Honor two-factor authentication on external-login sign-in

[GrantTotinov]

Honor two-factor authentication on external-login sign-in

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Description

The default scaffolded Identity UI completed an external-provider (OAuth/OIDC) sign-in with two-factor authentication bypassed unconditionally, even for accounts that had 2FA enabled. This diverged from the password sign-in path, which already honors 2FA.

In ExternalLogin.cshtml.cs (both V4 and V5), ExternalLoginSignInAsync is now called with bypassTwoFactor: false instead of true, and a result.RequiresTwoFactor branch was added that redirects to ./LoginWith2fa, mirroring the existing pattern in Login.cshtml.cs. No changes were needed in SignInManager: ExternalLoginSignInAsync already resolves the user internally and forwards the external loginProvider through the two-factor round-trip, so the completed sign-in after the second factor still preserves the external login and the external sign-in cookie is cleaned up as part of the existing two-factor completion flow.

Scope notes:

• The RedirectToPage("./LoginWith2fa", ...) call in the external-login callback intentionally omits RememberMe, since external sign-in has no "remember me" concept on the login form; it defaults to false.
• This is a UI-only change to the scaffolded Identity pages. Apps that have already scaffolded or overridden ExternalLogin.cshtml.cs will not pick up this change automatically.
• A new test, ExternalLoginIsChallengedForTwoFactorWhenAccountHasTwoFactorEnabled, locks down that an external-login account with 2FA enabled is routed through LoginWith2fa before sign-in completes, and that an account without 2FA continues to sign in unchanged (covered by the existing CanLoginWithASocialLoginProvider test).

Fixes #68497

[dotnet-policy-service]

Thanks for your PR, @GrantTotinov. Someone from the team will get assigned to your PR shortly and we'll get it reviewed.

[Copilot]

🟢 Approval recommended

The UI change correctly enforces the existing 2FA policy for external logins and is covered by functional tests that exercise both V4 and V5 UI variants.

Pull request overview

This pull request updates the scaffolded ASP.NET Core Identity UI external-login callback flow to honor two-factor authentication (2FA) for accounts that have 2FA enabled, bringing it in line with the password sign-in behavior.

Changes:

• Update V4/V5 ExternalLogin callback to call ExternalLoginSignInAsync(..., bypassTwoFactor: false) and handle RequiresTwoFactor by redirecting to LoginWith2fa.
• Add functional test coverage to ensure external-login sign-in is challenged for 2FA-enabled accounts.
• Extend functional-test page objects/user stories to drive the external-login + 2FA flow.

File summaries

File	Description
src/Identity/UI/src/Areas/Identity/Pages/V5/Account/ExternalLogin.cshtml.cs	Stops bypassing 2FA during external-login sign-in and redirects to LoginWith2fa when required.
src/Identity/UI/src/Areas/Identity/Pages/V4/Account/ExternalLogin.cshtml.cs	Same external-login 2FA enforcement behavior for the V4 (Bootstrap 4) UI.
src/Identity/test/Identity.FunctionalTests/UserStories.cs	Adds a user-story helper to perform external-login + 2FA sign-in.
src/Identity/test/Identity.FunctionalTests/Pages/Contoso/Login.cs	Adds a Contoso login helper that asserts the external-login flow redirects to LoginWith2fa.
src/Identity/test/Identity.FunctionalTests/LoginTests.cs	Adds a functional test verifying external login is challenged for 2FA when enabled.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.