Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
.NET Day 19 - Authentication and Authorization ...
Search
dotnetday
May 28, 2019
Technology
0
320
.NET Day 19 - Authentication and Authorization in ASP.NET Core by Damien Bowden
dotnetday
May 28, 2019
Tweet
Share
More Decks by dotnetday
See All by dotnetday
.NET Day 2025: Developing ASP.NET Core Microservices with Dapr: A practical guide
dotnetday
0
5
.NET Day 2025: Enhancing Legal Document Analysis with Reflection Agents, Semantic Kernel, and Azure AI Search
dotnetday
0
8
.NET Day 2025: Future-Proof Your Blazor Apps with bUnit
dotnetday
0
6
.NET Day 2025: .NET Core Testing: pushing the limits
dotnetday
0
5
.NET Day 2025: The best ways to use the latest OpenAPI features in .NET 9!
dotnetday
0
8
.NET Day 2025: Supercharged Search with Semantic Search and Vector Embeddings
dotnetday
0
5
.NET Day 2025: Tickets to Ride: Conquering Booking Chaos with Resilient .NET Architecture
dotnetday
0
6
.NET Day 2025: Code smarter, not harder: How AI Coding Tools Boost Your Productivity
dotnetday
0
9
.NET Day 2024: Mastering Integration Testing for .Net Web Apis With Webapplicationfactory and Testcontainers
dotnetday
0
80
Other Decks in Technology
See All in Technology
Flutterでキャッチしないエラーはどこに行く
taiju59
0
210
コスト削減の基本の「キ」~ コスト消費3大リソースへの対策 ~
smt7174
2
320
ヘブンバーンズレッドにおける、世界観を活かしたミニゲーム企画の作り方
gree_tech
PRO
0
430
7月のガバクラ利用料が高かったので調べてみた
techniczna
3
810
Snowflakeの生成AI機能を活用したデータ分析アプリの作成 〜Cortex AnalystとCortex Searchの活用とStreamlitアプリでの利用〜
nayuts
0
140
PRDの正しい使い方 ~AI時代にも効く思考・対話・成長ツールとして~
techtekt
PRO
0
310
クラウドセキュリティを支える技術と運用の最前線 / Cutting-edge Technologies and Operations Supporting Cloud Security
yuj1osm
2
250
モバイルアプリ研修
recruitengineers
PRO
5
1.7k
退屈なことはDevinにやらせよう〜〜Devin APIを使ったVisual Regression Testの自動追加〜
kawamataryo
4
1.1k
モダンフロントエンド 開発研修
recruitengineers
PRO
9
6.1k
おやつは300円まで!の最適化を模索してみた
techtekt
PRO
0
250
制約理論(ToC)入門
recruitengineers
PRO
9
3.7k
Featured
See All Featured
Facilitating Awesome Meetings
lara
55
6.5k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
48
9.7k
Intergalactic Javascript Robots from Outer Space
tanoku
272
27k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
30
9.6k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
46
7.6k
Java REST API Framework Comparison - PWX 2021
mraible
33
8.8k
Making the Leap to Tech Lead
cromwellryan
134
9.5k
The Power of CSS Pseudo Elements
geoffreycrofte
77
5.9k
Documentation Writing (for coders)
carmenintech
73
5k
Site-Speed That Sticks
csswizardry
10
800
Designing for humans not robots
tammielis
253
25k
Agile that works and the tools we love
rasmusluckow
330
21k
Transcript
ASP.NET Core Security • Damien Bowden Microsoft MVP • https://damienbod.com
• @damien_bod
https://github.com/damienbod ASP.NET Core, OpenID Connect, OAuth, Identity, Azure Angular, angular-auth-oidc-client
npm
Security & Applications today OpenID Connect, OAuth2 Authorization: ASP.NET Core
Policies
Security & Applications today
Application
Application Authentication Business Data Access Authorization Identity
Application Authentication Business Data Access Authorization Identity Application 2 Authentication
Business Data Access Authorization Identity
Application Authentication Business Data Access Authorization Identity Application 2 Authentication
Business Data Access Authorization Identity
None
None
HTTPS everywhere, Certs
WAF HTTPS everywhere, Certs Protected Zone
WAF HTTPS everywhere, Certs Protected Zone
