Asp.net core User Authentication and Authorization

Question

Hello, I have the following conceptual and architectural problem of an application.

-Scenario:

There is an application that has user table, user permissions and user groups already defined in the system. For a part of this application that will be developed we will use these permissions to log, authenticate and authorize these same users c their respective permissions to operate in this new part of the application.

-Doubt: Every solution that involves this part of Authentication and Authorization I see only documentation and articles using the Identity of . NET, would have some alternative solution or I get through this my existing base integrate it with idendity?

*Obs: This application will be an angular SPA consuming an API with this Authentication information.

Answer 1

It is possible to change the tables used by Identity, however, it would still be necessary for its table structure to be compatible with it. For any other "ready" alternative the problem would be the same.

To create your own alternative you would need to be aware of all your requirements (including the structure of existing tables) and I imagine you would not get an answer in the OS.

If your question is "how to implement Identity using a specific data structure", the . net code is open source and you are free to modify it.

Now, if your question is "how to have authentication and authorization", you do not need to make use of Identity. Vc could use JWT, for example.

Following the instructions of this post you can protect your endpoints in the same way, with the AuthorizeAttribute and use the methods AddAuthentication, AddJwtBearer, UseAuthentication and UseAuthorization to configure the authentication.

In Startup.Configure

app.UseAuthentication();
app.UseAuthorization();

In Startup.ConfigureServices

services.AddAuthentication(x =>
{
  x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
  x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(x =>
{
  (Suas configurações...)
});

services.AddScoped<IUserService, UserService>();

IUserService

public interface IUserService
{
  User Authenticate(string username, string password);
  IEnumerable<User> GetAll();
}

UserService: Implement as per your needs.

To implement authorization can become a little more complex depending on your existing tables. If it is possible to map existing data to roles, simply add the Claim ClaimTypes.Role to the user token and protect the methods with [Authorize(Roles = Role.Admin)], as demonstrated in this other example.