Return LockedOut from TwoFactorSignInAsync (#49337)

Author: CarlosZaldivar

src/Identity/Core/src/SignInManager.cs

@@ -560,6 +560,11 @@ public virtual async Task<SignInResult> TwoFactorAuthenticatorSignInAsync(string
                 // This is currently redundant, but it's here in case the code gets copied elsewhere.
                 return SignInResult.Failed;
             }
+
+            if (await UserManager.IsLockedOutAsync(user))
+            {
+                return await LockedOut(user);
+            }
         }
         return SignInResult.Failed;
     }
@@ -602,6 +607,11 @@ public virtual async Task<SignInResult> TwoFactorSignInAsync(string provider, st
                 // This is currently redundant, but it's here in case the code gets copied elsewhere.
                 return SignInResult.Failed;
             }
+
+            if (await UserManager.IsLockedOutAsync(user))
+            {
+                return await LockedOut(user);
+            }
         }
         return SignInResult.Failed;
     }

src/Identity/test/Identity.Test/SignInManagerTest.cs

@@ -425,6 +425,45 @@ public async Task TwoFactorAuthenticatorSignInFailWithoutLockout()
         auth.Verify();
     }
 
+    [Fact]
+    public async Task TwoFactorAuthenticatorSignInAsyncReturnsLockedOut()
+    {
+        // Setup
+        var user = new PocoUser { UserName = "Foo" };
+        string providerName = "Authenticator";
+        const string code = "3123";
+        var manager = SetupUserManager(user);
+        var lockedout = false;
+        manager.Setup(m => m.AccessFailedAsync(user)).Returns(() =>
+        {
+            lockedout = true;
+            return Task.FromResult(IdentityResult.Success);
+        }).Verifiable();
+        manager.Setup(m => m.SupportsUserLockout).Returns(true).Verifiable();
+        manager.Setup(m => m.VerifyTwoFactorTokenAsync(user, providerName ?? TokenOptions.DefaultAuthenticatorProvider, code)).ReturnsAsync(false).Verifiable();
+        manager.Setup(m => m.IsLockedOutAsync(user)).Returns(() => Task.FromResult(lockedout));
+
+        var context = new DefaultHttpContext();
+        var auth = MockAuth(context);
+        var helper = SetupSignInManager(manager.Object, context);
+        var twoFactorInfo = new SignInManager<PocoUser>.TwoFactorAuthenticationInfo { User = user };
+        if (providerName != null)
+        {
+            helper.Options.Tokens.AuthenticatorTokenProvider = providerName;
+        }
+        var id = SignInManager<PocoUser>.StoreTwoFactorInfo(user.Id, null);
+        auth.Setup(a => a.AuthenticateAsync(context, IdentityConstants.TwoFactorUserIdScheme))
+            .ReturnsAsync(AuthenticateResult.Success(new AuthenticationTicket(id, null, IdentityConstants.TwoFactorUserIdScheme))).Verifiable();
+
+        // Act
+        var result = await helper.TwoFactorAuthenticatorSignInAsync(code, isPersistent: false, rememberClient: false);
+
+        // Assert
+        Assert.True(result.IsLockedOut);
+        manager.Verify();
+        auth.Verify();
+    }
+
     [Theory]
     [InlineData(true, true, true)]
     [InlineData(true, true, false)]
@@ -670,6 +709,41 @@ public async Task CanTwoFactorSignIn(bool isPersistent, bool supportsLockout, bo
         auth.Verify();
     }
 
+    [Fact]
+    public async Task TwoFactorSignInAsyncReturnsLockedOut()
+    {
+        // Setup
+        var user = new PocoUser { UserName = "Foo" };
+        var manager = SetupUserManager(user);
+        var provider = "twofactorprovider";
+        var code = "123456";
+        var lockedout = false;
+        manager.Setup(m => m.AccessFailedAsync(user)).Returns(() =>
+        {
+            lockedout = true;
+            return Task.FromResult(IdentityResult.Success);
+        }).Verifiable();
+        manager.Setup(m => m.SupportsUserLockout).Returns(true).Verifiable();
+        manager.Setup(m => m.IsLockedOutAsync(user)).Returns(() => Task.FromResult(lockedout));
+        manager.Setup(m => m.VerifyTwoFactorTokenAsync(user, provider, code)).ReturnsAsync(false).Verifiable();
+
+        var context = new DefaultHttpContext();
+        var auth = MockAuth(context);
+        var helper = SetupSignInManager(manager.Object, context);
+        var id = SignInManager<PocoUser>.StoreTwoFactorInfo(user.Id, loginProvider: null);
+
+        auth.Setup(a => a.AuthenticateAsync(context, IdentityConstants.TwoFactorUserIdScheme))
+            .ReturnsAsync(AuthenticateResult.Success(new AuthenticationTicket(id, null, IdentityConstants.TwoFactorUserIdScheme))).Verifiable();
+
+        // Act
+        var result = await helper.TwoFactorSignInAsync(provider, code, isPersistent: false, rememberClient: false);
+
+        // Assert
+        Assert.True(result.IsLockedOut);
+        manager.Verify();
+        auth.Verify();
+    }
+
     [Fact]
     public async Task RememberClientStoresUserId()
     {
@@ -1169,16 +1243,9 @@ public async Task CheckPasswordSignInLockedOutResultIsDependentOnTheAccessFailed
         manager.Verify();
     }
 
-    public static object[][] AccessFailedResults => new object[][]
-    {
-        new object[] { IdentityResult.Success },
-        new object[] { null },
-        new object[] { IdentityResult.Failed() },
-    };
-
     [Theory]
-    [MemberData(nameof(AccessFailedResults))]
-    public async Task TwoFactorSignInLockedOutResultIsAlwaysGenericFailureRegardlessOfTheAccessFailedAsyncResult(IdentityResult accessFailedResult)
+    [MemberData(nameof(ExpectedLockedOutSignInResultsGivenAccessFailedResults))]
+    public async Task TwoFactorSignInLockedOutResultIsDependentOnTheAccessFailedAsyncResult(IdentityResult accessFailedResult, SignInResult expectedSignInResult)
     {
         // Setup
         var isLockedOutCallCount = 0;
@@ -1204,8 +1271,7 @@ public async Task TwoFactorSignInLockedOutResultIsAlwaysGenericFailureRegardless
         var result = await helper.TwoFactorSignInAsync(provider, code, false, false);
 
         // Assert
-        // Unlike password sign in, 2fa always returns SignInResult.Failed rather than LockedOut.
-        Assert.Same(SignInResult.Failed, result);
+        Assert.Same(expectedSignInResult, result);
         manager.Verify();
         auth.Verify();
     }