Microsoft.AspNetCore.Identity

Provides the APIs for managing roles in a persistence store.

The type encapsulating a role.

Constructs a new instance of .

The persistence store the manager will operate over. A collection of validators for roles. The normalizer to use when normalizing role names to keys. The used to provider error messages. The logger used to log messages, warnings and errors. The accessor used to access the .

The cancellation token associated with the current HttpContext.RequestAborted or CancellationToken.None if unavailable.

Provides the APIs for managing user in a persistence store.

The type encapsulating a user.

Constructs a new instance of .

The persistence store the manager will operate over. The accessor used to access the . The password hashing implementation to use when saving passwords. A collection of to validate users against. A collection of to validate passwords against. The to use when generating index keys for users. The used to provider error messages. The used to resolve services. The logger used to log messages, warnings and errors.

The cancellation token associated with the current HttpContext.RequestAborted or CancellationToken.None if unavailable.

Contains options for the .

Gets or sets the name of the . Defaults to DataProtectorTokenProvider.

The name of the .

Gets or sets the amount of time a generated token remains valid. Defaults to 1 day.

The amount of time a generated token remains valid.

Provides protection and validation of identity tokens.

The type used to represent a user.

Initializes a new instance of the class.

The system data protection provider. The configured . The logger used to log messages, warnings and errors.

Gets the for this instance.

The for this instance.

Gets the for this instance.

The for this instance.

Gets the name of this instance.

The name of this instance.

Gets the used to log messages from the provider.

The used to log messages from the provider.

Generates a protected token for the specified as an asynchronous operation.

The purpose the token will be used for. The to retrieve user properties from. The the token will be generated from. A representing the generated token.

Validates the protected for the specified and as an asynchronous operation.

The purpose the token was be used for. The token to validate. The to retrieve user properties from. The the token was generated for. A that represents the result of the asynchronous validation, containing true if the token is valid, otherwise false.

Returns a indicating whether a token generated by this instance can be used as a Two Factor Authentication token as an asynchronous operation.

The to retrieve user properties from. The the token was generated for. A that represents the result of the asynchronous query, containing true if a token generated by this instance can be used as a Two Factor Authentication token, otherwise false. This method will always return false for instances of .

Utility extensions to streams

The response type for the "/forgotPassword" endpoint added by .

The email address to send the reset password code to if a user with that confirmed email address already exists.

Defines the source generated JSON serialization contract metadata for a given type.

The default associated with a default instance.

The source-generated options associated with this context.

The request type for the "/manage/info" endpoint added by . All properties are optional. No modifications will be made to the user if all the properties are omitted from the request.

The optional new email address for the authenticated user. This will replace the old email address if there was one. The email will not be updated until it is confirmed.

The optional new password for the authenticated user. If a new password is provided, the is required. If the user forgot the old password, use the "/forgotPassword" endpoint instead.

The old password for the authenticated user. This is only required if a is provided.

The response type for the "/manage/info" endpoints added by .

The email address associated with the authenticated user.

Indicates whether or not the has been confirmed yet.

The request type for the "/login" endpoint added by .

The user's email address which acts as a user name.

The user's password.

The optional two-factor authenticator code. This may be required for users who have enabled two-factor authentication. This is not required if a is sent.

An optional two-factor recovery code from . This is required for users who have enabled two-factor authentication but lost access to their .

The request type for the "/refresh" endpoint added by .

The from the last "/login" or "/refresh" response used to get a new with an extended expiration.

The request type for the "/register" endpoint added by .

The user's email address which acts as a user name.

The user's password.

The response type for the "/resendConfirmationEmail" endpoint added by .

The email address to resend the confirmation email to if a user with that email exists.

The response type for the "/resetPassword" endpoint added by . The "/resetPassword" endpoint requires the "/forgotPassword" endpoint to be called first to get the .

The email address for the user requesting a password reset. This should match .

