LINGYUN.Abp.OpenIddict.Portal

Introduction

LINGYUN.Abp.OpenIddict.Portal is a portal authentication extension module for OpenIddict, providing enterprise portal authentication functionality, including multi-tenant selection, two-factor authentication, password policies, and more.

简体中文

Features

Enterprise Portal Authentication
- Support for enterprise list selection
- Support for multi-tenant authentication
- Support for enterprise logo display
Enhanced Password Authentication
- Support for email login
- Support for external login providers
- Support for password policy validation
- Support for forced password change
- Support for periodic password change
Two-Factor Authentication
- Support for multiple verification providers
- Support for verification code validation
- Support for authenticator validation
Security Logging
- Record login attempts
- Record login failures
- Record password changes

Installation

dotnet add package LINGYUN.Abp.OpenIddict.Portal

Usage

Add [DependsOn(typeof(AbpOpenIddictPortalModule))] to your module class.
Configure OpenIddict server:

public override void PreConfigureServices(ServiceConfigurationContext context)
{
    PreConfigure<OpenIddictServerBuilder>(builder =>
    {
        // Allow portal authentication flow
        builder.AllowPortalFlow();
    });
}

Usage example:

POST /connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=portal&
username=admin&
password=1q2w3E*&
enterpriseId=your-enterprise-id&
scope=openid profile

Authentication Flow

Enterprise Selection
- User provides enterprise ID (enterpriseId)
- Returns available enterprise list if not provided or invalid
Password Verification
- Support for username or email login
- Password policy validation
- Account status check
Two-Factor Authentication (if enabled)
- Verify two-factor authentication code
- Support for multiple verification providers
Password Change (if required)
- Force password change on first login
- Periodic password change requirement

Parameters

username (required)
- Username or email address
password (required)
- User password
enterpriseId (required)
- Enterprise ID, must be a valid GUID format
TwoFactorProvider (optional)
- Two-factor authentication provider name
- Only required when two-factor authentication is enabled
TwoFactorCode (optional)
- Two-factor authentication code
- Only required when two-factor authentication is enabled
ChangePasswordToken (optional)
- Password change token
- Only required when password change is needed
NewPassword (optional)
- New password
- Only required when password change is needed

Notes

Enterprise ID must be a valid GUID format
Password must comply with system-configured password policy
Two-factor authentication codes have limited validity
All authentication operations are recorded in security logs
HTTPS is recommended in production environments

3.5 KiB Raw Blame History