Select Page
ASP.NET Core Identity Claims based Authorization

ASP.NET Core Identity Claims based Authorization

This is the second post in the series – ASP.NET Core Security. In my last post, I covered how to get started with ASP.NET Core Identity. In this article, we will learn about claims and how to implement ASP.NET Core Identity claims-based authorization.

  1. ASP.NET Core Identity – Getting Started
  2. ASP.NET Core Identity Claims based Authorization

Before you start reading this I would suggest that first, you read my previous article about ASP.NET Core Identity – Getting Started

What are the claims?

The identity of the user consists of a set of properties like Unique Id, Name, Email Id, Email Verified, etc and these properties are called claims. A claim set is a list of properties that belongs to the user. Claims contain information about the user that can be used to build a flexible authorization model. These claims get assigned to the user when a new user is created using the register link. A claim is typically like a key-value pair.

ASP.NET Core Identity by default comes with claims for a user and we can implement our own custom claims as well. There can be multiple claims of the same type.

Authorization using a claim can be implemented based on the value of the claim for that user. Access to protected resources can be determined by comparing the claims needed to access the resource with the claims available for the user.

Implement a Custom Claim

In our previous demo, we created a custom user profile property Full Name which we will add to our list of custom claims i.e. claim list will contain a custom claim ‘FullName’

We will work on the source code which we created as part of the previous article where we added Identity to an existing Sample Blog Application. Here is the link to base source code which will be used for this demonstration.

Display all claims

First, let’s add a link to display all the claims from the identity of the logged-in user. We will add a new link ‘Claims’ besides post link & corresponding action in new user controller & cshtml to display all the available claims.

Add user controller

Add user controller to implement action for list of claims for the user

[Authorize]
public class UserController : Controller
{
    private readonly ILogger<UserController> _logger;

    public UserController(ILogger<UserController> logger)
    {
        _logger = logger;
    }

    public IActionResult Claims()
    {
        return View();
    }
}

Add view to display claims

This cshtml will iterate claims in identity user object to display all the available claims.

@model List<Post>
@{
    ViewData["Title"] = "View User Claims";
}
<h1>@ViewData["Title"]</h1>

<br />

@if (User.Identity.IsAuthenticated)
{
    <table class="table table-responsive-sm">
        @foreach (var claim in User.Claims)
        {
        <tr>
            <td>@claim.Type</td>
            <td>@claim.Value</td>
            <td>@claim.Issuer</td>
        </tr>
        }
    </table>
}

Add link for claims

We will add a menu or link besides posts link to display all claims. This will call Claims action in the User controller to display claims.cshtml which contains logic to display all claims of the logged-in user. Add the below code in application _Layout.cshtml page

<li class="nav-item">
    <a class="nav-link text-dark" asp-area="" asp-controller="User" asp-action="Claims">Claims</a>
</li>

Running the application & clicking on claims (post login) will display list of claims as shown below

List of Identity claims

We can see the list of default identity claims and now lets try to understand how to add a custom claim to identity.

Add custom claims

As part of article Identity – getting started we created a custom user profile property Full Name & now let’s make that Full Name as part of claims by adding a custom claim.

Add application level user claims principal factory

We will have to add application specific user claim principal factory that derives from Identities generic user claim principal factory which takes type of application specific user class i.e. SampleAppUser. In this we will have to override function GenerateClaims and add our application specific claim ‘FullName’ to it.

public class ApplicationUserClaimsPrincipalFactory : UserClaimsPrincipalFactory<SampleAppUser>
{
    public ApplicationUserClaimsPrincipalFactory(
        UserManager<SampleAppUser> userManager,
        IOptions<IdentityOptions> options
        ) : base(userManager, options)
    {

    }

    protected override async Task<ClaimsIdentity> GenerateClaimsAsync(SampleAppUser user)
    {
        var identity = await base.GenerateClaimsAsync(user);

        identity.AddClaim(new Claim("FullName",
            user.FullName
            ));

        return identity;
    }
}

Register claims factory in startup class

You will have have to add an application-specific user claims principal factory to dependency injection container.

services.AddScoped<IUserClaimsPrincipalFactory<SampleAppUser>, ApplicationUserClaimsPrincipalFactory>();

Now when you run the application and navigate to claim link and post login you should be able to see FullName in claims list.