The code sent to the user's email to reset the password. To get the reset code, first make a "/forgotPassword" request.

The new password the user with the given should login with. This will replace the previous password.

The request type for the "/manage/2fa" endpoint added by .

An optional to enable or disable the two-factor login requirement for the authenticated user. If null or unset, the current two-factor login requirement for the user will remain unchanged.

The two-factor code derived from the . This is only required if is set to .

An optional to reset the to a new random value if . This automatically disables the two-factor login requirement for the authenticated user until it is re-enabled by a later request.

An optional to reset the to new random values if . will be empty unless they are reset or two-factor was enabled for the first time.

An optional to clear the cookie "remember me flag" if present. This has no impact on non-cookie authentication schemes.

The response type for the "/manage/2fa" endpoint added by .

The shared key generally for TOTP authenticator apps that is usually presented to the user as a QR code.

The number of unused remaining.

The recovery codes to use if the is lost. This will be omitted from the response unless was set or two-factor was enabled for the first time.

Whether or not two-factor login is required for the current authenticated user.

Whether or not the current client has been remembered by two-factor authentication cookies. This is always for non-cookie authentication schemes.

Represents login information, source and externally source principal for a user record

Creates a new instance of

The to associate with this login. The provider associated with this login information. The unique identifier for this user provided by the login provider. The display name for the login provider.

Gets or sets the associated with this login.

The associated with this login.

The s associated with this login.

The associated with this login.

Helper functions for configuring identity services.

Adds the default token providers used to generate tokens for reset passwords, change email and change telephone number operations, and for two factor authentication token generation.

The current instance. The current instance.

Adds a for the .

The current instance. The current instance.

Adds a for the .

The type of the sign in manager to add. The current instance. The current instance.

Adds configuration and services needed to support but does not configure authentication. Call and/or to configure authentication separately.

The . The .

Represents all the options you can use to configure the cookies middleware used by the identity system.

The scheme used to identify application authentication cookies.

The scheme used to identify bearer authentication tokens.

The scheme used to identify combination of and .

The scheme used to identify external authentication cookies.

The scheme used to identify Two Factor authentication cookies for saving the Remember Me state.

The scheme used to identify Two Factor authentication cookies for round tripping user identities.

Used to configure identity cookie options.

Used to configure the application cookie.

Used to configure the external cookie.

Used to configure the two factor remember me cookie.

Used to configure the two factor user id cookie.

Helper functions for configuring identity services.

Adds cookie authentication.

The current instance. The which can be used to configure the identity cookies.

Adds the cookie authentication needed for sign in manager.

The current instance. Action used to configure the cookies. The which can be used to configure the identity cookies.

Adds the identity application cookie.

The current instance. The which can be used to configure the cookie authentication.

Adds the identity cookie used for external logins.

The current instance. The which can be used to configure the cookie authentication.

Adds the identity cookie used for two factor remember me.

The current instance. The which can be used to configure the cookie authentication.

Adds the identity cookie used for two factor logins.

The current instance. The which can be used to configure the cookie authentication.

Defines the source generated JSON serialization contract metadata for a given type.

The default associated with a default instance.

The source-generated options associated with this context.

Specifies options for passkey requirements.

Gets or sets the time that the browser should wait for the authenticator to provide a passkey.

This option applies to both creating a new passkey and requesting an existing passkey. This is treated as a hint to the browser, and the browser may choose to ignore it. The default value is 5 minutes. See and .

Gets or sets the size of the challenge in bytes sent to the client during attestation and assertion.

This option applies to both creating a new passkey and requesting an existing passkey. The default value is 32 bytes. See and .

Gets or sets the effective domain of the server. This should be unique and will be used as the identity for the server.

This option applies to both creating a new passkey and requesting an existing passkey. If left , the server's origin may be used instead. See .

Gets or sets the user verification requirement.

This option applies to both creating a new passkey and requesting an existing passkey. Possible values are "required", "preferred", and "discouraged". If set to , the effective value is "preferred". The default value is "required". See .

