Class ExternalLoginProvisioningService<TUser>

Namespace

Stratara.Identity.AspNetCore.Services

Assembly

Stratara.Identity.AspNetCore.dll

Just-in-time provisioning for external (OpenID Connect) sign-ins: on a first external sign-in it creates a local ASP.NET Identity account and links the external login, or links to an existing account — enforcing the security invariants as hard defaults.

public sealed class ExternalLoginProvisioningService<TUser> where TUser : IdentityUser, new()

Type Parameters

TUser

The host's ASP.NET Identity user entity.

Inheritance

object

ExternalLoginProvisioningService<TUser>

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

This is a channel-agnostic callable service; the sign-in callback endpoint that invokes it stays in the consumer app. The invariants it enforces: link on the issuer's (provider, sub), never on email; auto-link to a pre-existing account only when the email is verified by the provider and confirmed locally (otherwise RequiresInteractiveLinking, never a silent merge); honor the invitation gate and the auto-provision switch; and fail closed whenever a check cannot be satisfied.

Constructors

ExternalLoginProvisioningService(UserManager<TUser>, IOptions<ExternalLoginProvisioningOptions>, ILogger<ExternalLoginProvisioningService<TUser>>)

Just-in-time provisioning for external (OpenID Connect) sign-ins: on a first external sign-in it creates a local ASP.NET Identity account and links the external login, or links to an existing account — enforcing the security invariants as hard defaults.

public ExternalLoginProvisioningService(UserManager<TUser> userManager, IOptions<ExternalLoginProvisioningOptions> options, ILogger<ExternalLoginProvisioningService<TUser>> logger)

Parameters

userManager UserManager<TUser>

The ASP.NET Identity user manager backing local accounts.

options IOptions<ExternalLoginProvisioningOptions>

The provisioning options (security invariants).

logger ILogger<ExternalLoginProvisioningService<TUser>>

The logger for provisioning outcomes.

Remarks

This is a channel-agnostic callable service; the sign-in callback endpoint that invokes it stays in the consumer app. The invariants it enforces: link on the issuer's (provider, sub), never on email; auto-link to a pre-existing account only when the email is verified by the provider and confirmed locally (otherwise RequiresInteractiveLinking, never a silent merge); honor the invitation gate and the auto-provision switch; and fail closed whenever a check cannot be satisfied.

Methods

ProvisionAsync(ExternalLoginInfo, CancellationToken)

Resolves the local account for an external sign-in, provisioning or linking as policy allows.

public Task<ExternalLoginProvisioningResult<TUser>> ProvisionAsync(ExternalLoginInfo loginInfo, CancellationToken cancellationToken = default)

Parameters

loginInfo ExternalLoginInfo

The external login info from SignInManager.GetExternalLoginInfoAsync().

cancellationToken CancellationToken

A token to observe for cancellation.

Returns

Task<ExternalLoginProvisioningResult<TUser>>

The provisioning outcome and, when available, the resolved local account.

Exceptions

ArgumentNullException

loginInfo is null.