ASP.NET Identity VS DotNetOpenAuth

There's nothing wrong with directly getting the user in their flow, the GetTwoFactorAuthenticationUserAsync is just the method that uses a tfa cookie to flow the information in the templates. The obvious caveat is that you would need to be careful to not make it easy to bypass the first/password step, but there's not a lot of ceremony underneath the covers: https://github.com/aspnet/Identity/blob/master/src/Identity/SignInManager.cs#L526

If you wrap the result into another object like IdentityResult, you should pay the extra heap allocation. For each call, an extra object should be initialized even for the successful operation. If you call an API 100 times with different inputs, how many times an exception may be thrown? So the rate of throwing an exception with the extra object initializing (and heap allocation) is not the same

I saw this post from 2012, and it's almost exactly the same situation as ours, but the DotNetOpenAuth repository has been archived since 2019. There is also the IdentityServer project, but IdentityServer3 seems to be the most recent version that still supports .NET Framework (not Core), and it hasn't been updated since 2018.