ASP.NET Identity Account Lockout
ASP.NET Identity 2.1 comes with the infrastructure to support varied authentication from the complex two factor to the simple username and password. It also has the ability to enforce rules on sign in to keep account information secure. One feature that comes with out of the box identity but is not enabled by default is lockout. The behavior of the feature is straightforward: a series of incorrect passwords supplied for a given account will force the user to wait a penalty period before attempting to sign in again. This feature needs to be configured the right way to both prevent phishing for user accounts but to also not inconvenience legitimate users who may have mistyped their password a few times in a row. The first step to enabling this feature is to make some changes to your user manager. Below are 3 properties of the user manager that I am setting in the initialization for the class. The first property is one that is repeated in several of the classes we will look...