Gets or sets the extent to which the server desires to create a client-side discoverable credential.

This option only applies when creating a new passkey, and is not enforced on the server. Possible values are "discouraged", "preferred", "required", or . If set to , the effective value is "discouraged". The default value is "preferred". See .

Gets or sets the attestation conveyance preference.

This option only applies when creating a new passkey, and already-registered passkeys are not affected by it. To validate the attestation statement of a passkey during passkey creation, provide a value for the option. Possible values are "none", "indirect", "direct", and "enterprise". If left , the browser defaults to "none". See .

Gets or sets the allowed authenticator attachment.

This option only applies when creating a new passkey, and already-registered passkeys are not affected by it. Possible values are "platform" and "cross-platform". If left , any authenticator attachment modality is allowed. See .

Gets or sets a function that determines whether the given COSE algorithm identifier is allowed for passkey operations.

This option only applies when creating a new passkey, and already-registered passkeys are not affected by it. If left , all supported algorithms are allowed. See .

Gets or sets a function that validates the origin of the request.

This option applies to both creating a new passkey and requesting an existing passkey. If left , cross-origin requests are disallowed, and the request is only considered valid if the request's origin header matches the credential's origin.

Gets or sets a function that verifies the attestation statement of a passkey.

This option only applies when creating a new passkey, and already-registered passkeys are not affected by it. If left , this function does not perform any verification and always returns .

This API supports the ASP.NET Core Identity infrastructure and is not intended to be used as a general purpose email abstraction. It should be implemented by the application so the Identity infrastructure can send confirmation and password reset emails.

The recipient's email address. The subject of the email. The body of the email which may contain HTML tags. Do not double encode this.

The default that does nothing in . It is used to detect that the has been customized. If not, Identity UI provides a development experience where the email confirmation link is rendered by the UI immediately rather than sent via an email.

This method does nothing other return . It should be replaced by a custom implementation in production.

The user that is attempting to confirm their email. The recipient's email address. The link to follow to confirm a user's email. Do not double encode this.

The user that is attempting to reset their password. The recipient's email address. The link to follow to reset the user password. Do not double encode this.

The user that is attempting to reset their password. The recipient's email address. The code to use to reset the user password. Do not double encode this.

Represents a handler for generating passkey creation and request options and performing passkey assertion and attestation.

Generates passkey creation options for the specified user entity and HTTP context.

The passkey user entity for which to generate creation options. The HTTP context associated with the request. A representing the result.

Generates passkey request options for the specified user and HTTP context.

The user for whom to generate request options. The HTTP context associated with the request. A representing the result.

Performs passkey attestation using the provided .

The context containing necessary information for passkey attestation. A representing the result.

Performs passkey assertion using the provided .

The context containing necessary information for passkey assertion. A representing the result.

Provides an abstraction for a validating a security stamp of an incoming identity, and regenerating or rejecting the identity based on the validation result.

Validates a security stamp of an identity as an asynchronous operation, and rebuilds the identity if the validation succeeds, otherwise rejects the identity.

The context containing the and to validate. The that represents the asynchronous validation operation.

Used to validate the two factor remember client cookie security stamp.

Represents the context for passkey assertion.

Gets or sets the for the current request.

Gets or sets the credentials obtained by JSON-serializing the result of the navigator.credentials.get() JavaScript function.

Gets or sets the state to be used in the assertion procedure.

This is expected to match the previously returned from .

Represents the result of a passkey assertion operation.

Gets whether the assertion was successful.

Gets the updated passkey information when assertion succeeds.

Gets the user associated with the passkey when assertion succeeds.

Gets the error that occurred during assertion.

A factory class for creating instances of .

Creates a successful result for a passkey assertion operation.

The passkey information associated with the assertion. The user associated with the passkey. A instance representing a successful assertion.

Creates a failed result for a passkey assertion operation.