Authentication, Authorization, Accounting Session Protection HTTP headers HTTPS Certs TLS
1.2, 1.3 WAF Web Application Firewall
Authentication Authorization Signout Session
USE Standards Don’t implement this yourself, use certified libs, packages,
tested
None
OAuth2 OpenID Connect Authentication Authorization Delegated
OpenID Connect http://openid.net/connect/ • Standard, Specification • Authentication and Authorization
• built on top of OAuth2 (access control) • Identity (Person can have n Identities) • UserInfo Endpoint
Open ID Connect (OIDC) is supported by almost all systems
. Azure AD, Azure B2C, OKTA, IdentityServer4, google accounts, Openiddict, node-oidc-provider
Authentication Authorization Signout Session
OpenID Connect Flows OAuth2 Flows http://openid.net/specs/openid- connect-core-1_0.html OAuth2 Resource Owner
Credentials Flow OpenID Connect Code flow OpenID Connect Hybrid flow OpenID Connect PKCE Authorization Code Flow RFC 7636 OAuth Device Flow
id token token (access token) reference / self contained token
refresh token scope Back-Channel Front-Channel User Agent
OAuth2 Resource Owner Credentials Flow • MC to MC applications
• trusted client • grant_type=client_cred ential&client_id=xxxxx xxxxx&client_secret=xx xxxxxxxx • Limited user cases
OAuth2 Resource Owner Credentials Flow
OpenID Connect Authorization Code flow • Server to server applications
with User • Can keep secrets, is trusted • Client is authenticated • response_type = code
OIDC Authorization Code flow
OIDC Hybrid flow • Mix of the Code and Implicit
Flow • Can be used for Web applications with server side rendering. • response_type = code id_token | code id_token token | code token
OIDC Hybrid flow
Native App PKCE Authorization Code Flow RFC 7636 https://tools.ietf.org/html/rfc 7636
None
Single Page Applications Cookies OIDC Code Flow with PKCE OIDC
Implicit Flow
OpenID Connect Code flow with PKCE • For browser applications,
SPAs • Client is not authenticated, or trusted • response_type = code • NO SECRET
OAuth Device Flow RFC 7636 https://tools.ietf.org/html/dra ft-ietf-oauth-device-flow-12
None
https://github.com/damienbod/AspNetCoreHybridFlowWithApi https://github.com/damienbod/AspNetCoreWindowsAuth OpenID Connect Hybrid Flow / Code Flow Code
examples
None
None
None
https://github.com/damienbod/AspNetCoreHybridFlowWithApi https://github.com/damienbod/AspNetCoreWindowsAuth OAuth2 Resource Owner Credentials Flow Code examples
None
None
None
None
Authorization: ASP.NET Core Policies
Authorization is the responsibility of the Application / API, not
the STS. This can be implemented in an separate library.
Standard Requirements Complex Requirements Policies uses Requirements Authorization Handlers
Create a Requirement
Make a Handler
Create a Policy
Apply the Policy (Controller)
Apply the Policy (Razor Page)
Apply a Requirement directly
Handler with Resource
ASP.NET Core Policies, Handlers and Requirements makes it easy to
focus on Authorization
Thank you @damienbod
https://openid.net/developers/specs/ https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow https://medium.com/@darutk/diagrams-of-all-the-openid-connect-flows-6968e3990660 https://www.npmjs.com/package/angular-auth-oidc-client https://openid.net https://auth0.com/blog/cookies-vs-tokens-definitive-guide https://www.npmjs.com/package/angular-auth-oidc-client https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/authenticate https://scotthelme.co.uk/say-hello-to-security-txt https://csp-evaluator.withgoogle.com/