[Upgrade to .Net7] SecurityStampValidator<TUser> forces signout of TwoFactorRememberMeScheme which leads to InvalidOperationException in case scheme is not registered

[plachor]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Hi, in my project I'm relaying on AddIdentityCore followed by checrrypicked registrations like AddSignInManager and etc. It allows me to setup minimal Identity for my project. I do not want roles nor I do not want default authentication schemes.

Till now I have not yet invested in MFA or 2FA as most of users of this product are authenticated through external authentication scheme (which supports MFA).

So I have custom authentication schemes. (OpenIdConnect, Cookie and External for SSO). However I do not have TwoFactorRememberMeScheme as I do not use it. I've tried to bump my project to .NET7 from .NET6. However it turns out that in .NET7 default SecurityStampValidator<TUser> is forcing sign-out of TwoFactorRememberMeScheme scheme.

This ends with InvalidOperationException as there is no handler registered for that scheme. Check: https://github.com/dotnet/aspnetcore/blob/main/src/Identity/Core/src/SecurityStampValidator.cs#L137

Expected Behavior

Since you allow minimal setup as AddIdentityCore is public and not obsolete than perhaps you should not enforce some hard-coded scheme sign-out. in default implementation of SecurityStampValidator

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

7.0.201

Anything else?

No response

[ghost]

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[jorrit]

This addition seems to work, I hope it is an OK workaround.

            // Workaround for https://github.com/dotnet/aspnetcore/issues/47368
            .AddCookie(IdentityConstants.TwoFactorRememberMeScheme);

I think the SecurityStampValidator should check if the scheme is registered before invoking the signout method. It seems that IAuthenticationSchemeProvider provides this.

[halter73]

I think the SecurityStampValidator should check if the scheme is registered before invoking the signout method. It seems that IAuthenticationSchemeProvider provides this.

This sounds right to me too. We've already started doing this in SignInManager starting in .NET 8 so it can support MapIdentityApi<TUser>().

aspnetcore/src/Identity/Core/src/SignInManager.cs

Lines 431 to 433 in 00e3aaa

	public virtual async Task<bool> IsTwoFactorClientRememberedAsync(TUser user)
	{
	if (await _schemes.GetSchemeAsync(IdentityConstants.TwoFactorRememberMeScheme) == null)