The exception that describes the reason for the failure. A instance representing the failure.

Represents the context for passkey attestation.

Gets or sets the for the current request.

Gets or sets the credentials obtained by JSON-serializing the result of the navigator.credentials.create() JavaScript function.

Gets or sets the state to be used in the attestation procedure.

This is expected to match the previously returned from .

Represents the result of a passkey attestation operation.

Gets whether the attestation was successful.

Gets the passkey information collected during attestation when successful.

Gets the user entity associated with the passkey when successful.

Gets the error that occurred during attestation.

Creates a successful result for a passkey attestation operation.

The passkey information associated with the attestation. The user entity associated with the attestation. A instance representing a successful attestation.

Creates a failed result for a passkey attestation operation.

The exception that describes the reason for the failure. A instance representing the failure.

Contains the context for passkey attestation statement verification.

See .

Gets or sets the for the current request.

Gets or sets the attestation object as a byte array.

See .

Gets or sets the hash of the client data as a byte array.

Represents the result of a passkey creation options generation.

Gets or sets the JSON representation of the creation options.

The structure of this JSON is compatible with and should be used with the navigator.credentials.create() JavaScript API.

Gets or sets the state to be used in the attestation procedure.

This can be later retrieved during assertion with .

Represents an error that occurred during passkey attestation or assertion.

Constructs a new instance.

The default passkey handler.

Constructs a new instance.

The . The .

Performs passkey attestation using the provided credential JSON and original options JSON.

The context containing necessary information for passkey attestation. A task object representing the asynchronous operation containing the .

Performs passkey assertion using the provided credential JSON, original options JSON, and optional user.

The context containing necessary information for passkey assertion. A task object representing the asynchronous operation containing the .

Contains information used for determining whether a passkey's origin is valid.

Gets or sets the HTTP context associated with the request.

Gets or sets the fully-qualified origin of the requester.

See .

Gets or sets whether the request came from a cross-origin <iframe>.

See .

Gets or sets the fully-qualified top-level origin of the requester.

See .

Represents the result of a passkey request options generation.

Gets or sets the JSON representation of the request options.

The structure of this JSON is compatible with and should be used with the navigator.credentials.get() JavaScript API.

Gets or sets the state to be used in the assertion procedure.

This can be later retrieved during assertion with .

Represents an authenticator attestation object, which contains the attestation statement and authenticator data.

See .

Gets or sets the attestation statement format.

See .

Gets or sets the attestation statement.

See .

Gets or sets the authenticator data.

See .

Represents attested credential data in an .

See .

Gets or sets the AAGUID of the authenticator that created the credential.

Gets or sets the credential ID.

Gets or sets the credential public key.

Represents the response returned by an authenticator during the assertion phase of a WebAuthn login process.

See .

Gets or sets the authenticator data.

Gets or sets the assertion signature.

Gets or sets the opaque user identifier.

Represents the response returned by an authenticator during the attestation phase of a WebAuthn registration process.

See .

Gets or sets the attestation object.

Gets or sets the strings describing which transport methods (e.g., usb, nfc) are believed to be supported with the authenticator.

May be empty or null if the information is not available.

Encodes contextual bindings made by an authenticator.

See

Gets or sets the SHA-256 hash of the Relying Party ID the credential is scoped to.

Gets or sets the flags for this authenticator data.

Gets or sets the signature counter.

Gets or sets the attested credential data.

Gets or sets the extension-defined authenticator data.

Gets whether the user is present.

Gets whether the user is verified.

Gets whether the public key credential source is backup eligible.

Gets whether the public key credential source is currently backed up.

Gets whether the authenticator data has extensions.

Gets whether the authenticator added attested credential data.

Represents flags for .

See .

Indicates that the user is present.

Indicates that the user is verified.

Indicates that the public key credential source is backup eligible.

Indicates that the public key credential source is currently backed up.

