Identity and Advanced Auth

🏰 ASP.NET Identity & Security: Your App’s Fortress

The Big Picture: Think of your app like a castle. ASP.NET Identity is the entire security system — the gates, guards, keys, guest lists, and secret passages. Let’s build your fortress together!

🎯 What You’ll Master

graph TD
    A["🏰 Your App Castle"] --> B["🔑 Identity Framework"]
    B --> C["👤 User Management"]
    B --> D["👑 Role Management"]
    B --> E["🏗️ Identity Scaffolding"]
    B --> F["🌐 External Auth"]
    B --> G["📱 Two-Factor Auth"]

🔑 Identity Framework: The Master Key System

What is it?

Imagine you have a magical key-making machine. This machine:

• Creates unique keys for each person
• Remembers which key belongs to whom
• Checks if someone’s key is real or fake

That’s ASP.NET Identity! It handles everything about “who you are” in your app.

Simple Example

// Adding Identity to your castle
services.AddIdentity<User, Role>()
    .AddEntityFrameworkStores<AppDb>()
    .AddDefaultTokenProviders();

What this does:

• AddIdentity = Install the key-making machine
• AddEntityFrameworkStores = Where to store all the keys
• AddDefaultTokenProviders = Magic tokens for password resets

Real Life Comparison

👤 User Management: Your Guest Book

The Story

Your castle needs a guest book. When someone wants to enter:

1. They sign up (write their name in the book)
2. They get a key (password created)
3. Next time, they show their key to enter

Creating a User

// A new person wants to join!
var user = new IdentityUser {
    UserName = "alex@castle.com",
    Email = "alex@castle.com"
};

// Give them a key (password)
var result = await userManager
    .CreateAsync(user, "SecretKey123!");

Finding a User

// Who's at the door?
var user = await userManager
    .FindByEmailAsync("alex@castle.com");

Checking the Key

// Is this the right key?
var correct = await userManager
    .CheckPasswordAsync(user, "SecretKey123!");

Quick Reference

👑 Role Management: The VIP System

The Story

Not everyone in your castle has the same access:

• Servants can enter the kitchen
• Knights can enter the armory
• King can enter everywhere

Roles are like VIP badges that give different permissions!

Creating Roles

// Make a VIP badge called "Knight"
await roleManager.CreateAsync(
    new IdentityRole("Knight")
);

Giving Someone a Role

// Make Alex a Knight!
await userManager.AddToRoleAsync(
    user, "Knight"
);

Checking Roles

// Is Alex a Knight?
var isKnight = await userManager
    .IsInRoleAsync(user, "Knight");

Protecting Areas

// Only Knights can enter here!
[Authorize(Roles = "Knight")]
public IActionResult Armory() {
    return View();
}

// Knights OR Kings can enter
[Authorize(Roles = "Knight,King")]
public IActionResult GreatHall() {
    return View();
}

graph TD
    A["User Arrives"] --> B{Has Role?}
    B -->|Knight| C["Enter Armory ✅"]
    B -->|King| D["Enter Everywhere ✅"]
    B -->|Servant| E["Kitchen Only ✅"]
    B -->|No Role| F["Blocked ❌"]

🏗️ Identity Scaffolding: Ready-Made Rooms

The Story

Building a castle from scratch takes forever! What if someone gave you pre-built rooms that you could customize?

That’s scaffolding — pre-made login pages, registration forms, and account management screens!

How to Get It

# Add the magic pre-built rooms
dotnet add package Microsoft.AspNetCore.Identity.UI

# Generate customizable pages
dotnet aspnet-codegenerator identity

What You Get

Customizing a Page

// In Areas/Identity/Pages/Account/Login.cshtml.cs
public class LoginModel : PageModel {

    // Add your own castle decorations!
    public async Task<IActionResult> OnPostAsync() {
        // Your custom login logic
    }
}

The Beauty

You don’t write everything from scratch. You get working pages and only change what you need!

🌐 External Authentication: Guest Passes

The Story

Sometimes, instead of making new keys, you let guests show ID cards they already have — like a driver’s license from another kingdom.

External auth lets users login with Google, Facebook, Microsoft, etc.!

Setting Up Google Login

Step 1: Tell your castle about Google

// In Program.cs
services.AddAuthentication()
    .AddGoogle(options => {
        options.ClientId = "your-google-id";
        options.ClientSecret = "your-secret";
    });

Step 2: Get credentials from Google

1. Go to Google Cloud Console
2. Create a project
3. Enable OAuth 2.0
4. Get your Client ID and Secret

The Magic Flow

graph TD
    A["User Clicks 'Login with Google'"] --> B["Redirect to Google"]
    B --> C["User Logs into Google"]
    C --> D[Google Says 'They're Real!']
    D --> E["Your App Creates Session"]
    E --> F["User is Logged In! ✅"]

Multiple Providers

services.AddAuthentication()
    .AddGoogle(g => { /* config */ })
    .AddFacebook(f => { /* config */ })
    .AddMicrosoftAccount(m => { /* config */ });

Why Users Love This

📱 Two-Factor Authentication: Double Locks

The Story

Imagine your castle door has two locks:

1. First lock = Your password (something you KNOW)
2. Second lock = A code from your phone (something you HAVE)

Even if a thief steals your key, they can’t get in without your phone!

Enabling 2FA

// Check if 2FA is on for a user
var is2faEnabled = await userManager
    .GetTwoFactorEnabledAsync(user);

// Turn on 2FA
await userManager
    .SetTwoFactorEnabledAsync(user, true);

Getting the Secret Key (for Authenticator Apps)

// Generate a secret key
var key = await userManager
    .GetAuthenticatorKeyAsync(user);

if (string.IsNullOrEmpty(key)) {
    await userManager
        .ResetAuthenticatorKeyAsync(user);
    key = await userManager
        .GetAuthenticatorKeyAsync(user);
}

Verifying the Code

// User enters code from their phone
var isValid = await userManager
    .VerifyTwoFactorTokenAsync(
        user,
        userManager.Options
            .Tokens.AuthenticatorTokenProvider,
        codeFromUser
    );

The 2FA Flow

graph TD
    A["Enter Password"] --> B{Password Correct?}
    B -->|Yes| C["Enter Code from Phone"]
    B -->|No| D["Access Denied ❌"]
    C --> E{Code Correct?}
    E -->|Yes| F["Welcome In! ✅"]
    E -->|No| D

2FA Options

Setting Up SMS 2FA

// Add phone number
await userManager.SetPhoneNumberAsync(
    user, "+1234567890"
);

// Send verification code
var code = await userManager
    .GenerateTwoFactorTokenAsync(
        user, "Phone"
    );
// Send this code via SMS service

🎯 Quick Summary

🚀 You Did It!

You now understand how to:

✅ Set up Identity Framework (the master security system) ✅ Create and manage users (the guest book) ✅ Assign roles (VIP badges) ✅ Use scaffolding (pre-built rooms) ✅ Add external logins (guest passes from other kingdoms) ✅ Enable two-factor auth (double locks)

Your castle is now secure and ready! Go build something amazing! 🏰🔐