I have an ASP.NET Core Web API. When I set it up, I used the built-in ASP.NET Core identity stuff because that was fast and got me directly into writing the meat of the API functionality. Now I need to be able to log failed logins, but I can't see where to do this.
A class was created automatically at \Overrides\IdentityApiEndpointRouteBuilderExtensions.cs that contains a bunch of identity endpoints, including /login:
routeGroup.MapPost("/login", async Task<Results<Ok<AccessTokenResponse>, EmptyHttpResult, ProblemHttpResult>>
([FromBody] LoginRequest login, [FromQuery] bool? useCookies, [FromQuery] bool? useSessionCookies, [FromServices] IServiceProvider sp) =>
{
var signInManager = sp.GetRequiredService<SignInManager<TUser>>();
var useCookieScheme = (useCookies == true) || (useSessionCookies == true);
var isPersistent = (useCookies == true) && (useSessionCookies != true);
signInManager.AuthenticationScheme = useCookieScheme ? IdentityConstants.ApplicationScheme : IdentityConstants.BearerScheme;
var result = await signInManager.PasswordSignInAsync(login.Email, login.Password, isPersistent, lockoutOnFailure: true);
if (result.RequiresTwoFactor)
{
if (!string.IsNullOrEmpty(login.TwoFactorCode))
{
result = await signInManager.TwoFactorAuthenticatorSignInAsync(login.TwoFactorCode, isPersistent, rememberClient: isPersistent);
}
else if (!string.IsNullOrEmpty(login.TwoFactorRecoveryCode))
{
result = await signInManager.TwoFactorRecoveryCodeSignInAsync(login.TwoFactorRecoveryCode);
}
}
if (!result.Succeeded)
{
return TypedResults.Problem(result.ToString(), statusCode: StatusCodes.Status401Unauthorized);
}
// The signInManager already produced the needed response in the form of a cookie or bearer token.
return TypedResults.Empty;
});
In my Program.cs in the Main method, I have these lines:
builder.Services.AddAuthorization();
builder.Services.AddIdentityApiEndpoints<IdentityUser>().AddEntityFrameworkStores<DataContext>();
I can't hit breakpoints in that routeGroup.MapPost("/login". In fact, if I remove all of the code from that method, the login still works flawlessly. Obviously, this code is not handling logins.
Where can I find the code that handles these logins so that I can start logging failed logins?
A class was created automaticallyby whom? Identity doesn't generate code. Did you try scaffolding? Run some other tool? Or did you step into the decompiled code using Resharper? That would explain why you can't use breakpoints - that's not actual source code.signInManager.PasswordSignInAsync, not the login handler. .NET infrastructure code already uses the ILogger infrastructure to log events, so the events are probably logged already and hidden due to filtersAuthenticateSignIn, something's wrong. Tools like Prometheus can send metric alertsappsettings.json, not your code. Even if you change"Default": "Information"to"Default": "Debug" any"Microsoft": "Warning"` or"Microsoft.AspNetCore": "Warning"entries will hide the log entries