My engineers are implementing authentication and authorization using Asp.Net Identity Framework 2.0. The requirements state that we need to support the following scenario:
- Global admin user signs in.
- Global admin user views an organization.
- Global admin user invites organization user or admin to system.
- Email is sent to invited user containing special link.
- Invited user clicks on link, signs into their "Microsoft Account" (@hotmail.com) and is then signed into our website and associated to the organization and with the correct role assignment.
In my opinion, we should be able to do all of this using out-of-the-box features of Asp.Net Identity Framework. For example: In step 3, we can call the CreateUser() method and it should provision a user account that has not yet been confirmed. We can use the ConfirmationToken it generates to email the user. Is this not the correct way to proceed?
My engineers think that they need to implement custom user, role and organization tables and implement all custom authorization and roles for this because they believe that the user account within the identity framework can only be created when the user comes back from signing in (via OAuth) the first time.
