Use mixed authentication with Asp.Net MVC (Forms, FB connect, twitter, openId)

Question

I'm creating a new site and I want the users to be able to use several ways to sign in, basically the users should be able to create a new user on my site OR use Facebook connect OR use Twitter's account to log into the site.

I have seen several tutorials on using one of these methods, what I want to know is what do you think is the best approach to do this?

So far I think the best way would be to create a custom Authentication model (something like subtyping the existing authorization classes).

Is this the best approach? Can you point me to a good example of someone trying something similar?

Thanks a lot

Answer 1

I blogged about something similar recently...Here's the approach I took

public class User {
    public int UserID { get; set; }
    public string Name { get; set; }
    public string Page { get; set; }

    public virtual Authentication Authentication { get; set; }
}

public class Authentication {
    public int Id { get; set; }
    public string LoginId { get; set; }
    public string Provider { get; set; }
    public string Password { get; set; }

    public virtual User User { get; set; }
}

//login methods
User StandardUserLogin(string username) {
    IDataContext db = new DataContext();
    var user = db.Users.SingleOrDefault(u => u.Authentication.LoginId == username);
    if (user != null) {
        if (user.Authentication.Password == password) {
            SetAuthenticationTicket(user);
            return user;
        }
    }
}

I would create a different login method for each type of login depending on how their authorization schemes work.

User OpenIdUserLogin(string username) {
    IDataContext db = new DataContext();
    var user = db.Users.SingleOrDefault(u => u.Authentication.LoginId == username && u.Authentication.Provider == "openid");
    if (user == null) {
        //create new openid user
    }

    if (user.Authentication.LoginId == id) {
        SetAuthenticationTicket(user);
        return user;
        }
}

//openid's authentication method
[ValidateInput(false)]
public ActionResult Authenticate(string returnUrl) {
    IAuthenticationResponse response = OpenId.GetResponse();

    if (response == null) {
        //make openid request here
    } else {
        var user = OpenIdUserLogin(response.ClaimedIdentifier);
    }
}

Btw, the two classes at the top represent my Entity Framework POCOs The key here is the Authentication Table which is separate from the user table. It allows one user to have multiple methods of signing in. Hope this helps you get you on track.

Answer 2

If you're open to spending a few bucks per month the Windows Azure Access Control Service provides this functionality as a drop-in membership provider for ASP.NET. This is also the basis for the new Windows 8 SSO credential flow.

Note that Twitter is not yet supported, however, because Access Control doesn't support OAuth 1.0.