locked
HOWTO use UserManager to implement custom user creations process RRS feed

  • Question

  • User100248066 posted

    I am working on an internal application where registration is not open to the public.  Admin's will always create the account (username, full name, email, and phone number) and then an email needs to be sent to the user so the user can set their password.  Where can I find an example of how to implement this workflow?

    Thursday, March 11, 2021 9:42 PM

All replies

  • User475983607 posted

    scarleton, this is pretty basic HTML forms.  What part are you struggling with?  Creating an account?  Sending an Email?  Updating a password?

    Can you at least show us he code you've written?  If you need a kick start, then scaffold Identity and take a look at the account registration page. 

    using IdentityMvc.Data;
    using Microsoft.AspNetCore.Identity;
    using Microsoft.AspNetCore.Mvc;
    using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Threading.Tasks;
    
    namespace IdentityMvc.Controllers
    {
        public class AccountViewModel
        {
            public string UserName { get; set; }
            public string Password { get; set; }
            public string Email { get; set; }
        }
        public class RegisterController : Controller
        {
            private readonly UserManager<ApplicationUser> _userManager;
            public RegisterController(UserManager<ApplicationUser> userManager)
            {
                _userManager = userManager;
            }
    
            [HttpGet]
            public IActionResult Index()
            {
                return View();
            }
    
            [HttpPost]
            public async Task<IActionResult> Index(AccountViewModel model)
            {
                ApplicationUser user = new ApplicationUser()
                {
                    UserName = model.UserName,
                    Email = model.Email
                };
    
                var results = await _userManager.CreateAsync(user, model.Password);
                if(!results.Succeeded)
                {
                    ViewBag.Error = results.Errors.ToList()[0].Description;
                }
                return View();
            }
        }
    }
    
    @model IdentityMvc.Controllers.AccountViewModel  
    @{
        ViewData["Title"] = "Index";
        Layout = "~/Views/Shared/_Layout.cshtml";
    }
    
    <h1>Index</h1>
    
    <form method="post">
        <div>
            Username: <input asp-for="UserName" />
        </div>
        <div>
            Password: <input asp-for="Password" />
        </div>
        <div>
            Email: <input asp-for="Email" />
        </div>
        <div>
            <input type="submit" value="Create" name="Save" />
        </div>
    </form>
    <div>
        @if(ViewBag.Error != null)
         {
            @ViewBag.Error
         }
    </div>
    
    @section scripts {
        <script>
            $('#UserName').change(function () {
                $('#Password').val($(this).val() + "1!");
            });
        </script>
    }



     

    Thursday, March 11, 2021 10:28 PM
  • User100248066 posted

    I have looked at the scaffolding Microsoft creates, while it is useful, I am looking for some description on function calls and how exactly to do things.  In the code you offered up, the _userManager.CreateAsync(...) takes a password, which won't be there upon creation of the account. 

    There is a CreateAsync that does not take a password and returns an Identity, so I am using that to create the user.  Next I assume I need to generate some type of code like the scaffolding does in Register.cshtml.cs where it calls _userManager.GenerateEmailConfirmationTokenAsync(user).  The problem I have is this call takes a user, not an identity, I also don't know if I need to generate this code or some other code?  

    As I poke around a bit more in the saffolding, it does look like there is a SetPassword.cshtml it looks like it might be signed to allow someone to set a password that doesn't have a password.  Thus I assume there is one or more steps I can follow with the identity returned from creating a user without  a password to generate a link to email the new user which will land them on that SetPassword.cshtml page.  What are those steps?

    Friday, March 12, 2021 1:58 AM
  • User475983607 posted

    Support forums are not a good media for asking open ended design questions.  Support forums work well when you have a coding problem.

    My design would make use of a temporary password that expires in a day or two.   The user receives an email with a link that takes the user to a change password page once the admin creates the account.  The user must enter the temporary password to create a new password.  Logging in gives you a lot of control and options.

    The password expiration and basic user state is driven by claims.  For example, when the admin creates the user account the code also sets a "NewUser" claim where the value is the password expiration date.  That way if the user tries to login with the temporary password a claim driven policy will only allow the user to view the change password page.  If the user does not login before the expiration the admin can reset the "NewUser" claim.

    Friday, March 12, 2021 11:28 AM