Authentication verifies that a user or other client is who they claim to be. In an online shop, shoppers can browse the catalog without signing in, but placing an order requires a registered user. Authentication establishes identity; authorization decides whether that identity has permission to access a resource. section 8.6 section 1.1
Single sign-on (SSO) lets multiple applications rely on one identity provider (IdP). When an unauthenticated user requests a protected page, the application redirects them to the IdP. After login, a token accompanies the return redirect, and temporary storage such as a browser cookie retains the authenticated state. The token eventually expires. OpenID Connect (OIDC) handles authentication in this arrangement; OAuth can handle authorization alongside it. section 8.1 section 8.6
In an ASP.NET Core storefront, separate the two jobs that are easy to confuse:
- Register cookie authentication as the default scheme. It reads and validates the current authentication cookie. section 8.3
- Register OIDC as the default challenge scheme. It redirects an unauthenticated visitor who requests a protected resource to the IdP. section 8.3
- Configure the OIDC connection with the IdP authority URL and a backchannel HTTP client for direct communication. section 8.3
builder.Services.AddAuthentication(options =>
{
options.DefaultScheme =
CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme =
OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(
CookieAuthenticationDefaults.AuthenticationScheme)
.AddOpenIdConnect()
.ConfigureWebAppOpenIdConnect();
The startup registration shows the cookie and OIDC schemes assigned to different roles, then adds both handlers. section 8.3
Register authorization and place authentication and authorization middleware in the request pipeline. Mark a UI resource with `[Authorize]` when it requires an authenticated visitor. An authenticated UI can also pass credentials and permission information to a backend API using a JWT; that is a separate step from signing the visitor into the UI. section 8.3 section 8.6
@attribute [Microsoft.AspNetCore.Authorization.Authorize]
The `[Authorize]` attribute is the small, concrete step that makes a UI resource require authentication. section 8.3