Identity - Custom List of claims

Claim based authorization

ASP.NET Core Identity claims can be used to implement authorization i.e. based on user claim value we can decide whether access to a specific resource will be able or not to that user. e.g. in our case, we can configure authorization based on email id i.e. only user with email id [email protected] should be able to view the post details page.

Claims based Authorization

Implement claim based authorization

In our Sample Blog App, we will implement authorization based on email id i.e. if user email id is [email protected] then access to action Details in post controller will be allowed else it will be denied.

Register claim policy in startup class

Add the policy for user email id in the startup class. Here we have registered an authorization policy named EmailID using claim key http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name (email id) equal to [email protected] Add this code does not enable any authorization as it is registering a policy. We will have to apply this policy either to a controller or action to enable it.

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllersWithViews();
    services.AddRazorPages();

    services.AddAuthorization(options =>
    {
        options.AddPolicy("EmailID", policy =>
        policy.RequireClaim("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "[email protected]"
        ));
    });
}

Apply claim policy to controller action

Claim policy EmailID which we created above is applied to Action Details in the posts controller. This means that posts/details is allowed only for the user whose email id is [email protected]

[Authorize(Policy = "EmailID")]
public IActionResult Details(string id)
{
    Post post = DataHelper.GetAllPosts().Find(p => p.Id.Equals(id));
    return View(post);
}

You can specify multiple policies as well for controller or actions. In case of multiple policies all the policies need to confirm before granting access.

Now run the run and check action post/details with different users. We will see that action post/details is allowed to [email protected] and access is denied to user [email protected]

Identity Claim Authorization Allowed
Identity Claim Authorization Denied

Summary

In this article, we learned about Identity claims, configure custom claims & claim based authorization. Though claims can be used for authorization roles are a more standard way of implementing authorization as the same role can be specified for multiple users.

In our next article in this series for ASP.NET Core Identity, we will learn about roles and how to how to implement role-based authorization.

References – https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims?view=aspnetcore-3.1

Download Source Code

ASP.NET Core Identity – Getting Started

ASP.NET Core Identity – Getting Started

This article is first in the series – ASP.NET Core Security. Here we will see what is ASP.NET Core Identity and how to get started. To understand things better we will explicitly add identify to an existing ASP.NET Core web application.

  1. ASP.NET Core Identity – Getting Started
  2. ASP.NET Core Identity Claims based Authorization

What is Identity?

ASP.NET Core Identity

ASP.NET Core Identity is authentication & authorization API and is used to implement security-related features in your ASP.NET Core Applications. ASP.NET Core Identity is a built-in membership system or framework which allows us to implement

  • Manage User Accounts
  • Authentication & Authorization
  • Email confirmation
  • Password Recovery
  • Two factor Authentication
  • External login providers like Microsoft, Google, Facebook etc

Identity source code is available on GitHub. SQL Server is the generally preferred database to store identity-related data like user name, password & user-related data. Alternatively, Azure table storage is also supported.

Implement ASP.NET Core Identity

Sample Application Details

Below is the GitHub link to sample ASP.NET Core Web Application which has been created to implement identity

When you download, build & run above visual studio project you can see below mentioned functionality available in application & also anyone can browse the application with no need to provide user credentials.

  • View list of posts
  • View details of each post
ASP.NET Core App 1
ASP.NET Core App 2

Add Identity to Sample Application

To add identity right click on project in solution explorer and select Add=>New Scaffolded Items from the context menu.

Add New Scaffolded Items

On selecting Add New Scaffolded Item below dialog appears where you need to select Identity under Installed and click on Add Button.

