I have just one concern with this change, it's that it allows for username checks. We can guess if an email is registered or not with this kind of information.
If there is already another endpoint that would allow that then we can ignore this concern, but I can't think of any.
I will also ask what the security engineers if it's ok. And look at what is done in ASP.NET Identity default templates.

@jardg, thanks for signing the contribution license agreement. We will now validate the agreement and then the pull request.

Thanks, .NET Foundation Pull Request Bot

This wont allow for username checks. Whether user is null or the combination user/password is invalid always returns The username or e-mail or password provided is incorrect. It was just I made a change returning an incorrect message from "The username or e-mail or password provided is incorrect." to "Invalid password".
Also where can I look to understand what is a ASP.NET Identity template?Thanks

With "The username or e-mail or password provided is incorrect." you don't know if the user exists. With your message you know it exists.

Create a new ASP.NET MVC application (dotnet core or not) then try to log with a non-existent user or with a wrong password (existing user). Compare the messages.

I explained bad myself. In the first pull the message told you that the password was incorrect as you say. But I updated the pull request to correct this. With the changes the message "The username or e-mail or password provided is incorrect." is always displayed wether the user doesn't exist or the password is incorrect. So its safe in this concern. The messages included on the pull "You must verify your email" or "You must be approved before being able to login" are only displayed if the password/user validation done before is correct but the username didn't verify the mail or the user isn't approved yet. Otherwise it will show "The username or e-mail or password provided is incorrect.". I have tested these cases to work as expected.

Two requests:

• Translate the message from the service, not from the caller. You can return a LocalizedString.
• Return the error message as an out parameter in ValidateUser, this will make less changes in the code as you don't use it all the time.

Changed to return List of LocalizedString as it can output one or more errors. Changed to output these messages.