Indicates that the authenticator added attested credential data.

Indicates that the authenticator data has extensions.

Represents the base class for responses returned by an authenticator during credential creation or retrieval operations.

Gets or sets the client data passed to navigator.credentials.create() or navigator.credentials.get().

Used to specify requirements regarding authenticator attributes.

See .

Gets or sets the authenticator attachment.

See .

Gets or sets the extent to which the server desires to create a client-side discoverable credential. Supported values are "discouraged", "preferred", or "required".

See

Gets whether a resident key is required.

See .

Gets or sets the user verification requirement.

See .

Represents a base64url-encoded byte buffer for use in passkey operations.

This type is named after the JavaScript BufferSource type. When included in a JSON payload, it is serialized as a base64url-encoded string. When a member of type BufferSource is mentioned in the WebAuthn specification, this type can be used to represent it in .NET.

Gets the length of the byte buffer.

Creates a new instance of from a byte array.

Creates a new instance of from a string.

Gets the byte buffer as a .

Gets the byte buffer as a byte array.

Performs a value-based equality comparison with another instance.

Performs a value-based equality comparison between two instances.

Performs a value-based inequality comparison between two instances.

Gets the UTF-8 string representation of the byte buffer.

Represents the client data passed to navigator.credentials.get() or navigator.credentials.create().

See

Gets or sets the type of the operation that produced the client data.

Will be either "webauthn.create" or "webauthn.get".

Gets or sets the challenge provided by the relying party.

Gets or sets the fully qualified origin of the requester.

Gets or sets whether the credential creation request was initiated from a different origin than the one associated with the relying party.

Gets or sets the fully qualified top-level origin of the requester.

Gets or sets information about the state of the token binding protocol.

Represents a number identifying a cryptographic algorithm.

See .

Contains all supported public key credential parameters.

This list is sorted in the order of preference, with the most preferred algorithm first.

Gets whether the specified COSE algorithm identifier is supported.

The algorithm identifier.

A variation of that is used to read COSE keys in a CTAP2 canonical CBOR encoding form.

Represents information about a public key/private key pair.

See

Gets or sets the credential ID.

Gets the type of the public key credential.

This is always expected to have the value "public-key".

Gets the client extensions map.

Gets or sets the authenticator response.

Gets or sets a string indicating the mechanism by which the WebAuthn implementation is attached to the authenticator.

Represents options for credential creation.

See .

Gets or sets the name and identifier for the relying party requesting attestation.

Gets or sets the names and and identifier for the user account performing the registration.

Gets or sets a challenge that the authenticator signs when producing an attestation object for the newly created credential.

Gets or sets the key types and signature algorithms the relying party supports, ordered from most preferred to least preferred.

Gets or sets the time, in milliseconds, that the relying party is willing to wait for the call to complete.

Gets or sets the existing credentials mapped to the user account.

Gets or sets settings that the authenticator should satisfy when creating a new credential.

Gets or sets hints that guide the user agent in interacting with the user.

Gets or sets the attestation conveyance preference for the relying party.

Gets or sets the attestation statement format preferences of the relying party, ordered from most preferred to least preferred.

Gets or sets the client extension inputs that the relying party supports.

Identifies a specific public key credential.

See

Gets or sets the type of the public key credential.

Gets or sets the identifier of the public key credential.

Gets or sets hints as to how the client might communicate with the authenticator.

Used to supply additional parameters when creating a new credential.

See

Used to supply additional parameters when creating a new credential.

See

Gets the type of the credential.

See .

Gets or sets the cryptographic signature algorithm identifier.

See .

Represents options for requesting a credential.

See

Gets or sets the challenge that the authenticator signs when producing an assertion for the requested credential.

Gets or sets a time in milliseconds that the server is willing to wait for the call to complete.

Gets or sets the relying party identifier.

Gets or sets the credentials of the identified user account, if any.

Gets or sets the user verification requirement for the request.