Add Microsoft Identity

After adding Identity you need to specify few things on the screen below

  1. Select the layout page from the project files
  2. Select Login & Logout file to be overridden
  3. Select Register file
  4. Add new data context class using + sign button
  5. Add new User class using + sign button
Select Scaffolded Items

ASP.NET Core Identity has provided with the ready library but you can override the standard implementation by scaffolding the items which you need to override.

Also above actions installs following NuGet packages implicitly.

Microsoft.VisualStudio.Web.CodeGeneration.Design
Microsoft.EntityFrameworkCore.Sqlsever
Microsoft.EntityFrameworkCore.Tools
Microsoft.AspNetCore.Identity.UI
Microsoft.AspNetCore.Identity.EntityFrameworkCore

ASP.NET Core Identity makes use of Entity Framework to manage user profiles. If you need further details on how an entity framework works then check my other article on Entity Framework Core in ASP.NET Core 3.1

Generated Code Explained

Areas/Identity/IdentityHostingStartup.cs file this works like a starting class for the project and is called each time the project starts. This class holds the configuration of identity-related services & Entity framework configuration for identity.

public class IdentityHostingStartup : IHostingStartup
{
    public void Configure(IWebHostBuilder builder)
    {
        builder.ConfigureServices((context, services) => {
            services.AddDbContext<SampleAppContext>(options =>
                options.UseSqlServer(
                    context.Configuration.GetConnectionString("SampleAppContextConnection")));

            services.AddDefaultIdentity<SampleAppUser>(options => options.SignIn.RequireConfirmedAccount = true)
                .AddEntityFrameworkStores<SampleAppContext>();
        });
    }
}

Areas/Identity/SampleAppUser.cs file which derives from Identity User. This class allows you to add your own fields for user profiles. Identity framework comes with default properties for user profile you can add your application-specific properties here. After adding properties you will have to modify Register Screen to capture new properties for the user.

public class SampleAppUser : IdentityUser
{
    public string FullName { get; set; }
}

Area/Identity/SampleAppContext.cs file which is the entity framework context class used by Identity.

public class SampleAppContext : IdentityDbContext<SampleAppUser>
{
    public SampleAppContext(DbContextOptions<SampleAppContext> options)
        : base(options)
    {
    }

    protected override void OnModelCreating(ModelBuilder builder)
    {
        base.OnModelCreating(builder);
        // Customize the ASP.NET Identity model and override the defaults if needed.
        // For example, you can rename the ASP.NET Identity table names and more.
        // Add your customizations after calling base.OnModelCreating(builder);
    }
}

Also SQL Server connection is added to Appsettings.json file.

  "ConnectionStrings": {
    "SampleAppContextConnection": "Server=(localdb)\mssqllocaldb;Database=ProCodeGuide.Sample.Blog;Trusted_Connection=True;MultipleActiveResultSets=true"
  }

Add Migrations

To automate the migrations & create a database for Identity we need to run the following commands in the package manager console.

add-migration InitialMigration
update-database
Identity Database

You can see that Application specific property ‘FullName’ for user which we configured is also part of AspNetUsers table.

You can also explore the cshtml files for Login, Logout & Register which are available in folder Areas/Identity/Pages/Account

Execute Application

After building and running application still you don’t see any changes no login screen & no security added to action view all post & post details. Still you need to do following changes for identity related links to appear and to secure your actions.

For Identity-related links Login, Logout (after login) & Register to appear to add following code to application layout file i.e Views/Shared/_Layout.cshtml. Add it in the header tag.

<div class="col-md-2">
    <partial name="_LoginPartial.cshtml" />
</div>

To secure your actions add Authorize attribute (part of Microsoft.AspNetCore.Authorization namespace) either at a controller level for all actions or at Action level for specific actions.

[Authorize]
public class PostsController : Controller
{
    //Remaining code has been removed
}

Make changes to Startup class to add Authentication, Razor Pages & Endpoints for Razor Pages

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllersWithViews();
        services.AddRazorPages();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
        }
        app.UseStaticFiles();

        app.UseRouting();

        app.UseAuthentication();

        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
            endpoints.MapRazorPages();
        });
    }
}

Now when you run application and try to navigate to post pages it will redirect you to login page if you are not logged in already. Register link is also available to create new users.

