Wsrtjtyk

Migrating an SPA web app (Angular) and ASP Core Web API from Auth0 auth provider to Identity framework due to some requirements and limitations.

Until now everything was handled by auth0 and I didn't give it a much thought about the whole process of authentication. I would simply redirect users to auth0 hosted login page where it'd handle everything, callback with access token and I would use it for calls to API where API would just verify the JWT.

Now that I need to do this all manually, I am a bit confused. I want to have multiple authentication options: either Email/Password or OIDC auth providers like Google/Github.

I can get access token from these OIDC providers without much problem. But what do I do exactly with it, or to be more precise how do I configure Identity framework to handle the rest, without doing a lot of manual work? All users have quite a bit of additional data inside Identity framework user classes and I'm not fully sure how do i connect that to OIDC tokens.

Sorry for a bit abstract question, I think I'm missing some small detail, but at the moment I'm just really confused.

A lot of this is in place already, so to test the OIDC tokens, you just need them to be accepted by your consuming API.

To do so, you need to do some configuring, probably the same as you did for Auth0. Since the dependency here of the external providers, I'll post a link:

MSDN Google Auth

• register your API with the exteral provider


• use the, provider dependent, instructions to set it up in your API.

The providers are additional to the one you have in placed and are referenced by Identity as ExternalProviders

In general, it's pretty easy. Possible some things are left out, since I don't know your exact use case.

So you are using an Identity Provider, previously Auth0, and now another (or custom) one.

Just for sanity a recap of your use case:

• You trust the Identity Provider so every token signed by this provider is valid.


• Your Identity Provider (and the external ones e.g; Facebook, Google etc) are responsible for their own user management.


• Your own Identity Provider needs to handle specific authentication methods, tested against a corporate UserStore. These need to be managed, possibly with AD, Identity username/password or something similar.


• Your Identity Provider provides authentication through JWTs


• You also want to use external Identity Providers like Facebook etc.

So, as for the setup, you must do the following:

• Implement (or reuse, or use ActiveDirectory or any other) user management tools, if you need to perform some management on them. This means password recovery and all that stuff, which is available in a lot of standard libraries (I think it comes out of the box in Identity)


• Define clients, scopes and claims throughout your system(s). Possibly there is some effort to be made.


• Make sure the JWT's are accepted as authentication throughout your system (this was already in place) and the proper claims are assigned when called for the correct client.


• Register your API with the external providers


• Setup your API to accept the external JWT tokens (needs some setup with secrets and API keys)

A lot of this is already in place in the Identity framework. There is an article about it here.

If you are willing to do a good exercise (and a lot of work), you could also try to implement things fully customized with IdentityServer4