Gets or sets hints that guide the user agent in interacting with the user.

Gets or sets the client extension inputs that the relying party supports.

Used to supply Relying Party attributes when creating a new credential.

See .

Gets or sets the human-palatable name for the entity.

Gets or sets the unique identifier for the replying party entity.

Used to supply additional user account attributes when creating a new credential.

See .

Gets or sets the user handle of the user account.

Gets or sets the human-palatable name for the entity.

Gets or sets the human-palatable name for the user account, intended only for display.

Contains information about the state of the token binding protocol.

See .

Gets or sets the token binding status.

Supported values are "supported", "present", and "not-supported". See .

Gets or sets the token binding ID.

See .

Represents information about the user associated with a passkey.

Gets the user ID associated with a passkey.

Gets the name of the user associated with a passkey.

Gets the display name of the user associated with a passkey.

Used to pass information during the SecurityStamp validation event.

The principal contained in the current cookie.

The new principal which should replace the current.

Provides default implementation of validation functions for security stamps.

The type encapsulating a user.

Creates a new instance of .

Used to access the . The . The system clock. The logger.

Creates a new instance of .

Used to access the . The . The logger.

The SignInManager.

The .

Gets the used to log messages.

The used to log messages.

Called when the security stamp has been verified.

The user who has been verified. The . A task.

Verifies the principal's security stamp, returns the matching user if successful

The principal to verify. The verified user or null if verification fails.

Validates a security stamp of an identity as an asynchronous operation, and rebuilds the identity if the validation succeeds, otherwise rejects the identity.

The context containing the and to validate. The that represents the asynchronous validation operation.

Static helper class used to configure a CookieAuthenticationNotifications to validate a cookie against a user's security stamp.

Validates a principal against a user's stored security stamp.

The context containing the and to validate. The that represents the asynchronous validation operation.

Used to validate the and cookies against the user's stored security stamp.

The context containing the and to validate.

Options for .

Gets or sets the after which security stamps are re-validated. Defaults to 30 minutes.

The after which security stamps are re-validated.

Invoked when the default security stamp validator replaces the user's ClaimsPrincipal in the cookie.

Gives control over the timestamps for testing purposes.

Provides the APIs for user sign in.

The type encapsulating a user.

Creates a new instance of .

An instance of used to retrieve users from and persist users. The accessor used to access the . The factory to use to create claims principals for a user. The accessor used to access the . The logger used to log messages, warnings and errors. The scheme provider that is used enumerate the authentication schemes. The used check whether a user account is confirmed.

Gets the used to log messages from the manager.

The used to log messages from the manager.

The used.

The authentication scheme to sign in with. Defaults to .

The used.

Creates a for the specified , as an asynchronous operation.

The user to create a for. The task object representing the asynchronous operation, containing the ClaimsPrincipal for the specified user.

Returns true if the principal has an identity with the application cookie identity

The instance. True if the user is logged in with identity.

Returns a flag indicating whether the specified user can sign in.

The user whose sign-in status should be returned. The task object representing the asynchronous operation, containing a flag that is true if the specified user can sign-in, otherwise false.

Signs in the specified , whilst preserving the existing AuthenticationProperties of the current signed-in user like rememberMe, as an asynchronous operation.

The user to sign-in. The task object representing the asynchronous operation.

Signs in the specified .

The user to sign-in. Flag indicating whether the sign-in cookie should persist after the browser is closed. Name of the method used to authenticate the user. The task object representing the asynchronous operation.

Signs in the specified .

The user to sign-in. Properties applied to the login and authentication cookie. Name of the method used to authenticate the user. The task object representing the asynchronous operation.

Signs in the specified .

The user to sign-in. Flag indicating whether the sign-in cookie should persist after the browser is closed. Additional claims that will be stored in the cookie. The task object representing the asynchronous operation.

Signs in the specified .

The user to sign-in. Properties applied to the login and authentication cookie. Additional claims that will be stored in the cookie. The task object representing the asynchronous operation.

