Identityserver4: implementing passwordless login through customization of idsrv

[stombeur]

Hi, is it possible to implement a passwordless login with custom grant and a custom login view?

By passwordless I mean that by visiting the custom login view and specifying your email, idsrv sends you an email with a magic link containing a TOTP, clicking the magic link goes to the custom grant validator and after validating the TOTP, idsrv redirects you to the client application.

Is that a scenario that can be supported through customization/extension of idsrv?

thanks,
Stephane

[khelben]

I think so, in fact what you do for authentication a user is up to you.

What you could do is:

• in the AccountController.Login (GET) let the user enter his email address.
  Be sure to keep a reference to the returnUrl, this is the url that you should redirect to when a user is authenticated (it links to /connect/authorize/login?...)
• Send the user a link with your TOTP and let it link to a custom action in your AccountController
  In that action validate the TOTP and redirect then to the previous returnUrl and voila, the user is logged in. Similar to how AccountController.Login (POST) works

That's how I would do it.

[stombeur]

@khelben thanks for your answer. I did manage to leave out that I'm currently on v3 with no immediate plans of moving to v4 though. So I'm not sure that solution is 100% applicable to v3?

[leastprivilege]

So why are you posting here then?

[stombeur]

I'm sorry, I misread the contributing guidelines page. Obvious mistake on my part.

[leastprivilege]

no prob - identityserver3 has its own issue tracker - but given the nature of the question, you are better off at StackOverflow

For IdentityServer3
https://stackoverflow.com/questions/tagged/?tagnames=identityserver3&sort=newest

For IdentityServer4
https://stackoverflow.com/questions/tagged/?tagnames=identityserver4&sort=newest

[Jurabek]

@stombeur maybe might be helpful https://github.com/Jurabek/IdentityServer4.PhoneNumberAuth

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.