title: ASP.NET 5 Identity - custom SignInManager
body: <p>I have a MVC 6 project (vNext) and I am playing around with the ASP.NET Identity. In my case I don't want to use the build-in stuff which uses the EF (SignInManager, UserManager, UserStore). I have an external database and I just want to make a username/password lookup and return a valid cookie. 
  So I started writing my own classes. </p>
  
  <pre><code>public class MyUser
  {
      public string Id { get; set; }
      public string UserName { get; set; }
      public string Password { get; set; }
      public string PasswordHash { get; set; }
  }
  
  public class MyUserStore : IUserStore&lt;MyUser&gt;, IUserPasswordStore&lt;MyUser&gt;
  {
      ...
  }
  </code></pre>
  
  <p>In the <code>MyUserStore</code> class I am using hard-coded list of users as my store (only for test purposes). And I overrode some methods just to return the data from the hard-coded store.</p>
  
  <pre><code>public class MyUserManager : UserManager&lt;MyUser&gt;
  {
      public MyUserManager(
          IUserStore&lt;MyUser&gt; store,
          IOptions&lt;IdentityOptions&gt; optionsAccessor,
          IPasswordHasher&lt;MyUser&gt; passwordHasher,
          IEnumerable&lt;IUserValidator&lt;MyUser&gt;&gt; userValidators,
          IEnumerable&lt;IPasswordValidator&lt;MyUser&gt;&gt; passwordValidators,
          ILookupNormalizer keyNormalizer,
          IdentityErrorDescriber errors,
          IEnumerable&lt;IUserTokenProvider&lt;MyUser&gt;&gt; tokenProviders,
          ILoggerFactory logger,
          IHttpContextAccessor contextAccessor) :
          base(store, optionsAccessor, passwordHasher, userValidators, passwordValidators, keyNormalizer, errors, tokenProviders, logger, contextAccessor)
      {
      }
  }
  </code></pre>
  
  <p>Here I made the methods <code>CheckPasswordAsync</code> and <code>VerifyPasswordAsync</code> to return <code>true</code> and <code>PasswordVerificationResult.Success</code> respectively just for the test.</p>
  
  <pre><code>public class MyClaimsPrincipleFactory : IUserClaimsPrincipalFactory&lt;MyUser&gt;
  {
      public Task&lt;ClaimsPrincipal&gt; CreateAsync(MyUser user)
      {
          return Task.Factory.StartNew(() =&gt;
          {
              var identity = new ClaimsIdentity();
              identity.AddClaim(new Claim(ClaimTypes.Name, user.UserName));
              var principle = new ClaimsPrincipal(identity);
  
              return principle;
          });
      }
  }
  
  public class MySignInManager : SignInManager&lt;MyUser&gt;
  {
      public MySignInManager(MyUserManager userManager, IHttpContextAccessor contextAccessor, IUserClaimsPrincipalFactory&lt;MyUser&gt; claimsFactory, IOptions&lt;IdentityOptions&gt; optionsAccessor = null, ILoggerFactory logger = null)
              : base(userManager, contextAccessor, claimsFactory, optionsAccessor, logger)
      {
      }
  
      public override Task&lt;SignInResult&gt; PasswordSignInAsync(string userName, string password, bool isPersistent, bool shouldLockout)
      {
          // here goes the external username and password look up
  
          if (userName.ToLower() == "username" &amp;&amp; password.ToLower() == "password")
          {
              return base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout);
          }
          else
          {
              return Task.FromResult(SignInResult.Failed);
          }
      }
  }
  </code></pre>
  
  <p>And everything is hooked up in the <code>Startup</code> class as follows:</p>
  
  <pre><code>services.AddIdentity&lt;MyUser, MyRole&gt;()
              .AddUserStore&lt;MyUserStore&gt;()
              .AddUserManager&lt;MyUserManager&gt;()
              .AddDefaultTokenProviders();
  </code></pre>
  
  <p>And because I didn't manage to create the <code>MySignInManager</code> object in the <code>Startup</code> code in order to add it into the DI (for later injection in the controllers and views), I am creating it in the <code>MyAccountController</code>.</p>
  
  <pre><code>public MyAccountController(IHttpContextAccessor httpContextAccessor, UserManager&lt;MyUser&gt; userManager, IOptions&lt;IdentityOptions&gt; optionsAccessor, ILoggerFactory logger)
  {
      SignInManager = new MySignInManager(userManager as MyUserManager, httpContextAccessor, new MyClaimsPrincipleFactory(), optionsAccessor, logger);
  }
  </code></pre>
  
  <p>In my <code>MyLogin</code> action in the <code>MyAccount</code> controller I am calling <code>PasswordSignInAsync</code> and I can see that I am getting the cookie with the encoded claims in it (from the <code>MyClaimsPrincipleFactory</code>).
  When I try to call some other action with the <code>AuthorizeAttribute</code> on it I can see that the cookie is in the request header but I am unauthorized (more precisely, because I didn't remove the built-in default ASP.NET Identity Authentication from the visual studio sample template, I am redirected to the Account/Login instead).</p>
  
  <p>Is this the right way of customizing ASP.NET Identity and what am I missing here?</p>