Asp.Net Owin Authentication Without Entity Framework

Question

I have an existing website with 600,000+ users, my database of choice is RavenDb (NoSql).

I am currently using a simple form of Owin authentication to login a user by simply calling this on my login controller:

            var identity = new ClaimsIdentity(new[] {
                            new Claim(ClaimTypes.Sid, user.Id), 
                            new Claim(ClaimTypes.Email, viewModel.EMail),
                            new Claim(ClaimTypes.NameIdentifier, user.ArtistName) 
                        },
                        DefaultAuthenticationTypes.ApplicationCookie,
                        ClaimTypes.Sid, ClaimTypes.Role);

            Authentication.SignIn(new AuthenticationProperties
            {
                IsPersistent = viewModel.RememberMe
            }, identity);

Now i want to allow my users to login with external providers such as facebook, google etc but i don't want to use the UserManager abstraction if I don't have to.

What is the minimum I need to use to get this working? I think i need to code up the ExternalLoginCallback code etc, but pretty confused on what i actually need / don't need at this point.

Answer 1

You would have to implement the return endpoint the external provider does a POST request to, and then after you have determined you trust the claims in the post parameters, do something just like what you did in your original sign in.

The provided implementations have methods like <your-site>/signin-google as the return url to which the provider does a POST with a post parameter called something like SecureAuthenticationToken you have to parse and then trust (or not). Without going back to the docs, that is in json (JWT) or samlp format depending on the external provider and protocol.