ASP.NET Core Identity architecture

ASP.NET Core Identity is a mature identity system that provides user management, role management, claim management, password management, sign-in management, external login management, two-factor authentication, email confirmation, phone number confirmation, security token management, user lockout, user unlock, user sign-out, user deletion, user recovery, and more.

Identity architecture explained

Entity typeDescription
UserRepresents a user.
RoleRepresents a role.
UserClaimRepresents a claim that a user possesses.
UserTokenRepresents an authentication token for a user.
UserLoginAssociates a user with a login.
RoleClaimRepresents a claim granted to all users within a role.
UserRoleA join entity that links users and roles.

Storing Identity data with EF Core

Defining entity types

public class User : IdentityUser<int>
{
    public DateTimeOffset CreationTime { get; set; } = DateTimeOffset.UtcNow;
}

public class Role : IdentityRole<int>
{
    public DateTimeOffset CreationTime { get; set; } = DateTimeOffset.UtcNow;
}

Configuring entity types

public class UserEntityTypeConfiguration : IEntityTypeConfiguration<User>
{
    public void Configure(EntityTypeBuilder<User> builder)
    {
        builder.ToTable("Users");
        builder.HasKey(x => x.Id);
        builder.Property(x => x.CreationTime);
    }
}

Reusing the Identity database context

dotnet add package Microsoft.AspNetCore.Identity.EntityFrameworkCore

public class IdentityServiceDbContext(DbContextOptions<IdentityServiceDbContext> options) : IdentityDbContext<User, Role, int>(options)
{
    protected override void OnModelCreating(ModelBuilder builder)
    {
        base.OnModelCreating(builder);
        builder.ApplyConfigurationsFromAssembly(Assembly.GetExecutingAssembly());
        AppContext.SetSwitch("Npgsql.EnableLegacyTimestampBehavior", true);
        AppContext.SetSwitch("Npgsql.DisableDateTimeInfinityConversions", true);
    }
}

Using the Identity API endpoints

builder.Services.AddIdentityApiEndpoints<User>(options => {
    options.Password.RequireDigit = false;
    options.Password.RequireLowercase = false;
    options.Password.RequireUppercase = false;
    options.Password.RequireNonAlphanumeric = false;
    options.Password.RequiredLength = 5;
    options.SignIn.RequireConfirmedAccount = false;
}).AddEntityFrameworkStores<IdentityServiceDbContext>();

app.MapGroup("identity").MapIdentityApi<User>();

Working with Identity data

Services such as UserManager, RoleManager, SignInManager, and PasswordValidator can all be used to work with Identity data. Unless there is a special case, it is not recommended to manipulate Identity data directly with a DbContext.

Using the Endpoints Explorer

In Visual Studio 2022 or later, open this feature via “View” > “Other Windows” > “Endpoints Explorer”.

Testing API endpoints

Tools such as the CURL command-line tool, the Edge network console, OpenApi, HTTP files, Postman, Insomnia, and the Visual Studio Code REST Client extension can all be used to test API endpoints.

Bearer authentication

Authorization : Bearer <token string>

Integrating Bearer authentication with OpenApi

services.Configure<SwaggerGenOptions>(options =>
{
    options.AddSecurityDefinition("bearerAuth", new OpenApiSecurityScheme
    {
        Type = SecuritySchemeType.Http,
        Scheme = "bearer",
        BearerFormat = "JWT",
        Description = "JWT Authorization header using the Bearer scheme."
    });

    options.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "bearerAuth" }
            },
            Array.Empty<string>()
        }
    });
});

References

https://learn.microsoft.com/zh-cn/aspnet/core/security/authentication/identity-api-authorization

https://www.cnblogs.com/dongfo/p/17808249.html