Using ASP.NET Core MVC cookie based authentication with custom user tables in database

Question

I have my own tables for Authentication:
Users
Roles
UserRoles

I am am trying to figure out what the best way to implement custom authentication with ASP.NET Core MVC would be. I do not want to use the built in UserManager, RoleManager, etc. I prefer creating my own. Can I somehow still tap into the cookie based authentication and use all of the ASP.NET Authorization helper tags without using asp.net identity?

Correct me if I am wrong, but I believe I want something like this: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie

@Win because I have been trying to figure out ASP.NET Identity for years and I am sick of not understanding every single part of it. I would rather implement my own auth just like the good old days. It is most likely my problem for not being able to read the documentation and pick up on it, but I cant stand Entity Framework / ASP.NET Identity. I am aware that ASP.NET Identity can be used without EF but just seems like a pain. Plus my ultimate goal would be to use IdentityServer at some point to auth my client apps and apps. Just not ready for that yet. — Blake Rivell
– Blake Rivell, Commented Jul 19, 2017 at 20:24
@Win I feel like this stuff isn't rocket science. I prefer understanding 100% of what I build so I try to limit as much third party use as possible. — Blake Rivell
– Blake Rivell, Commented Jul 19, 2017 at 20:26

Win · Accepted Answer · 2017-07-19 20:55:58Z

2

I have been trying to figure out ASP.NET Identity for years and I am sick of not understanding every single part of it. I would rather implement my own auth just like the good old days. It is most likely my problem for not being able to read the documentation and pick up on it, but I cant stand Entity Framework / ASP.NET Identity. I am aware that ASP.NET Identity can be used without EF but just seems like a pain.

Well, if you decided to go that route, you can use Cookie Authentication Middleware.

There are too many moving pieces, so I created a sample project in GitHub.

You can replace this LDAP Authentication with your own Authentication mechanism. Here is actual implementation.

The main reason I did not use ASP.NET Identity in some of my projects is we already have Active Directory in our organization.

Startup.cs

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
   Events = new CookieAuthenticationEvents
   {
      OnRedirectToAccessDenied = context =>
      {
         context.Response.StatusCode = (int) HttpStatusCode.Forbidden;
         return TaskCache.CompletedTask;
      }
   },
   ExpireTimeSpan = TimeSpan.FromMinutes(Int32.Parse(Configuration.GetSection(
       "AppSettings:CookieAuthentication:ExpireMinutes").Value)),
   AuthenticationScheme = Constants.AuthenticationScheme,
   LoginPath = new PathString("/Account/Login"),
   AccessDeniedPath = new PathString("/Common/AccessDenied"),
   AutomaticAuthenticate = true,
   AutomaticChallenge = true
});

edited Jul 19, 2017 at 20:55

answered Jul 19, 2017 at 20:35

Win

62.4k13 gold badges106 silver badges190 bronze badges

Sign up to request clarification or add additional context in comments.

10 Comments

Blake Rivell Over a year ago

thanks for this great response. I actually got it somewhat working for now but your post is going to help me fill in the blanks. So far I have it to the point where I am creating a cookie when a user logs in and I am able to access actions in controllers that have [Authorize] attribute on them. The next thing I am going to look into is how to set all of the UserRoles as Claims in the principal so they are stored in the cookie. Then I will be able to use those attributes too.

Blake Rivell Over a year ago

Now that the cookie is being stored in the browser do you know how I can access information from the cookie? For example, current logged in user etc. Typically I know I would get this information from the Identity Managers, but I am going to have to do it manually using HttpContext aren't I?

Win Over a year ago

In ASP.NET Core, we should use policy instead of role base. Here is how I convert role claims to policy.

Win Over a year ago

Here is a wrapper class for HttpContext so that I can unit test controllers, and here is how it is injected to view.

Win Over a year ago

Since most of us have role table, so we store authorized role as claims. Claims are then converted to policy. We then use authorize attribute to restrict access.

|

Collectives™ on Stack Overflow

Using ASP.NET Core MVC cookie based authentication with custom user tables in database

1 Answer 1

Startup.cs

10 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

10 Comments

Your Answer

Sign up or log in

Post as a guest

Related