Signs the current user out of the application.

Validates the security stamp for the specified against the persisted stamp for the current user, as an asynchronous operation.

The principal whose stamp should be validated. The task object representing the asynchronous operation. The task will contain the if the stamp matches the persisted value, otherwise it will return null.

Validates the security stamp for the specified from one of the two factor principals (remember client or user id) against the persisted stamp for the current user, as an asynchronous operation.

Validates the security stamp for the specified . If no user is specified, or if the store does not support security stamps, validation is considered successful.

The user whose stamp should be validated. The expected security stamp value. The result of the validation.

Attempts to sign in the specified and combination as an asynchronous operation.

The user to sign in. The password to attempt to sign in with. Flag indicating whether the sign-in cookie should persist after the browser is closed. Flag indicating if the user account should be locked if the sign in fails. The task object representing the asynchronous operation containing the for the sign-in attempt.

Attempts to sign in the specified and combination as an asynchronous operation.

The user name to sign in. The password to attempt to sign in with. Flag indicating whether the sign-in cookie should persist after the browser is closed. Flag indicating if the user account should be locked if the sign in fails. The task object representing the asynchronous operation containing the for the sign-in attempt.

Attempts a password sign in for a user.

The user to sign in. The password to attempt to sign in with. Flag indicating if the user account should be locked if the sign in fails. The task object representing the asynchronous operation containing the for the sign-in attempt.

Generates passkey creation options for the specified .

The user entity for which to create passkey options. A JSON string representing the created passkey options.

Creates passkey assertion options for the specified .

The user for whom to create passkey assertion options. A JSON string representing the created passkey assertion options.

Performs passkey attestation for the given .

The should be obtained by JSON-serializing the result of the navigator.credentials.create() JavaScript API. The argument to navigator.credentials.create() should be obtained by calling . The credentials obtained by JSON-serializing the result of the navigator.credentials.create() JavaScript function. A task object representing the asynchronous operation containing the .

Performs passkey assertion for the given .

The should be obtained by JSON-serializing the result of the navigator.credentials.get() JavaScript API. The argument to navigator.credentials.get() should be obtained by calling . Upon success, the should be stored on the using . The credentials obtained by JSON-serializing the result of the navigator.credentials.get() JavaScript function. A task object representing the asynchronous operation containing the .

Performs a passkey assertion and attempts to sign in the user.

The should be obtained by JSON-serializing the result of the navigator.credentials.get() JavaScript API. The argument to navigator.credentials.get() should be obtained by calling . The credentials obtained by JSON-serializing the result of the navigator.credentials.get() JavaScript function. The task object representing the asynchronous operation containing the for the sign-in attempt.

Returns a flag indicating if the current client browser has been remembered by two factor authentication for the user attempting to login, as an asynchronous operation.

The user attempting to login. The task object representing the asynchronous operation containing true if the browser has been remembered for the current user.

Sets a flag on the browser to indicate the user has selected "Remember this browser" for two factor authentication purposes, as an asynchronous operation.

The user who choose "remember this browser". The task object representing the asynchronous operation.

Clears the "Remember this browser flag" from the current browser, as an asynchronous operation.

The task object representing the asynchronous operation.

Signs in the user without two factor authentication using a two factor recovery code.

The two factor recovery code.

Validates the sign in code from an authenticator app and creates and signs in the user, as an asynchronous operation.

The two factor authentication code to validate. Flag indicating whether the sign-in cookie should persist after the browser is closed. Flag indicating whether the current browser should be remember, suppressing all further two factor authentication prompts. The task object representing the asynchronous operation containing the for the sign-in attempt.

Validates the two factor sign in code and creates and signs in the user, as an asynchronous operation.

The two factor authentication provider to validate the code against. The two factor authentication code to validate. Flag indicating whether the sign-in cookie should persist after the browser is closed. Flag indicating whether the current browser should be remember, suppressing all further two factor authentication prompts. The task object representing the asynchronous operation containing the for the sign-in attempt.

