Authentication And Claim Based Authorization With ASP.NET Identity Core

The authentication determines application identity while authorization determines what a subject may or may not do. The claim based identity is nothing but attaching the concept of claim to the identity. The claims are not what the subject can and cannot do. They are what the subject is or is not. It does the simple process of the authentication.

When an identity is created for authenticated user, it may be assigned one or more claims which are issued by trusted party. The claim is a name-value pair that represents what the subject is or is not, instead of what the subject can and cannot do. The claim based authorization checks the value of the claim and allows access to the resource, based on that value.

For example, a person is an Indian civilian and may have a voter id card issued by Election Commission of India. The voter id has his or her age on it. In this case, the claim name would be Age and this claim value would be an age of a person. For example, if the age is 18 on it, that means the person has authority to cast his/her vote.

A claim can contain multiple values and an identity can contain multiple claims of the same type.

The source code of this article is available at MSDN Sample.

First, create an empty ASP.NET Core project. As this project doesn’t hold default implementation of ASP.NET Core Identity, we build an application step by step with ASP.NET Core Identity. We don’t have the default implementation of ASP.NET Core Identity so project.json file doesn't have any identity NuGet packages. Now, open the project.json file and modify it to add the dependencies and the tools, as per the code snippet given below.

This file includes NuGet packages for both Entity Framework Core and ASP.NET Core Identity.

Now, create custom ApplicationUser class, which inherits IdentityUser class. This class holds the additional field for the identity user. The IdentityUser class holds user basic information such as Email, UserName, Password etc. The ApplicationUser class extends this class. It is used to store the user information. The code snippet is given below for the same.

To perform the database operations, we create an IdentityDbContext class named ApplicationDbContext, as per the code snippet given below.

This class needs to know that which type Application user and role are dealing with the Application. We passed ApplicationUser and IdentityRole as a parameter, while creating the object of ApplicationDbContext class. Here, the third parameter represents the primary key data type for both IdentityUser and IdentityRole.

The application needs to configure to implement ASP.NET Core Identity. Now, add the identity in the method Configure of the Startup class. The code snippet is given below to add the identity in the Application.

As the concept of Dependency Injection is central to ASP.NET Core Application, we register context, identity and policy to Dependency Injection during the application start up. Thus, we register these as a Service in the ConfigureServices method of the StartUp class, as per the code snippet given below.

As per the above code snippet, we need to build and register the policy. This takes places as part of the Authorization service configuration. The claims requirements are policy based. We create policy which can contain one and more than one claims. The authenticate user has these claims then he/she authorizes to access the resources.

In this case the AddEditUser policy checks for the presence of an “Add User” and “Edit User” claims on the current identity.

Here, the DefaultConnection is the connection string, which is defined in appsettings.json file, as per the code snippet given below.

Now, we have configured settings to create the database, so we have time to create a database, using migration. For database migration , we need to follow the following steps.

1. Tools -> NuGet Package Manager -> Package Manager Console.
2. Run PM> Add-Migration MyFirstMigration to scaffold a migration to create the initial set of tables for our model. If we receive an error which states the term `add-migration' is not recognized as the name of a cmdlet, then close and reopen Visual Studio.
3. Run PM> Update-Database to apply the new migration to the database. Since our database doesn't exist yet, it will be created for us before the migration is applied.

This section demonstrates that how to create, edit and delete the identity users and how to assign the claims to a user. There is UserManager, which exposes the user related APIs. This creates the user in the Application and is stored in the database.

Now Claim data create which be assigned to user. The following code snippet for some claim data.

Now, we proceed to the controller. We create controller named UserController under the Controllers folder of the application. It has all ActionResult methods for the end user interface of operations. We create the UserManager instances. Subsequently, we inject it in the controller's constructor to get its object. The following is a partial code snippet for the UserController in which UserManager is injected, using constructor dependency Injection.

The AuthorizeAttribute attribute applied to the entire controller which means this controller access by authenticated users only.

We can notice that Controller takes UserManager as constructor parameter. ASP.NET Core Dependency Injection will take care of passing the instance of UserManager into UserController. The controller is developed to handle the operations requests for the application identity user. Now, let's develop the user interface for the user listing, add user, edit user and delete user. Let's see each one by one.

When we click on top User menu of the application, it shows the user listing, as shown in figure 1. The user data is displayed in a tabular format and on this view, it has linked to adding a new user, edit a user and delete a user.

To pass the data from the controller to view, create named UserListViewModel view model, as per the code snippet, mentioned below. This view model is used for the user listing.

Now, we create an action method, which returns an index view with the data. The code snippet of an Index action method in UserController is mentioned below.

Now, we create an index view, as per the code snippet, mentioned below under the User folder of the views.

It shows all the operational forms in the Bootstrap model popup, so create the user - index.js file, as per the code snippet given below.

When the Application runs and calls the index() action method from UserController with a HttpGet request, it gets all the users, which are listed in the UI, as shown in Figure 1.


Figure 1: Application User Listing

To pass the data from UI to a controller to add a user, it uses view model named UserViewModel. The code snippet is given below for the same.

The UserController has an action method, which is named as AddUser, which returns the view to add a user. The code snippet mentioned below is for same action method for both GET and Post requests.

As per above code snippet AddEditUser policy applied using the Policy property on the AuthorizeAttribute attribute to specify the policy name; in this instance only identities matching the policy will be allowed access to AddUserAction on the controller.

If we have a controller that is protected by the AuthorizeAttribute attribute, but want to allow anonymous access to particular actions we apply the AllowAnonymousAttribute attribute;

The CreateAsync asynchronous method of the UserManager class performs operation to creates new user in the Application. This method has new ApplicationUser as a parameter.

The GET request for the AddUser action method returns _AddUser partial view; the code snippet follows under the User folder of views.