RFC 6238 Two-Factor Authentication service fails on .NET Framework 4.8

[Choonster]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When calling Microsoft.AspNetCore.Identity.UserManager.VerifyTwoFactorTokenAsync in a .NET Framework 4.8 application, a NullReferenceException will be thrown due to Rfc6238AuthenticationService.ComputeTotp passing a null value to Rfc6238AuthenticationService.ApplyModifier for the modifierBytes argument.

Expected Behavior

UserManager.VerifyTwoFactorTokenAsync should return either true or false depending on whether the token was valid.

Steps To Reproduce

• Repo: https://github.com/Choonster/AspNetCoreIdentityRfc6238Error
• Test code: https://github.com/Choonster/AspNetCoreIdentityRfc6238Error/blob/master/AspNetCoreIdentityRfc6238Error/Controllers/TwoFactorController.cs
• Service registration: https://github.com/Choonster/AspNetCoreIdentityRfc6238Error/blob/master/AspNetCoreIdentityRfc6238Error/App_Start/ServiceConfig.cs

To reproduce:

• Open the project in Visual Studio
• Run the application
• Click the "Test 2FA" button
• Observe that the output below the button displays a NullReferenceException instead of an IdentityResult

Exceptions (if any)

System.NullReferenceException: Object reference not set to an instance of an object.
   at Microsoft.AspNetCore.Identity.Rfc6238AuthenticationService.ApplyModifier(Span`1 input, Byte[] modifierBytes)
   at Microsoft.AspNetCore.Identity.Rfc6238AuthenticationService.ComputeTotp(HashAlgorithm hashAlgorithm, UInt64 timestepNumber, Byte[] modifierBytes)
   at Microsoft.AspNetCore.Identity.AuthenticatorTokenProvider`1.<ValidateAsync>d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.AspNetCore.Identity.UserManager`1.<VerifyTwoFactorTokenAsync>d__133.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at AspNetCoreIdentityRfc6238Error.Controllers.TwoFactorController.<Test2faAsync>d__2.MoveNext() in C:\Users\[USER]\source\repos\AspNetCoreIdentityRfc6238Error\AspNetCoreIdentityRfc6238Error\Controllers\TwoFactorController.cs:line 38
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at System.Threading.Tasks.TaskHelpersExtensions.<CastToObject>d__1`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at System.Web.Http.Controllers.ApiControllerActionInvoker.<InvokeActionAsyncCore>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at System.Web.Http.Controllers.ActionFilterResult.<ExecuteAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at System.Web.Http.Dispatcher.HttpControllerDispatcher.<SendAsync>d__15.MoveNext()

.NET Version

.NET Framework 4.8

Anything else?

• Microsoft.Extensions.Identity.Core version: 8.0.3
• VS version: Microsoft Visual Studio Professional 2022 (64-bit) - Current - Version 17.9.2

This seems to have been introduced in #44557, which was released with .NET 8.0. Version 7.0.17 of the package doesn't have this issue.

[witvoetscreencheck]

I'm using .NET 8 (so not .NET Framework), and I'm having the exact same issue after updating Microsoft.Extensions.Identity.Core to v9.0.0. The previous version, v8.0.11, does work as intended.

[cheng93]

Can confirm 8.0.14 works fine.

It looks like NET6_0_OR_GREATER directive is being ignored

[jeremysalwen]

I am also hitting this same error with .NET 9, and Microsoft.Extensions.Identity.Core version 9.0.2.

[whoward92]

I am hitting this issue to using .NET 9 and and Microsoft.Extensions.Identity.Core version 9.0.0.

Confirmed working on 8.0.15

[Elementenfresser]

For some reason the pre-processor symbols in https://github.com/dotnet/aspnetcore/blob/v9.0.6/src/Identity/Extensions.Core/src/Rfc6238AuthenticationService.cs (like #if NET6_0_OR_GREATER)
don't get applied when targeting .NET Standard - which is happening when using .NET 8 platform:
"...For example, if you're targeting .NET Framework 2.0, the following symbols are defined: NET20, NET20_OR_GREATER, NET11_OR_GREATER, and NET10_OR_GREATER." see see https://learn.microsoft.com/en-us/dotnet/standard/frameworks

In conclusion: Identity 9 doesn't really work via .Net Standard 2.0 as advertised on lower Framework versions. You either have to roll back to Identity 8 or upgrade to .NET 9

[martincostello]

For some reason the pre-processor symbols in https://github.com/dotnet/aspnetcore/blob/v9.0.6/src/Identity/Extensions.Core/src/Rfc6238AuthenticationService.cs (like #if NET6_0_OR_GREATER)
don't get applied when targeting .NET Standard

That's correct. .NET Standard isn't .NET 6 or greater, so they're false.