IsTfaEnabled

[cheng93]

https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/SignInManager.cs#L765

Any reason why this is private? Could it be made protected?

Use case is I want to override methods that calls it, however as it's private, I have no access

[captainsafia]

Triage: It looks like the link that you pasted might be incorrect. Can you clarify what property/method you are wanting to make protected and why?

I assume that you are referring to https://source.dot.net/#Microsoft.AspNetCore.Identity/SignInManager.cs,744.

If so, a PR is welcome.

[ghost]

Hi @cheng93. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

[cheng93]

Yes it is, looks like some code was committed which shifted it.

Will create a PR

[cheng93]

Summary

Change accessibility of IsTfaEnabled in SignInManager

Motivation and goals

- private async Task<bool> IsTfaEnabled(TUser user) {}
+ public async Task<bool> IsTwoFactorEnabled(TUser user) {}

In scope

• Overriding methods that depend on IsTwoFactorEnabled will not be able to call it due to it being private, such as TwoFactorAuthenticatorSignInAsync
• May want to check explicitly where IsTwoFactorEnabled for a user in a controller/service

Out of scope

Scenarios you explicitly want to exclude.

Risks / unknowns

How might developers misinterpret/misuse this? How might implementing it restrict us from other enhancements in the future? Also list any perf/security/correctness concerns.

Examples

// overriding
public override async Task<SignInResult> TwoFactorAuthenticatorSignInAsync(string code, bool isPersistent, bool rememberClient)
{
    var user = GetUser()
    if (IsTwoFactorEnabled(user)) // here it is called
    {
    }  
}

// publicly used
public async Task<IActionResult> OnGet()
{
    var user = GetUser();
    if (!await signInManager.IsTwoFactorEnabled(user))
    {
        return RedirectToSetupTwoFactor()
    }
}

[HaoK]

So if we are going to make this public, it probably should be a spelled out i.e. IsTwoFactorEnabledAsync(TUser)

[ghost]

Thanks for contacting us.

We're moving this issue to the .NET 8 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

[cheng93]

I can submit PR if given the green light :)

[HaoK]

Sure submit a PR and I'll review it

[ghost]

Thank you for submitting this for API review. This will be reviewed by @dotnet/aspnet-api-review at the next meeting of the ASP.NET Core API Review group. Please ensure you take a look at the API review process documentation and ensure that:

• The PR contains changes to the reference-assembly that describe the API change. Or, you have included a snippet of reference-assembly-style code that illustrates the API change.
• The PR describes the impact to users, both positive (useful new APIs) and negative (breaking changes).
• Someone is assigned to "champion" this change in the meeting, and they understand the impact and design of the change.

[captainsafia]

I updated the API issue comment and added the label so we can review this while the PR comes in.

[halter73]

API Review Notes:

• Could this API be protected instead of public? Public usage is demonstrated in the example, so it looks like yes.
• Does this support more than two factors? Should it be called IsMultiFactorEnabledAsync? No. TwoFactor is already used in other APIs, so let's stick with that.
• Edit: I copied the wrong method name. We definitely want to suffix it with "Async".

API Approved!

namespace Microsoft.AspNetCore.Identity;

public class SignInManager<TUser> where TUser : class
{
-     private async Task<bool> IsTfaEnabled(TUser user) {}
+     public virtual async Task<bool> IsTwoFactorEnabledAsync(TUser user) {}
}