Gets the for the current two factor authentication login, as an asynchronous operation.

The task object representing the asynchronous operation containing the for the sign-in attempt.

Signs in a user via a previously registered third party login, as an asynchronous operation.

The login provider to use. The unique provider identifier for the user. Flag indicating whether the sign-in cookie should persist after the browser is closed. The task object representing the asynchronous operation containing the for the sign-in attempt.

Signs in a user via a previously registered third party login, as an asynchronous operation.

The login provider to use. The unique provider identifier for the user. Flag indicating whether the sign-in cookie should persist after the browser is closed. Flag indicating whether to bypass two factor authentication. The task object representing the asynchronous operation containing the for the sign-in attempt.

Gets a collection of s for the known external login providers.

A collection of s for the known external login providers.

Gets the external login information for the current login, as an asynchronous operation.

Flag indication whether a Cross Site Request Forgery token was expected in the current request. The task object representing the asynchronous operation containing the for the sign-in attempt.

Stores any authentication tokens found in the external authentication cookie into the associated user.

The information from the external login provider. The that represents the asynchronous operation, containing the of the operation.

Configures the redirect URL and user identifier for the specified external login .

The provider to configure. The external login URL users should be redirected to during the login flow. The current user's identifier, which will be used to provide CSRF protection. A configured .

Creates a claims principal for the specified 2fa information.

The user whose is logging in via 2fa. The 2fa provider. A containing the user 2fa information.

Check if the has two factor enabled.

The task object representing the asynchronous operation containing true if the user has two factor enabled.

Signs in the specified if is set to false. Otherwise stores the for use after a two factor check.

Flag indicating whether the sign-in cookie should persist after the browser is closed. The login provider to use. Default is null Flag indicating whether to bypass two factor authentication. Default is false Returns a

Used to determine if a user is considered locked out.

The user. Whether a user is considered locked out.

Returns a locked out SignInResult.

The user. A locked out SignInResult

Used to ensure that a user is allowed to sign in.

The user Null if the user should be allowed to sign in, otherwise the SignInResult why they should be denied.

Used to reset a user's lockout count.

The user The that represents the asynchronous operation, containing the of the operation.

Responsible for validation of two factor identity cookie security stamp.

The type encapsulating a user.

Creates a new instance of .

Used to access the . The . The system clock. The logger.

Creates a new instance of .

Used to access the . The . The logger.

Verifies the principal's security stamp, returns the matching user if successful

The principal to verify. The verified user or null if verification fails.

Called when the security stamp has been verified.

The user who has been verified. The . A task.

Type {0} must derive from {1}<{2}>.

The provided PasswordHasherCompatibilityMode is invalid.

The iteration count must be a positive integer.

Provides extension methods for to add identity endpoints.

Add endpoints for registering, logging in, and logging out using ASP.NET Core Identity.

The type describing the user. This should match the generic parameter in . The to add the identity endpoints to. Call to add a prefix to all the endpoints. An to further customize the added endpoints.

Provides access to the normal system clock with precision in seconds.

Contains extension methods to for configuring identity services.

Adds the default identity system configuration for the specified User and Role types.

The type representing a User in the system. The type representing a Role in the system. The services available in the application. An for creating and configuring the identity system.

Adds and configures the identity system for the specified User and Role types.

The type representing a User in the system. The type representing a Role in the system. The services available in the application. An action to configure the . An for creating and configuring the identity system.

Adds a set of common identity services to the application to support and configures authentication to support identity bearer tokens and cookies.

The . The .

Adds a set of common identity services to the application to support and configures authentication to support identity bearer tokens and cookies.

The . Configures the . The .

Configures the application cookie.

The services available in the application. An action to configure the . The services.

Configure the external cookie.

The services available in the application. An action to configure the . The services.