Fix PasskeySignInAsync to enforce email/phone confirmation and lockout checks

[Copilot]

Fix PasskeySignInAsync to enforce email/phone confirmation and lockout checks

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Fix PasskeySignInAsync bypassing RequireConfirmedEmail, RequireConfirmedPhoneNumber, and lockout

Description

PasskeySignInAsync() was not calling PreSignInCheck() before signing in users, allowing authentication to succeed even when:

• RequireConfirmedEmail = true and email is unconfirmed
• RequireConfirmedPhoneNumber = true and phone is unconfirmed
• User is locked out

This is inconsistent with PasswordSignInAsync() and other sign-in methods that properly enforce these requirements.

Changes:

• SignInManager.PasskeySignInCoreAsync: Added PreSignInCheck() call after successful passkey assertion, before updating passkey metadata. Returns SignInResult.NotAllowed or SignInResult.LockedOut when requirements aren't met.

• Tests: Added CanRequireConfirmedEmailForPasskeySignIn, CanRequireConfirmedPhoneNumberForPasskeySignIn, and PasskeySignInReturnsLockedOutWhenLockedOut to verify enforcement.

Original prompt

Problem

SignInManager<TUser>.PasskeySignInAsync() does not call PreSignInCheck() before signing in the user, which means it bypasses sign-in requirements like RequireConfirmedEmail, RequireConfirmedPhoneNumber, and lockout checks. This is inconsistent with PasswordSignInAsync() which correctly enforces these requirements.

Reference Issue: #65020

Current Behavior

Looking at PasskeySignInCoreAsync in src/Identity/Core/src/SignInManager.cs:

private async Task<SignInResult> PasskeySignInCoreAsync(string credentialJson)
{
    ArgumentException.ThrowIfNullOrEmpty(credentialJson);

    var assertionResult = await PerformPasskeyAssertionAsync(credentialJson);
    if (!assertionResult.Succeeded)
    {
        return SignInResult.Failed;
    }

    // After a successful assertion, we need to update the passkey so that it has the latest
    // sign count and authenticator data.
    var setPasskeyResult = await UserManager.AddOrUpdatePasskeyAsync(assertionResult.User, assertionResult.Passkey);
    if (!setPasskeyResult.Succeeded)
    {
        return SignInResult.Failed;
    }

    return await SignInOrTwoFactorAsync(assertionResult.User, isPersistent: false, bypassTwoFactor: true);
}

The method directly proceeds to SignInOrTwoFactorAsync without calling PreSignInCheck().

Expected Behavior

PasskeySignInAsync() should call PreSignInCheck() after successful passkey assertion (but before signing in) to enforce:

• RequireConfirmedEmail - returns SignInResult.NotAllowed if email is not confirmed
• RequireConfirmedPhoneNumber - returns SignInResult.NotAllowed if phone is not confirmed
• User lockout - returns SignInResult.LockedOut if user is locked out

Required Changes

1. Modify PasskeySignInCoreAsync in src/Identity/Core/src/SignInManager.cs

Add a call to PreSignInCheck() after successful passkey assertion, similar to how TwoFactorAuthenticatorSignInCoreAsync and TwoFactorSignInCoreAsync do it:

private async Task<SignInResult> PasskeySignInCoreAsync(string credentialJson)
{
    ArgumentException.ThrowIfNullOrEmpty(credentialJson);

    var assertionResult = await PerformPasskeyAssertionAsync(credentialJson);
    if (!assertionResult.Succeeded)
    {
        return SignInResult.Failed;
    }

    // Check pre-sign-in requirements (email confirmation, phone confirmation, lockout)
    var error = await PreSignInCheck(assertionResult.User);
    if (error != null)
    {
        return error;
    }

    // After a successful assertion, we need to update the passkey so that it has the latest
    // sign count and authenticator data.
    var setPasskeyResult = await UserManager.AddOrUpdatePasskeyAsync(assertionResult.User, assertionResult.Passkey);
    if (!setPasskeyResult.Succeeded)
    {
        return SignInResult.Failed;
    }

    return await SignInOrTwoFactorAsync(assertionResult.User, isPersistent: false, bypassTwoFactor: true);
}

2. Add unit tests in src/Identity/test/Identity.Test/SignInManagerTest.cs

Add the following test methods that mirror the existing password sign-in tests:

Test 1: CanRequireConfirmedEmailForPasskeySignIn

Similar to CanRequireConfirmedEmailForPasswordSignIn, this test should verify that when RequireConfirmedEmail = true:

• If email is NOT confirmed → PasskeySignInAsync returns SignInResult.NotAllowed
• If email IS confirmed → PasskeySignInAsync returns SignInResult.Success

Test 2: CanRequireConfirmedPhoneNumberForPasskeySignIn

Similar to CanRequireConfirmedPhoneNumberForPasswordSignIn, this test should verify that when RequireConfirmedPhoneNumber = true:

• If phone is NOT confirmed → PasskeySignInAsync returns SignInResult.NotAllowed
• If phone IS confirmed → PasskeySignInAsync returns SignInResult.Success

Test 3: PasskeySignInReturnsLockedOutWhenLockedOut

Similar to PasswordSignInReturnsLockedOutWhenLockedOut, this test should verify that:

• If user is locked out → PasskeySignInAsync returns SignInResult.LockedOut

For reference, the existing CanPasskeySignIn test in the same file shows how to set up passkey sign-in tests with mocked IPasskeyHandler. Use similar setup patterns for the new tests.

This pull request was created from Copilot chat.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR fixes a security vulnerability where PasskeySignInAsync() was bypassing important sign-in requirements (email confirmation, phone confirmation, and lockout checks) that are properly enforced by other sign-in methods like PasswordSignInAsync().

Changes:

• Added PreSignInCheck() call in PasskeySignInCoreAsync to enforce email/phone confirmation and lockout requirements before signing in
• Added three comprehensive unit tests to verify the fix works correctly for all three scenarios (email confirmation, phone confirmation, and lockout)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Identity/Core/src/SignInManager.cs	Added PreSignInCheck() call after successful passkey assertion to enforce sign-in requirements
src/Identity/test/Identity.Test/SignInManagerTest.cs	Added three tests to verify email confirmation, phone confirmation, and lockout checks work with passkey sign-in

[MackinnonBuck]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[halter73]

I assume we're going to backport this to release/10.0?

[MackinnonBuck]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[MackinnonBuck]

/backport to release/10.0

[github-actions]

Started backporting to release/10.0 (link to workflow run)

[github-actions]

@MackinnonBuck backporting to release/10.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Patch format detection failed.
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

[utilsites]

This PR is documented as a breaking change in ASP.NET Core 11:

It is the outcome of the issue I originally opened, which was fixed by this PR.

Original issue: #65020
PR: #65024

Sharing this for traceability, in case it helps future readers connect report → fix → documentation.

Tested OK, problem solved.