BROKEN? ASP.Net Core Identity User login being based on NormalizedUserName DB field and not NormalizedEmail

[EdwardL75]

Recently I noticed with my WebAPI I am creating based on generic template for 'Individual Account' setup, that upon trying to re-log a registered user back in even though the login page/view requestes the user's email, it is actually taking that INPUT and comparing against NormalizedUserName in the DB. This I verified by changing the UserName fields in the DB and commenting out the [EmailAddress] datatype requirement for email in the LoginViewModel.cs file.

My question: 1) is this something that was recently broken or always been there? 2) How can I correct this to verify against the NormalizedEmail value?

The point of this is that I offer a user the ability to input a UserName upon registering. This is done by adding the property in the RegisterViewModel.cs, label/input in the Register.cshtml and in the controller changing the line (#108) inside the async Task<IActionResult> Register

var user = new ApplicationUser { UserName = model.Email, Email = model.Email };
to
var user = new ApplicationUser { UserName = model.UserName, Email = model.Email };

This is what is installed

Microsoft Visual Studio Community 2015 Version 14.0.25431.01 Update 3
Microsoft .NET Framework Version 4.6.01586
ASP.NET and Web Tools 2015.1
ASP.NET Web Frameworks and Tools 2012.2
ASP.NET Web Frameworks and Tools 2013
Microsoft .NET Core Tools (Preview 2)
NuGet Package Manager 3.5.0
SQL Server Data Tools 14.0.60519.0

[ajcvickers]

@HaoK Can you take a look at this?

[HaoK]

This is by design, the APIs that verify passwords are always using the user name field, the individual auth template happens to use the email as the user name, but they are distinct fields.

[EdwardL75]

@HaoK So if I give the user the ability to specify their username at registration, where I make the change in the viewmodel will that break any abilities at external logins?

[HaoK]

I'm not sure exactly what you are asking, but identity checks the username against the password, if you wish to use email as the primary identifier, you can still do that, and do a lookup for the user based on Email to get the username and pass that into the login API that expects username + pwd

[EdwardL75]

@HaoK You state that APIs use UserName/Password authentication. If I change how the default Individual Auth template is setup to allow a user to provide their own UserName that is different than that of their email, placing in the corresponding fields within the DB AspNetUser table, will the APIs still recognize who is attempting to login from the external social site credentials. Or are they expecting a UserName that is an email?

[HaoK]

Identity uses the UserId for foreign keys in general, so external logins should be fine.