Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
.NET Day 19 - Authentication and Authorization ...
Search
dotnetday
May 28, 2019
Technology
0
310
.NET Day 19 - Authentication and Authorization in ASP.NET Core by Damien Bowden
dotnetday
May 28, 2019
Tweet
Share
More Decks by dotnetday
See All by dotnetday
.NET Day 2024: Mastering Integration Testing for .Net Web Apis With Webapplicationfactory and Testcontainers
dotnetday
0
63
.NET Day 2024: Backend for Frontend as a Gateway to the World of Microservices
dotnetday
0
54
.NET Day 2024: Implementing the planet's largest e-commerce site using service boundaries
dotnetday
0
44
.NET Day 2024: Sitting in meetings all day long
dotnetday
0
43
.NET Day 2024: Evolutionary Architecture. The What. The Why. The How
dotnetday
0
52
.NET Day 2024: Onion, Hexagonal, Clean or Fractal Architecture? All of them, and more!!
dotnetday
0
62
.NET Day 2024: 100% Unit Test Coverage and beyond
dotnetday
0
49
.NET Day 2024: Five common mistakes with distributed systems
dotnetday
0
60
.NET Day 2024: Curious Code and Where to Find it
dotnetday
0
53
Other Decks in Technology
See All in Technology
ObsidianをMCP連携させてみる
ttnyt8701
2
140
AWS Summit Japan 2025 Community Stage - App workflow automation by AWS Step Functions
matsuihidetoshi
1
150
エンジニア向け技術スタック情報
kauche
0
110
Wasm元年
askua
0
100
Абьюзим random_bytes(). Фёдор Кулаков, разработчик Lamoda Tech
lamodatech
0
290
本当に使える?AutoUpgrade の新機能を実践検証してみた
oracle4engineer
PRO
1
120
AI技術トレンド勉強会 #1MCPの基礎と実務での応用
nisei_k
1
250
より良いプロダクトの開発を目指して - 情報を中心としたプロダクト開発 #phpcon #phpcon2025
bengo4com
1
390
AIの最新技術&テーマをつまんで紹介&フリートークするシリーズ #1 量子機械学習の入門
tkhresk
0
130
“社内”だけで完結していた私が、AWS Community Builder になるまで
nagisa53
1
230
Amazon S3標準/ S3 Tables/S3 Express One Zoneを使ったログ分析
shigeruoda
2
390
OpenHands🤲にContributeしてみた
kotauchisunsun
0
220
Featured
See All Featured
The Power of CSS Pseudo Elements
geoffreycrofte
77
5.8k
Building Applications with DynamoDB
mza
95
6.5k
It's Worth the Effort
3n
184
28k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
29
1.8k
How to train your dragon (web standard)
notwaldorf
92
6.1k
The Cost Of JavaScript in 2023
addyosmani
51
8.4k
Reflections from 52 weeks, 52 projects
jeffersonlam
351
20k
The Pragmatic Product Professional
lauravandoore
35
6.7k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
45
7.4k
Automating Front-end Workflow
addyosmani
1370
200k
Product Roadmaps are Hard
iamctodd
PRO
53
11k
The Language of Interfaces
destraynor
158
25k
Transcript
ASP.NET Core Security • Damien Bowden Microsoft MVP • https://damienbod.com
• @damien_bod
https://github.com/damienbod ASP.NET Core, OpenID Connect, OAuth, Identity, Azure Angular, angular-auth-oidc-client
npm
Security & Applications today OpenID Connect, OAuth2 Authorization: ASP.NET Core
Policies
Security & Applications today
Application
Application Authentication Business Data Access Authorization Identity
Application Authentication Business Data Access Authorization Identity Application 2 Authentication
Business Data Access Authorization Identity
Application Authentication Business Data Access Authorization Identity Application 2 Authentication
Business Data Access Authorization Identity
None
None
HTTPS everywhere, Certs
WAF HTTPS everywhere, Certs Protected Zone
WAF HTTPS everywhere, Certs Protected Zone
Authentication, Authorization, Accounting Session Protection HTTP headers HTTPS Certs TLS
1.2, 1.3 WAF Web Application Firewall
Authentication Authorization Signout Session
USE Standards Don’t implement this yourself, use certified libs, packages,
tested
None
OAuth2 OpenID Connect Authentication Authorization Delegated
OpenID Connect http://openid.net/connect/ • Standard, Specification • Authentication and Authorization
• built on top of OAuth2 (access control) • Identity (Person can have n Identities) • UserInfo Endpoint
Open ID Connect (OIDC) is supported by almost all systems
. Azure AD, Azure B2C, OKTA, IdentityServer4, google accounts, Openiddict, node-oidc-provider
Authentication Authorization Signout Session
OpenID Connect Flows OAuth2 Flows http://openid.net/specs/openid- connect-core-1_0.html OAuth2 Resource Owner
Credentials Flow OpenID Connect Code flow OpenID Connect Hybrid flow OpenID Connect PKCE Authorization Code Flow RFC 7636 OAuth Device Flow
id token token (access token) reference / self contained token
refresh token scope Back-Channel Front-Channel User Agent
OAuth2 Resource Owner Credentials Flow • MC to MC applications
• trusted client • grant_type=client_cred ential&client_id=xxxxx xxxxx&client_secret=xx xxxxxxxx • Limited user cases
OAuth2 Resource Owner Credentials Flow
OpenID Connect Authorization Code flow • Server to server applications
with User • Can keep secrets, is trusted • Client is authenticated • response_type = code
OIDC Authorization Code flow
OIDC Hybrid flow • Mix of the Code and Implicit
Flow • Can be used for Web applications with server side rendering. • response_type = code id_token | code id_token token | code token
OIDC Hybrid flow
Native App PKCE Authorization Code Flow RFC 7636 https://tools.ietf.org/html/rfc 7636
None
Single Page Applications Cookies OIDC Code Flow with PKCE OIDC
Implicit Flow
OpenID Connect Code flow with PKCE • For browser applications,
SPAs • Client is not authenticated, or trusted • response_type = code • NO SECRET
OAuth Device Flow RFC 7636 https://tools.ietf.org/html/dra ft-ietf-oauth-device-flow-12
None
https://github.com/damienbod/AspNetCoreHybridFlowWithApi https://github.com/damienbod/AspNetCoreWindowsAuth OpenID Connect Hybrid Flow / Code Flow Code
examples
None
None
None
https://github.com/damienbod/AspNetCoreHybridFlowWithApi https://github.com/damienbod/AspNetCoreWindowsAuth OAuth2 Resource Owner Credentials Flow Code examples
None
None
None
None
Authorization: ASP.NET Core Policies
Authorization is the responsibility of the Application / API, not
the STS. This can be implemented in an separate library.
Standard Requirements Complex Requirements Policies uses Requirements Authorization Handlers
Create a Requirement
Make a Handler
Create a Policy
Apply the Policy (Controller)
Apply the Policy (Razor Page)
Apply a Requirement directly
Handler with Resource
ASP.NET Core Policies, Handlers and Requirements makes it easy to
focus on Authorization
Thank you @damienbod
https://openid.net/developers/specs/ https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow https://medium.com/@darutk/diagrams-of-all-the-openid-connect-flows-6968e3990660 https://www.npmjs.com/package/angular-auth-oidc-client https://openid.net https://auth0.com/blog/cookies-vs-tokens-definitive-guide https://www.npmjs.com/package/angular-auth-oidc-client https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/authenticate https://scotthelme.co.uk/say-hello-to-security-txt https://csp-evaluator.withgoogle.com/