I have been using ASP.NET Identity 2.2.1. Following is the code in post method of VerifyCode action.
var result = await SignInManager.TwoFactorSignInAsync(model.Provider, model.Code, isPersistent: model.RememberMe, rememberBrowser: model.RememberBrowser); switch (result) { case SignInStatus.Success: return RedirectToAction("Dashboard","Index"); case SignInStatus.LockedOut: return View("Lockout"); case SignInStatus.Failure: default: ModelState.AddModelError("", "Invalid code."); return View(model); }
When both model.RememberMe and model.RememberBrowser is true browser remembers Identity and two factor cookie for 2 weeks. This is the default implementation.
But i only need to remember TFA for 8 hours. How can i do that?
I have been searching for the solution since last 10 days but i haven't found the solution. Any help would be much appreciated.
Following is the code in my StartUp class. It just doesn't take effect.
public partial class Startup { // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864 public void ConfigureAuth(IAppBuilder app) { // Configure the db context, user manager and signin manager to use a single instance per request app.CreatePerOwinContext(ApplicationDbContext.Create); app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create); app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create); app.CreatePerOwinContext<ApplicationRoleManager>(ApplicationRoleManager.Create); string domainName = string.IsNullOrEmpty(Config.DomainName) ? "" : Config.DomainName; string cookieName = "AspNet." + domainName; // Enable the application to use a cookie to store information for the signed in user // and to use a cookie to temporarily store information about a user logging in with a third party login provider // Configure the sign in cookie app.UseCookieAuthentication(new CookieAuthenticationOptions { AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie, LoginPath = new PathString("/Account/Login"), SlidingExpiration = true, ExpireTimeSpan = TimeSpan.FromHours(9), CookieDomain = domainName, CookieName = cookieName, Provider = new CookieAuthenticationProvider { // Enables the application to validate the security stamp when the user logs in. // This is a security feature which is used when you change a password or add an external login to your account. OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ProgenyUser, long>( validateInterval: TimeSpan.FromMinutes(30), regenerateIdentityCallback: (manager, user) => user.GenerateUserIdentityAsync(manager), getUserIdCallback: (id) => (id.GetUserId<long>())) } }); // Use a cookie to temporarily store information about a user logging in with a third party login provider //app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie); // Enables the application to temporarily store user information when they are verifying the second factor in the two-factor authentication process. app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5)); // Enables the application to remember the second login verification factor such as phone or email. // Once you check this option, your second step of verification during the login process will be remembered on the device where you logged in from. // This is similar to the RememberMe option when you log in. app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie); // Uncomment the following lines to enable logging in with third party login providers //app.UseMicrosoftAccountAuthentication( // clientId: "", // clientSecret: ""); //app.UseTwitterAuthentication( // consumerKey: "", // consumerSecret: ""); //app.UseFacebookAuthentication( // appId: "", // appSecret: ""); //app.UseGoogleAuthentication(); } }
I just made another test and i found following:
Case I
- Check Remember me during username and password validation.
- Don't check Remember browser during code verification
Actual Result: ExpireTimeSpan in Startup.Auth.cs takes effect
Case II
- Check Remember me during username and password validation
- Check Remember me during code verification
Actual Result: ExpireTimeSpan in Startup.Auth.cs doesn't take effect. Both cookies gets a ExpireTime of 2 weeks.
Desired Result:
When both Remember Me and Remember Browser is true i want cookies to expire in 9 hours after successful login.
Thanks,