\n<\/p>\n
Video – https:\/\/youtu.be\/GhZLi8pBJow?si=mnIVpCke9OJBMFoJ<\/p>\n
Services for Authentication and Authorization<\/p>\n
Authentication Service<\/p>\n
Maintains multiple authentication schemes
\nUses Cookie handler to Build ClaimsPrincipal from cookie, set up request redirection for login, logout, access denial
\nAdd cookie authentication service in DI container using the following<\/p>\n
\/\/ Add Cookie Authentication service
\nbuilder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
\n .AddCookie(options =>
\n {
\n options.LoginPath = “\/Account\/Login”; \/\/ Specify the path to the login page
\n options.AccessDeniedPath = “\/Account\/AccessDenied”; \/\/ Specify the path for access denied
\n options.ExpireTimeSpan = TimeSpan.FromMinutes(60); \/\/ Set the cookie expiration time
\n options.SlidingExpiration = true; \/\/ Enable sliding expiration
\n });<\/p>\n
Enter fullscreen mode\n\n\n\nExit fullscreen mode\n<\/code><\/pre>\nAddAuthentication adds the authentication service to DI container. It also specifies the default authentication scheme (Cookies) for authentication.
\n AddCookie provides a cookie authentication handler for the Cookies authentication scheme.<\/p>\n
Authorization Service<\/p>\n
Evaluates ClaimsPrincipal’s claims against authorization policies to determine if the request is authorized
\nAdd authorization service in DI container using the following<\/p>\n
builder.Services.AddAuthorization(options =>
\n{
\n \/\/ Define a rule named “AdminOnly”
\n options.AddPolicy(“AdminOnly”, policy =>
\n policy.RequireRole(“Admin”)
\n .RequireClaim(“EmployeeId”));
\n});<\/p>\n
Enter fullscreen mode\n\n\n\nExit fullscreen mode\n<\/code><\/pre>\nThe above code adds a policy named AdminOnly along with default available authorization service policies<\/p>\n
A Request’s Journey for cookie-based Authentication and Authorization in dotnet<\/p>\n
Phase 1 – Authentication middleware (for Identification)<\/p>\n
Authentication middleware identifies the visitor by extracting the ClaimsPrincipal from cookie and attaches it to HttpContext<\/p>\n
Authenticaiton middleware is added to the request pipeline using the following<\/p>\n
app.UseAuthentication();<\/p>\n
Enter fullscreen mode\n\n\n\nExit fullscreen mode\n<\/code><\/pre>\nSteps<\/p>\n
Middleware asks the Authentication Service (configured via AddAuthentication) for a ClaimsPrincipal (user).
\nAuthentication Service calls the Cookie Handler. It decrypts the cookie (using Data Protection Provider) and creates a ClaimsPrincipal
\nThe created ClaimsPrincipal is attached to HttpContext.User. The request moves to the next middleware.<\/p>\n
Phase 2: Authorization middleware (for Permissions check)<\/p>\n
Authorization middleware evaluates the identified ClaimsPrincipal’s claims and redirects the request to login or denies the request if claims don’t meet the authorization requirements
\nAuthorization middleware is added to the request pipeline using the following<\/p>\n
app.UseAuthorization();<\/p>\n
Enter fullscreen mode\n\n\n\nExit fullscreen mode\n<\/code><\/pre>\nSteps<\/p>\n
Authorization middleware checks the endpoint for attributes like (Authorize) or a specific policy (e.g., (Authorize(Policy = “AdminOnly”))).
\nAuthorization middleware asks the Authorization Service (registered via AddAuthorization) to evaluate the ClaimsPrincipal’s claims against those rules.
\nBased on that evaluation, the system executes one of three paths:<\/p>\n
Path A: User is Not Logged In (Challenge the request)<\/p>\n
Condition: The authorization policy requires a user, but HttpContext.User is anonymous.
\nAction: The Authorization middleware triggers a Challenge by calling the ChallengeAsync method on the Authentication service.
\nExecution: Authentication service delegates the Challenge execution to Cookie Handler, which modifies HttpContext.Response for a 302 Redirect to LoginPath. The pipeline short-circuits.<\/p>\n
Path B: User has Wrong Permissions (Forbid the request)<\/p>\n
Condition: ClaimPrincipal is present, but the claims fail the requirements of authorization policies.
\nAction: The Authorization middleware triggers a Forbid by calling the ForbidAsync method on the Authentication service.
\nExecution: Authentication service delegates the Forbid execution to Cookie Handler, which modifies HttpContext.Response for a 302 Redirect to AccessDeniedPath. The pipeline short-circuits.<\/p>\n
Path C: Access Granted<\/p>\n
Condition: The user’s claims satisfy all requirements in the Authorization Service.
\nExecution: The middleware calls next(), allowing the request to reach next middleware (like controllers).<\/p>\n
Setting logged in user in the cookie<\/p>\n
The user will submit credentials in the login page
\n The user credentials will be verified from a database and ClaimsPrincipal will be created to represent the logged in user
\n HttpContext.SignInAsync uses Authentication service’s Cookie Handler to set the logged in user details (a ClaimsPrincipal) in the response cookie<\/p>\n
await HttpContext.SignInAsync(
\n CookieAuthenticationDefaults.AuthenticationScheme,
\n new ClaimsPrincipal(claimsIdentity),
\n authProperties);<\/p>\n
Enter fullscreen mode\n\n\n\nExit fullscreen mode\n<\/code><\/pre>\nSignout logged in user<\/p>\n
await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);<\/p>\n
Enter fullscreen mode\n\n\n\nExit fullscreen mode\n<\/code><\/pre>\nHttpContext.SignOutAsync uses Authentication service’s Cookie Handler to expire the cookie that contains the logged in user details (a ClaimsPrincipal) and makes the HttpContext.User as anonymous<\/p>\n
Access the ClaimsPrincipal (logged in user)<\/p>\n
After the authentication middleware derives a valid ClaimsPrincipal from the cookie, it sets the user details (ClaimsPrincipal) in the HttpContext.User object
\n Hence<\/p>\n
HttpContext.User?.Identity?.IsAuthenticated can be used to determine if a request is authenticated
\n HttpContext.User.Identity.Name can be used to determine the logged in user name<\/p>\n