There is nothing wrong with the code. await
means that execution continues only after the asynchronous method that follows finishes. This means that in this snippet:
var user = await userManager.FindAsync(context.UserName, context.Password)
var roles = await userManager.GetRolesAsync(user.Id);
the call to GetRolesAsync
will be executed only after the previous line completes.
From the documentation of UserManager.FindAsync
Returns a user with the specified username and password or null if there is no match.
Either the username or password are wrong. Just return a message to the end user asking them to retry. If you make this call using stored credentials, check them again.
In any case, you need to check for an authentication failure before trying to use the user
value, eg:
var user = await userManager.FindAsync(context.UserName, context.Password)
if (user == null)
{
//Somehow report failure, decrement retry counters, etc
retries--;
return false;
}
else
{
var roles = await userManager.GetRolesAsync(user.Id);
....
}