Email Confirmation Token is always Invalid #1400

32 Answer(s)

• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  I think everything is ok locally, right?

  Can you add below code to identity server and api?

  public void ConfigureServices(IServiceCollection services)
  {
       var redis = ConnectionMultiplexer.Connect(configuration["Redis:Configuration"]);
          context.Services.AddDataProtection()
              .PersistKeysToStackExchangeRedis(redis, "Your-DataProtection-Keys")
              .SetApplicationName("YourAppName");
  }
  

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  It is not working locally either.

  I have added that and it still gives me the same error.

  I have also tried using that along with DisableAutomaticKeyGeneration() with no luck also.

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  Will it work if identity server and api are run on one instance?

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  Locally they run on the same instance but are started on separate processes and it still does not work

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  Can i check it remotely? https://zoom.us/j/92883778530?pwd=SHRCbEd0UndjYzc5R2szVlJiLzJzQT09

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  I checked, the problem should DataProtectorTokenProvider.

  You can inject the UserManager in your identity server project, then call GenerateEmailConfirmationTokenAsync and ConfirmEmailAsync to check if the function is works.

  public IdentityUserManager UserManager { get; set; }
  
  public virtual Task<string> GenerateEmailConfirmationTokenAsync(TUser user);
  public virtual async Task<IdentityResult> ConfirmEmailAsync(TUser user, string token)
  

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  I have tried that on both the api and identity server and they work when they are called together on each individual application.

  The issue with that is that the GenerateEmailConfirmationTokenAsync is being called on the api while ConfirmEmailAsync is on the idenentity server so having the same UserManager is not possible accross both.

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  OK, I will investigate this.

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  If two instances use the same key and same ApplicationName, it is possible to call each other.

  https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-5.0

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  Is that not what we did when you said to do this?

  I think everything is ok locally, right?

  Can you add below code to identity server and api?

  public void ConfigureServices(IServiceCollection services) 
  { 
       var redis = ConnectionMultiplexer.Connect(configuration["Redis:Configuration"]); 
          context.Services.AddDataProtection() 
              .PersistKeysToStackExchangeRedis(redis, "Your-DataProtection-Keys") 
              .SetApplicationName("YourAppName"); 
  } 
  

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  Is that not what we did when you said to do this?

  Yes, Can you try on another computer? Let us rule out environment.

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  I have tried it on two different computers with the same result

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  I will check again.

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi ruben.vazquez-chapa

  I checked. The identity server sends and check the token by default.

  abp new qa -t app -u angular --separate-identity-server
  

  

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  The issue with that is that the GenerateEmailConfirmationTokenAsync is being called on the api while ConfirmEmailAsync is on the idenentity server so having the same UserManager is not possible accross both.

  I'm curious how this happened.

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  Yes, we implemented a custom registration process and put the registration API in the API project. We are still using the the built in Registration method that is in the Applications project

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  I add some test code and it works between two application.

  https://github.com/abpframework/abp/commit/0f13c80056b4159f5a83b50753a7ff7b66ae6e74

  

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  Looking at your example, we are doing almost the same thing but with two differences

  • We are using the built in AccountAppService class from ABP and calling SendingEmailConfirmationTokenAsync from the API and ConfirmEmailAsync from the Identity Server which calls UserManager.ConfirmEmailAsync
  • Since both instances are separate in our production environment we cannot persist the keys on the local file system

  Is the built in functionality in the AccountAppService class not suitable for this? Do we need to just use our own implementation instead?

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  Since both instances are separate in our production environment we cannot persist the keys on the local file system

  You can use other provider to save your keys.

  https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-5.0

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  Yes, and as stated in previous messages and seen in our zoom call we are using Redis to save the keys

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  Can you check your redis to see if the keys are created?

  I think your Redis may have problem, Because we've confirmed the Data Protection can works between two application.

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  I checked and Redis is not the problem. What is happening is that in ConfirmEmailAsync the line that calls UserManager.ConfirmEmailAsync is not using Redis for the key. When I change it to call UserManager.VerifyUserTokenAsync directly it does. Can you check as to why this is happening? Since this is the IdentityUserManager for the ABP library and the code in question is also from the ABP library I would have expected the using the code given to us would work out of the box.

  This is all in the AccountAppService class from Volo.Abp.Account.Pro.Public.Application project using the Volo.Abp.Account namespace

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  Can you check the tokenProvider and purpose?

  https://github.com/dotnet/aspnetcore/blob/52eff90fbcfca39b7eb58baad597df6a99a542b0/src/Security/samples/Identity.ExternalClaims/Pages/Account/ConfirmEmail.cshtml.cs#L34

  https://github.com/dotnet/aspnetcore/blob/af9bb41d623b17eec946029815db5554b73be156/src/Identity/Extensions.Core/src/UserManager.cs#L1495

  Save Cancel
• 

  0

  ruben.vazquez-chapa@frogslayer.com created 4 years ago

  We are using the IdentityUserManager class from the Volo.Abp.Identity identity package so im not sure if I am following you. We have not modified or changed that class so im not sure how to check those unless it is in a setting somewhere.

  Save Cancel
• 

  0

  maliming created 4 years ago

  Support Team Fullstack Developer

  hi

  Can you share a demo project that can simple reproduce the problem?

  liming.ma@volosoft.com

  Save Cancel