Any password is working with SmartAdmin MVC

Question

I'm able to authenticate using anything for a password. The email has to be a valid registered email, but the pwd doesn't matter. Everything else is working normally.

Any suggestions on where to start trouble shooting this? I haven't found any similar issues in web searches.

My view...

My action in the account controller...

 [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public async Task<ActionResult> Login(AccountLoginModel viewModel)
    {
        if (!ModelState.IsValid)
            return View(viewModel);

        var user = _manager.FindByEmail(viewModel.Email);

        if (user != null)
        {
            await SignInAsync(user, viewModel.RememberMe);

            string uid = user.Id;
            return RedirectToLocal(viewModel.ReturnUrl);
        }

        ModelState.AddModelError("", "Invalid username or password.");

        return View(viewModel);
    }

and the signinasync method...

private async Task SignInAsync(IdentityUser user, bool isPersistent)
    {
        // Clear any lingering authencation data
        FormsAuthentication.SignOut();

        // Create a claims based identity for the current user
        var identity = await _manager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);

        // Write the authentication cookie
        FormsAuthentication.SetAuthCookie(identity.Name, isPersistent);
    }

I did create a seperate MVC web project to see the scaffolded login action, which is quite a bit different. The SmartAdmin template is customized enough that its difficult to start changing things without knowing what I'm effecting. Any direction is appreciated.

Answer 1

If username in your system is email, you should use

var user = _manager.FindAsync(viewModel.Email, viewModel.Password);

and then signin the user if it's not null.

If username is not email, you should first get the user and then check for password

var user = _manager.FindByEmail(viewModel.Email);
bool isPasswordCorrect = await _manager.CheckPasswordAsync(user, viewModel.Password);