Cannot link external logins in 1.0.0/1.0.1 Individual auth templates

[HaoK]

Repro:

• New Individual Auth App
• Add 2 external auth providers (i.e. facebook/twitter/google)
• Register a local user and password
• Manage -> Add External Login -> First Facebook/twitter/google will work
• Second will result in access failed.

Original issue: aspnet/Identity#1005

This has been mitgated somewhat in 1.1 by aspnet/Security#980

A potential fix is to add the equivalent signout code to ManageController's LinkLogin + LinkLoginCallback(when add login was successful). I verified that this enables things.

Similar to: 306fbc6

[HaoK]

@Tratcher @blowdart @Eilon @muratg @divega we should probably discuss this one at triage today

[divega]

Was there a triage discussion about this today? What was the conclusion?

[Eilon]

@divega we have a thread with the tooling folks that I just added you to.

[brockallen]

This seems to still be a problem in 1.1.0, but under a different scenario. A locally logged in user (with uid/pwd) wants to now associate an external provider with their account. They click "Google", which triggers a challenge. Since they are currently logged in, they get the access denied page (which doesn't exist in the template).

This should allow them to challenge on google and be redirected. The cookie MW should not be handling this.

To demo this scenario I created a new ASP.NET Core project (w/ ASP.NET Identity) in VS2015, then updated project.json to use netcoreapp1.1, and then updated all nugets. I then added a new migration for the new stuff 1.1 added, and then ran it. I registered a new local user, logged in, then tried to link google to the account.

[Tratcher]

@brockallen I can't repro that with the 1.1 packages. I am able to create a user with a password and then add an external identity. I only get AccessDenied if I remove the external identity and try to re-add it, which is a known variation of this issue.

The password login and the external logins use separate cookies, so there's no reason they should conflict like you describe. Can you try again and make sure you don't have an old external cookie when you start?

[brockallen]

Ok, you are right -- I retested and confirm what you describe. Thank goodness. Thanks.

[brockallen]

I just grabbed this change to the manage controller and still see the issue I described above.