Multifactor authentication

As explained in ASP.NET Core in Action, 3e

Multifactor authentication is authentication that requires evidence from multiple independent credential or verification factors.

Multifactor authentication (MFA) asks a user for both a password and an extra piece of information before sign-in. Two-factor authentication (2FA) is a form of MFA. The extra information might be a code sent to a phone by SMS or generated by a mobile authenticator app. section 23.1.2

If your ASP.NET Core application manages its own users, ASP.NET Core Identity provides support for MFA alongside password hashing and user lockout. Offering MFA is one part of protecting user accounts; it does not replace careful password handling or other security measures. section 23.1.2 section 29.4.4

To make MFA available through the default Identity UI:

• Let signed-in users open the account-management pages and configure MFA with an authenticator app. section 23.3.4
• Add a QR code generator to the enable-MFA page if you want that setup aid; it is a suggested customization, not part of the described default UI. section 23.3.4

Figure 23.10 Logging in with an existing user and managing the user account. The Login page describes how to configure external login providers, such as Facebook and Google. The user-management pages allow users to change their email and password and to configure MFA.

The login and account-management screens show where a signed-in user can find the option to configure MFA. section 23.3.4

Plan for MFA while building authentication rather than adding it as an afterthought. If you store user details yourself, offer MFA alongside safeguards such as hashed passwords and protection against weak or compromised passwords. section 29.4.4 section 29.5

How ASP.NET Core in Action, 3e covers it

How deep it goes

Defines MFA and points to Identity’s account-management setup, but defers QR-code customization and does not work through MFA implementation.

Examples

Uses SMS and mobile-app codes as sign-in examples and shows an account-management screen with an MFA configuration option.

What it assumes

Introduces MFA from its password-plus-extra-information definition while assuming an application with user sign-in for the Identity UI discussion.

What you can do after

Apply it via ASP.NET Core Identity by offering users authenticator-app setup and planning optional QR-code support.

How it connects

Connects MFA to ASP.NET Core Identity, authenticator apps, password hashing, user lockout, and account-management UI.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityMultifactor authentication is an identity-verification process that requires authentication factors from multiple categories before granting access.
• 

  liveBookmanning.com
  Microsoft Azure in ActionMulti-factor authentication (MFA) is an authentication technique that requires two or more independent types of evidence to verify an identity.
• 

  liveBookmanning.com
  Data-Driven CybersecurityAn authentication method requiring two or more independent factors to verify a user's identity.
• 

  liveBookmanning.com
  Software Security for DevelopersMultifactor authentication verifies identity using two or more independent authentication factors.
• 

  liveBookmanning.com
  Grokking Web Application SecurityMultifactor authentication is an authentication technique that requires a user to provide at least two distinct forms of identification.
• 

  liveBookmanning.com
  Azure SecurityMultifactor authentication is an authentication method that requires two or more independent factors to verify an identity.
• 

  liveBookmanning.com
  MongoDB 8.0 in Action, Third EditionMFA, or multifactor authentication, verifies an identity using two or more independent authentication factors.
• 

  liveBookmanning.com
  Amazon Web Services in Action, Third Edition: An in-depth guide to AWSMultifactor authentication is an authentication method that requires evidence from multiple independent credential factors.

Compare how 9 books explain multifactor authentication →

Related concepts

• Microsoft Entra IDused by · Microsoft Entra ID is Microsoft's cloud-based identity and access-management service for authenticating users, applications, and services and controlling their access to resources.
• authentication factoruses · An authentication factor is an independent category of evidence used to verify a subject’s identity during authentication.
• Keycloakused by · Keycloak is an open-source identity and access management platform that provides authentication, authorization, and single sign-on, including support for identity standards and federation.
• passwordless authenticationincludes · Passwordless authentication is an authentication method that verifies a user’s identity without requiring a conventional password.
• one-time codeused by · A one-time code is a temporary authentication credential accepted for a single attempt or operation, or during a limited validity period.
• inherence factoruses · An inherence factor is an authentication factor based on a distinctive biological or behavioral characteristic of the claimant.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.