External authentication as a service ?

[giannik]

Looking at the new external authentication feature(#16721) I'm wondering if I can use external authentication as a service without creating the user.
In my custom module I would like to authenticate using an external provider but not create the orchard user automatically. Just get the authentication result from the external provider and use that information elsewhere. I guess I could just copy in my own controller the code to call the external authentication provider and handle the result eg :

public sealed class ExternalAuthenticationsController : AccountBaseController

  [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public IActionResult ExternalLogin(string provider, string returnUrl = null)
    {
        // Request a redirect to the external login provider.
        var redirectUrl = Url.Action(nameof(ExternalLoginCallback), new { returnUrl });
        var properties = _signInManager.ConfigureExternalAuthenticationProperties(provider, redirectUrl);

        return Challenge(properties, provider);
    }

    [AllowAnonymous]
    public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
    {
        var info = await _signInManager.GetExternalLoginInfoAsync();

    }

}

@MikeAlhayek Do you find this approach reasonable?

[MikeAlhayek]

@giannik how would your app be aware of the logged in user? User is needed to create the identity which it's used to authenticate against. Also, the current implementation of identity, stored the external login provider under the registered user. So one user could be authenticated using multiple external providers.

[giannik]

@MikeAlhayek i want to create wizard like registration form from the default tenant , authenticate through google , capture the user info, and then create a new tenant with the user info on the new tenant. does it make sense?

[MikeAlhayek]

Not really. I think each site will need an instance of a user to be able to handle permissions.

What you could do is make your default app as your identity provider instead of Google. But each tenant will need to have a user internally.

Assuming you have a users in memory only, what benefits are you trying to achieve?

[giannik]

ok , Ill rethink it.