Rfc6238AuthenticationService should be in Security repository and make him public?

[abcplex]

Rfc6238AuthenticationService class at https://github.com/aspnet/Identity/blob/85012bd0ac83548f7eab31f0585dae3836935d9d/src/Microsoft.AspNet.Identity/Rfc6238AuthenticationService.cs look like very useful. But I think it should in Security repo. Also it will be great if you guys can make this class public.

[HaoK]

@blowdart thoughts?

[kevinchalet]

FWIW: https://github.com/aspnet/DataProtection is also a good candidate for that.

[blowdart]

Not data protection, no no no. It's a reasonable idea, it won't break anything as it's internal right now.

[Tratcher]

@blowdart Should we do this, and if so, where?

[blowdart]

Yes, and the Security namespace I feel.

[slaneyrw]

If it is moved then I'll get able to build a TOTP token provider to support the standard authenticator apps, like Google Authenticator. It is currently not possible to use the base provider that the Email and Phone token provider uses (TotpSecurityStampBasedTokenProvider) as it adds additional entropty ( UserModifier ) that I cannot easily override, but it also hardcodes the timestep at 3 minutes. All the authenticator apps use 30 seconds

[abcplex]

@blowdart still not done?

[grahamehorner]

I too would like this as it seems to be a very useful library without needing identity, also looking at the identity source the computation of the timestep is duplicated in a couple of areas when IMHO it should be a configurable parameters, I’ve created a proof of concept that I registered with DI IRFC6238 and updated identity to use the DI implementation seems to work for my needs 🤪

[mguinness]

Any updates? Would probably also need Base32 class moved.

This being internal was discussed aspnet/Identity#1388 (comment).

[oferns]

I too would like to see this

[grahamehorner]

@mguinness yes, Base32 should possibly move into the System.Text.Encoding namespace and have its own nupkg package if not be part of the corefx

[Eilon]

Closing because we are not planning to make this a public API at this time. However, people are free to grab the code per the license and ship a library that way.