docs/en/modules/account.md
//[doc-seo]
{
"Description": "Explore the Account Module for ABP Framework, featuring essential authentication functions like login, registration, and account management with advanced integration options."
}
Account module implements the basic authentication features like login, register, forgot password and account management.
This module is based on Microsoft's Identity library and the Identity Module. It has IdentityServer integration (based on the IdentityServer Module) and OpenIddict integration (based on the OpenIddict Module) to provide single sign-on, access control and other advanced authentication features.
This module comes as pre-installed (as NuGet/NPM packages). You can continue to use it as package and get updates easily, or you can include its source code into your solution (see get-source CLI command) to develop your custom module.
The source code of this module can be accessed here. The source code is licensed with MIT, so you can freely use and customize it.
This section introduces the main pages provided by this module.
/Account/Login page provides the login functionality.
Social/external login buttons becomes visible if you setup it. See the Social/External Logins section below. Register and Forgot password and links redirect to the pages explained in the next sections.
/Account/Register page provides the new user registration functionality.
New users receive every Identity role marked as Default.
/Account/ForgotPassword page provides a way of sending password reset link to user's email address. The user then clicks to the link and determines a new password.
The host part of the password reset link is built from
AppUrlOptions.Applications["MVC"].RootUrl. Configure it if the defaultApp:SelfUrlisn't what you want users to see in emails — for example, when you use subdomain-based multi-tenancy and want the link to point to the tenant's subdomain. See Application URLs.
/Account/Manage page is used to change password and personal information of the user.
IdentitySettingNames.User.IsUserNameUpdateEnabled and IdentitySettingNames.User.IsEmailUpdateEnabled control whether the profile application service accepts changes to those fields. Both settings are true by default. External users can't change a local password; the built-in MVC profile page omits the password group for them and the application service rejects a password change.
The Account module defines two client-visible settings. Both are true by default:
AccountSettingNames.IsSelfRegistrationEnabled controls self-registration. It is enforced by IAccountAppService.RegisterAsync as well as the built-in registration pages.AccountSettingNames.EnableLocalLogin controls the local username/password login UI and handlers in the MVC Account pages, the OpenIddict and IdentityServer integrations, and the Angular Account layout. In Angular, AuthWrapperService reads the setting; the Basic Theme's AuthWrapperComponent shows the account content when it is enabled and a no-login-schemes warning when it is disabled.These settings are independent. Disabling local login doesn't disable the registration application service. Set IsSelfRegistrationEnabled to false as well when users must not create local accounts. Change the values with ISettingManager like other settings. Global or tenant values are normally appropriate because the login and registration requests run before a user is authenticated.
The MVC /Account/Manage page is built from the contributors in ProfileManagementPageOptions.Contributors. Implement IProfileManagementPageContributor to add a group backed by a view component, then register it from your module:
Configure<ProfileManagementPageOptions>(options =>
{
options.Contributors.Add(new MyProfileManagementPageContributor());
});
Each contributor receives a ProfileManagementPageCreationContext and appends ProfileManagementPageGroup instances to its Groups collection. Contributors run in registration order on both GET and POST requests, and can resolve services through context.ServiceProvider when visibility depends on the current user or another runtime condition.
The Angular createRoutes function accepts three module-specific options: redirectUrl, isPersonalSettingsChangedConfirmationActive and editFormPropContributors. The form contributor key is eAccountComponents.PersonalSettings. The login, register, forgot-password, reset-password and manage-profile routes are also registered with the corresponding eAccountComponents keys for component replacement. See Dynamic Form Extensions for the contributor pattern.
Volo.Abp.Account.Web.OpenIddict package provides integration for the OpenIddict. This package comes as installed with the application startup template. See the OpenIddict Module documentation.
Volo.Abp.Account.Web.IdentityServer package provides integration for the IdentityServer. This package comes as installed with the application startup template. See the IdentityServer Module documentation.
The Account Module has already configured to handle social or external logins out of the box. You can follow the ASP.NET Core documentation to add a social/external login provider to your application.
The MVC login and registration pages also recognize a Windows authentication scheme. AbpAccountOptions.WindowsAuthenticationSchemeName identifies that scheme and defaults to "Windows". Set it when the registered scheme uses another name:
Configure<AbpAccountOptions>(options =>
{
options.WindowsAuthenticationSchemeName = "Negotiate";
});
Follow the ASP.NET Core Facebook integration document to support the Facebook login for your application.
Add the Microsoft.AspNetCore.Authentication.Facebook package to your project. Based on your architecture, this can be .Web, .IdentityServer (for tiered setup) or .Host project.
Use the .AddFacebook(...) extension method in the ConfigureServices method of your module, to configure the client:
context.Services.AddAuthentication()
.AddFacebook(facebook =>
{
facebook.AppId = "...";
facebook.AppSecret = "...";
facebook.Scope.Add("email");
facebook.Scope.Add("public_profile");
});
It would be a better practice to use the
appsettings.jsonor the ASP.NET Core User Secrets system to store your credentials, instead of a hard-coded value like that. Follow the Microsoft's document to learn the user secrets usage.