How to secure an ASP.NET Core MVC client with a separate Core API?

Question

Currently, I have two clients for the same API, a Xamarin Forms app and an ASP.NET Core MVC project. Instead of using Entity in the MVC project and have to rewrite much of what has already been written in the API, we've decided to use the same API for both (isolating the database in the process).

However, I've been having trouble trying to adapt Identity to this situation. Basically, we need to ask for login info in this MVC client, and then use the separate API to access the server and authenticate this info.

There seems to be a few different ways to go about this, though I haven't yet been able to decide upon one/make one work as there isn't much documentation covering this specific scenario.

Ideally, we'd like to be able to use the [Authorize] and other useful tags from Identity in this client MVC project, but haven't found a way to introduce our own API in this process. Any ideas?

Answer 1

Identity, at its core, is a user-management framework. The functions of authentication/authorization are only tangentially related. When you start talking about needing to authorize many different applications, especially different types of applications such as mobile app and a website, then you need to start looking into a centralized identity provider. If you want to roll your own, IdentityServer is just about the only game in town. For a hosted solution, you might consider something like Auth0 or Azure Active Directory.

Whichever you choose, you'll need to utilize various flows for different situations. A mobile app will typically use an OAuth flow for user-centric actions, whereas generic non-user specific requests might utilize client credentials. For a website, you'll use cookie authentication and an OIDC flow. Your API(s) will utilize client credentials or perhaps a hybrid auth flow, if you need to support client-side authenticated requests via something like AJAX.

In short, there's no substitute for doing the research here. You'll need to dig in, figure out what you need to support and how you're going to support it. However, regardless of the individual flow, you'll need a centralized identity provider to pull it all off.

That said, the authentication and authorization middleware in ASP.NET Core is not tied to any particular provider. Depending on what you end up going with, you may or may not continue to use ASP.NET Identity (IdentityServer can integrate with that, but something like Auth0 will have it's own user management). However, that has no bearing at all on your ability to continue using things like the Authorize attribute.