SignInManager::ExternalLoginSignInAsync returns IsNotAllowed for social login

Question

I am using Microsoft.NetCore.App v1.1.0 (Nov 16, 2016) and have built a standard MVC Web App to which I've added Social Login for Microsoft and Google following advice given at Microsoft Docs.

During the first login using Google (or Microsoft) it works as expected - i.e. following authentication of my Google account my WebApp presents me with a Registration webpage requiring me to provide an email address for association with my Google account and then I'm logged into my WebApp. Unfortunately, the same happens on the second login, so obviously registration fails as the email address is already in my AspNetUsers table.

I've put a break point on _signInManager.ExternalLoginSignInAsync() in AccountController::ExternalLoginCallback(). During first login it returns Result.Succeeded false, presumably because the email isn't registered. During second login it returns Result.IsNotAllowed which isn't handled by the following series of 'if' statements so gets handled by the 'else' block - same as for Result.Succeeded false.

Does anyone know what Result.IsNotAllowed means and why it is being set? Is there a workaround?

Thanks Will

Answer 1

I was just having troubles with the same thing. You probably have the following line in startup.cs:

services.AddIdentity(config => config.SignIn.RequireConfirmedEmail = true)

If you have a look at Identity source code on github you will see that IsNotAllowed is returned when email has not been confirmed yet. It does not matter if this is a third party provider or a local account. To fix this, just set EmailConfirmed = true when you create and store the ApplicationUser. In the template project that is ExternalLoginConfirmation method.

var user = new ApplicationUser { UserName = model.Email, Email = model.Email, EmailConfirmed = true};