允许电子邮件和用户名进行身份验证

我正在使用 ASP.Net Identity 2.1 创建两个项目（MVC 5 和 Web API），但我找不到如何使用电子邮件和用户名进行身份验证（名为“管理”的区域必须使用用户名，而公共区域必须使用电子邮件用于身份验证的地址）。

问题是只有一种身份验证方法，并且不允许您指定是否与电子邮件地址或用户名进行比较。

SignInHelper.PasswordSignIn

我应该怎么做才能实现这个目标？

SignInManager你不会帮忙吗，你需要使用UserManager还有一点jiggery-pokery（这是技术术语！）：

这就是我对这种情况的看法：

var unauthUserByUsername = await userManager.FindByNameAsync(command.UserName);
var unauthUserByEmail = await userManager.FindByEmailAsync(command.UserName);

var unauthenticatedUser = unauthUserByUsername ?? unauthUserByEmail;
if (unauthenticatedUser == null)
{
    logger.Warn("User {0} is trying to login but username is not correct", command.UserName);
    return View(); // stop processing
}

var loggedInUser = await userManager.FindAsync(unauthenticatedUser.UserName, command.Password);
if (loggedInUser == null)
{
    // username is correct, but password is not correct
    logger.Warn("User {0} is trying to login with incorrect password", command.UserName);
    await userManager.AccessFailedAsync(unauthenticatedUser.Id);
    return View(); // stop processing
}

// Ok, from now on we have user who provided correct username and password.

// and because correct username/password was given, we reset count for incorrect logins.
await userManager.ResetAccessFailedCountAsync(loggedInUser.Id);

if (!loggedInUser.EmailConfirmed)
{
    logger.Warn("User {0} is trying to login, entering correct login details, but email is not confirmed yet.", command.UserName);
    return View("Please confirm your email"); // stop processing
}

if (await userManager.IsLockedOutAsync(loggedInUser.Id))
{
    // when user is locked, but provide correct credentials, show them the lockout message
    logger.Warn("User {0} is locked out and trying to login", command.UserName);
    return View("Your account is locked");
}

logger.Info("User {0} is logged in", loggedInUser.UserName);

// actually sign-in.
var authenticationManager = HttpContext.Current.GetOwinContext().Authentication;
await userManager.SignInAsync(authenticationManager, loggedInUser, false);

这会检查用户是否已确认电子邮件、用户是否被锁定以及在一定次数的尝试后确实将用户锁定（假定启用了所有其他锁定设置）。