Configuration["Authentication:Facebook:AppId"];
46+
options.AppSecret = Configuration["Authentication:Facebook:AppSecret"];
47+
options.AccessDeniedPath = "/AccessDeniedPathInfo";
48+
});
49+
#endregion
50+
51+
services.AddAuthentication().AddMicrosoftAccount(options =>
52+
{
53+
options.ClientId = Configuration["Authentication:Microsoft:ClientId"];
54+
options.ClientSecret = Configuration["Authentication:Microsoft:ClientSecret"];
55+
// options.AccessDeniedPath = "/AccessDeniedPathInfo";
56+
});
57+
58+
services.AddAuthentication().AddTwitter(options =>
59+
{
60+
options.ConsumerKey = Configuration["Authentication:Twitter:ConsumerAPIKey"];
61+
options.ConsumerSecret = Configuration["Authentication:Twitter:ConsumerSecret"];
62+
options.RetrieveUserDetails = true;
63+
// options.AccessDeniedPath = "/AccessDeniedPathInfo"; // Not supported
64+
});
65+
}
66+
67+
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
68+
{
69+
if (env.IsDevelopment())
70+
{
71+
app.UseDeveloperExceptionPage();
72+
app.UseDatabaseErrorPage();
73+
}
74+
else
75+
{
76+
app.UseExceptionHandler("/Error");
77+
app.UseHsts();
78+
}
79+
80+
app.UseHttpsRedirection();
81+
app.UseStaticFiles();
82+
83+
app.UseRouting();
84+
85+
app.UseAuthentication();
86+
app.UseAuthorization();
87+
88+
app.UseEndpoints(endpoints =>
89+
{
90+
endpoints.MapRazorPages();
91+
});
92+
}
93+
}
94+
}

‎aspnetcore/security/authentication/social/twitter-logins.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,12 @@ You are now logged in using your Twitter credentials:
7373
7474
[!INCLUDE[Forward request information when behind a proxy or load balancer section](includes/forwarded-headers-middleware.md)]
7575
76+
<!--
77+
### React to cancel Authorize External sign-in
78+
Twitter doesn't support AccessDeniedPath
79+
Rather in the twitter setup, you can provide an External sign-in homepage. The external sign-in homepage doesn't support localhost. Tested with https://cors3.azurewebsites.net/ and that works.
80+
-->
81+
7682
## Troubleshooting
7783
7884
* **ASP.NET Core 2.x only:** If Identity isn't configured by calling `services.AddIdentity` in `ConfigureServices`, attempting to authenticate will result in *ArgumentException: The 'SignInScheme' option must be provided*. The project template used in this sample ensures that this is done.

0 commit comments

Comments
 (0)