Identity Login Screen
Identity Logged in User Screen

Also, note that only users with confirmed email are allowed to log in so after registering a user link to confirm the email is available which should be clicked to confirm email. Ideally, a mail should be sent out to the user to confirm email but by default, email support is not enabled so the link has been provided directly for an email confirmation.

Save custom user properties to database

ASP.NET Core Identity allows us to add custom fields to the user profile. Previously we added new user profile property Full Name but we did not add any code to save it to the database. Here we will make changes to save the same to the database as part of registering a new user.

First, we will have to make changes in Areas/Identity/Pages/Account/Register.cshtml to add an input box for user to enter it as part of the registration process. We will below HTML in Register.cshtml before Email Input

<div class="form-group">
    <label asp-for="Input.FullName"></label>
    <input asp-for="Input.FullName" class="form-control" />
    <span asp-validation-for="Input.FullName" class="text-danger"></span>
</div>

Then we need to add FullName property in InputModel class in Register.cshtml.cs

public class InputModel
{
    [Required]
    [StringLength(25, ErrorMessage = "The {0} must be at least {2} and at max {1} characters long.", MinimumLength = 10)]
    [Display(Name = "Full Name")]
    public string FullName { get; set; }

    //Remaining Code has been removed
}

Finally we need set the value for FullName property in OnPostAsync method in Register.cshtml.cs file. Modify code as show below to set FullName from InputModel.

var user = new SampleAppUser { UserName = Input.Email, Email = Input.Email, FullName = Input.FullName };

After running code you should be able to see Full Name text box in Register form & on Register click the value entered in text box is saved to database in AspNetUsers table in column FullName.

Identity Register With Custom Field

Summary

In this first article for security series, we saw how to add Identity to additional ASP.NET Core application. We added Identity to add functionalities like Login, Logout & Register. We also saw how to secure our resources so that unauthorized access to the application is blocked.

Download Source Code

References – https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-3.1&tabs=visual-studio

Series: ASP.NET Core Security

Series: ASP.NET Core Security

ASP.NET Core Security

These days web applications are vulnerable to various attacks so there is a need to secure your application so that unauthorized users are not able to access it. ASP.NET Core Security provides a various mechanism to secure you applications i.e. authentication, authorization, data protection, Secure Socket Layer (HTTPS), app secrets, etc. This series will try to cover security techniques in detail to make you aware of various ways available to secure your applications.

Here is the list of posts in this series.

  1. ASP.NET Core Identity – Getting Started
  2. ASP.NET Core Identity Claims based Authorization

Also I will be listing new posts here when they are published.

ASP.NET Core Security Techniques

There are many in-built as well as third party tools & libraries available which can be used in ASP.NET Core applications to implement security-related features like authentication, authorization, etc.

Authentication

There are applications that have user-specific data i.e. user’s stocks, bank balance, mails, etc and this data is confidential so it should not be viewable by other users. Authentication helps you in identifying the user’s identity i.e. which user is accessing your application. The user has to prove his/her identity by providing the credential i.e. user id/password and in some cases, there might additional security features like multi-factor authentication.

Authorization

Once the user is identified and able to access your application then the next step is to determine what actions the user is able to perform. A superuser might be able to create data and other normal users might be able to view data added by the superuser but not delete allowed to delete records. Now authentication & authorization are two different things but they go hand in hand.

Data Security

Data security is about securing confidential application data from unauthorized access. Data should be secure between server round trips Also, access to the database should be secured.

Other Vulnerabilities

There are lots of other attacks against which ASP.NET Core security provides ways to secure our applications. To name a few of the other vulnerabilities like SQL Injection, Cross-Site Request Forgery, Server Version Disclosure, etc.

References: https://docs.microsoft.com/en-us/aspnet/core/security/?view=aspnetcore-3.1