NOTE: An alternative solution exists:

How to: Use Google, Facebook and Microsoft accounts in ASP.NET XAF applications (OAuth2 authentication demo).

Instead of a custom-tailored implementation, we recommend that you delegate these routine tasks to OAuth2 providers. Microsoft 365 or Google GSuite services enable user and document management that's familiar to anyone who works with business apps. Your XAF application can easily integrate these OAuth2 providers into the logon form. You only need to add some boilerplate code.

This example contains a reusable Security.Extensions module that enables the following functionality:

• Security - add a capability to register a new user from the logon form
• Security.Authentication - add a "Forgot Password" feature

The module includes the following notable building blocks:

• Application Model settings (Model.DesignedDiffs.xafml) that place custom Actions next to the logon form input fields. See How to: Include an Action to a Detail View Layout.
• Non-persistent data models for parameter screens (LogonActionParameters.cs)
• A View Controller (ManageUsersOnLogonController.cs) for the logon Detail View. The controller declares custom Actions and their behavior. See the XafApplication.CreateCustomLogonWindowControllers event in Module.cs to find controller registration code and other service logic.

In order to use this module in your own project, follow the steps below:

1. Download the Security.Extensions module project, include it in your XAF solution, and rebuild the solution. See How to Add an Existing Project in MSDN for details.

2. Add the Security.Extensions.SecurityExtensionsModule to your application. To do this, use any of the techniques described in the following help topic: Ways to Register a Module.

3. Add the following code to your platform-agnostic module class:

   static YourPlatformAgnosticModuleName() {
       SecurityExtensionsModule.CreateSecuritySystemUser = Updater.CreateUser;
   } 

   In the above code sample, Updater.CreateUser is your custom method that matches the following definition:

   public delegate IAuthenticationStandardUser CreateSecuritySystemUser(IObjectSpace objectSpace, string userName, string email, string password, bool isAdministrator);

4. Add the following types to the SecurityStrategy.AnonymousAllowedTypes collection:

   • ApplicationUser
   • PermissionPolicyRole
   • ApplicationUserLoginInfo

   Use the SecurityOptions.Events.OnSecurityStrategyCreated delegate to access this collection: SecurityStrategyComplex.AnonymousAllowedTypes Property.

NOTE: Implementation details do not depend on your ORM tool of choice, so the following two sets of files contain the same code. We added both lists for your convenience - so you can navigate directly to the solution folder that you need.

EF Core:

• Updater.cs
• LogonActionParameters.cs
• ManageUsersOnLogonController.cs
• Module.cs
• Startup.cs

XPO:

• Updater.cs
• LogonActionParameters.cs
• ManageUsersOnLogonController.cs
• Module.cs
• Startup.cs