asp.net core identity + api

Question

I just started learning asp.net core. I would like to create a simple web app, where I would have a rest API in asp.net core and then a separate frontend with some angular consuming that API.

I just got a bit stuck trying to figure out ASP.NET Core Identity and cookie/token authentication...

My question is pretty simple: Can I just create an API and use Entity Framework for database handling and ASP.NET Core Identity to handle creating and managing users and authorization? Do I have to also to use some JWT, OAuth or anything like that? It's just this is all super new to me and I am getting confused, because every example/tutorial shows it in a different way and I am getting very confused...

Thanks for any help!

Answer 1

I'm working on a project that's very similar. Check out IdentityServer4 https://identityserver4.readthedocs.io/en/release/index.html. It's an open source OpenID Connect/OAuth 2 framework for ASP.NET Core created by the guys from leastprivilege https://leastprivilege.com.

You can handle protecting your APIs with JWTs and configure IdentityServer to use ASP.NET Core Identity for its user store. This section here describes protecting the API: https://identityserver4.readthedocs.io/en/release/configuration/apis.html

This is basically how you add ASP.NET Identity, IdentityServer, and configure IdentityServer to use ASP.NET Identity in your Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<ApplicationDbContext>(options =>
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();

services.AddMvc();

// Adds IdentityServer
services.AddIdentityServer()
    .AddAspNetIdentity<ApplicationUser>();
}

Then protecting an API is just a few lines of code in Startup.cs

public void Configure(IApplicationBuilder app)
{
    app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
    {
        Authority = "https://demo.identityserver.io",
        AllowedScopes = { "api1" },
    });

    app.UseMvc();
}

Then you would have to configure your angular app to be a "client" of IdentityServer and be able to access your API "resource". There is a whole tutorial on adding JavaScript clients: https://identityserver4.readthedocs.io/en/release/quickstarts/7_javascript_client.html