ASP.NET Core Identity provides interfaces and high-level abstractions for managing and storing user accounts in ASP.NET Core applications. In a board-game API, it supplies the account foundation for restricting data-changing endpoints to authorized users. Its EF Core integration lets those accounts live alongside the existing application data. section 9.2 section 9.0
A practical setup follows the path from user data to HTTP requests:
- Install the Identity core, EF Core provider, and JWT bearer authentication NuGet packages. section 9.2.1
- Create a user entity derived from IdentityUser, then change the existing database context to IdentityDbContext<ApiUser>. The base user class supplies the properties needed for the initial implementation. section 9.2.2 section 9.2.3
- Create and apply an EF Core migration. Check that the new Identity tables appear in the database; their default names begin with AspNet. section 9.2.4
- Register Identity with EF Core stores and password requirements. Configure JWT bearer authentication to validate the token issuer, audience, and signing key, then place authentication before authorization in the HTTP pipeline. section 9.2.5
- Add registration and login endpoints so clients can create accounts and obtain temporary access tokens. section 9.2
Listing 9.1 Program.cs file: Identity service
using Microsoft.AspNetCore.Identity; #1
builder.Services.AddDbContext<ApplicationDbContext>(options =>
options.UseSqlServer(
builder.Configuration.GetConnectionString("DefaultConnection"))
);
builder.Services.AddIdentity<ApiUser, IdentityRole>(options => #2
{
options.Password.RequireDigit = true; #3
options.Password.RequireLowercase = true;#3
options.Password.RequireUppercase = true;#3
options.Password.RequireNonAlphanumeric = true;#3
options.Password.RequiredLength = 12;#3
})
.AddEntityFrameworkStores<ApplicationDbContext>();
The service-registration listing shows where Identity connects to the database context and how password requirements are set. section 9.2.5
Bearer tokens suit this stateless API better than session cookies, while avoiding the additional management work of API keys. Identity also supports authorization approaches based on roles, claims, and policies. Authentication and authorization remain security-sensitive: protect tokens, review implementation choices, and keep security guidance current. section 9.1.2 section 9.6
