I keep coming back to these basic walk throughts of the complex topic of authentication / authorization as really they are the best way I found to get my head wrapped around this topic
First of all, thanks for that content. It's pure gold. I was coding along the tutorial, and got the InvalidOperationException when trying to call the SignInAsync method inside the login route, and I had the exact same code as Anton. If anyone else is getting the error, to fix that you have to pass the scheme in the ClaimsIdentity constructor: var identity = new ClaimsIdentity(claims, AuthScheme);
Great video, thanks for your explaination. It helps me understand a lot about asp.net core authentication because there isn't any document for detailed
Hi, Anton. Thank you for your super usefull content. What do you think? I have some remote repository (web api) that provide permissions of authenticated user. Getting this permissions must be done in AuthenticationHandler or in AuthorizationPolicy when deciding if user allowed to have access to endpoint?
If i authorize with the IISAuthorizationScheme against a local Ad on Windows, which claims will be filled in the user object? Can i influence the process of building the user object? Thank you so much.
Lets say I have an ERP system and a user needs access to Contacts, Projects, inventory, Accounting, Leads, etc (each of those have read write update roles). This could lead to adding a lot of claims to the token. Is it ok to add many claims with their roles? Or would it be better to make another request to the Api to get the User's roles and permissions?
any of them even if they all are bit similar. But I can tell few tNice tutorialngs changed and also I forgot almost everytNice tutorialng so I guess Im gonna start
I have bit unrelated and general question. What do you think about Authentication with JWT and Asp.Net Identity. Is this simple stack enough to create API that's consumed by SPAs. Or should I opt in for advanced stuff like Microsoft Identity
Hi man, i have a question suppose i have this authorization/authentication builder combos //AUTHENTICATION string adminScheme = "admin-cookie"; string moderatorScheme = "moderator-cookie"; string VIPuserScheme = "vip-user-cookie"; string userScheme = "user-cookie"; builder.Services.AddAuthentication() .AddCookie(adminScheme) .AddCookie(moderatorScheme) .AddCookie(VIPuserScheme) .AddCookie(userScheme); //AUTHORIZATION builder.Services.AddAuthorization(builder => { builder.AddPolicy("admin-policy", policy => policy .RequireAuthenticatedUser() .AddAuthenticationSchemes(adminScheme) .RequireClaim(ClaimTypes.Role, "admin")); builder.AddPolicy("staff-policy", policy => policy .RequireAuthenticatedUser() .AddAuthenticationSchemes(moderatorScheme, adminScheme) .RequireClaim(ClaimTypes.Role, "moderator","admin")); builder.AddPolicy("vip-user-policy", policy => policy .RequireAuthenticatedUser() .AddAuthenticationSchemes(VIPuserScheme, moderatorScheme, adminScheme) builder.AddPolicy("user-policy", policy => policy .RequireAuthenticatedUser() .AddAuthenticationSchemes(userScheme, moderatorScheme, adminScheme) ); }); the first policy is for admin only users endpoints the second is for staff only users which is mainly for moderators but ofc admins can also do their actions the third is for registered users ( which includes mods and admins ) now what if i wanted to have more of a dynamic policy with some actions that can be performed only by certain moderators + all the admins like maybe i want some moderators to be able to edit some posts but not be able to delete them while some other moderators can so it's a mix between Roles and Priviledges assuming i had a DB my User model would look something like this public class User{ //usual stuff, id,username etc public string Role {get; set;} public List Priviledges {get; set;} } i know i could add some extra data in the claims maybe the array of priviledges? but if i were to remove some priviledges to a user they would remain in the cookie so i wonder if there is a better way to approach this? is there a video on your channel that explains something like that ? and if not what would you think a good approach could be ?
thank you for your question. first of all, reduce it all down to a single authentication schema if you can, that's un necessary duplication. for dynamic authorization check this video out: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-x7NxbZNboIc.html
