Using ASP.NET Core Identity with IdentityServer4 - Authentication

Question

I'm trying to get my head around how to implement security in a microservices environment and am currently toying with the idea of using .NET Core Identity for User access management (usernames, passwords, hashing, etc) and IdentityServer4 for token based authentication and management.

This is because I want a veriety of clients to authenticate: a Blazer web site that will use usernames and passwords; other internal APIs which may use tokens; and a mobile app which will also use OAUTH token/refresh token logic.

I am trying to implement all this in one microservice so there is just one place all clients go to authenticate - a gate keeper of sorts.

My questions is: is this a good idea or should I be splitting the services?

Secondly: Wnen I'm testing my Login API call from postman I'm getting a 404 as the API is trying to redirect me to a login page. I would expect a 401 here instead as I've defined the authentication scheme to be Bearer.

Here is my code:

   public void ConfigureServices(IServiceCollection services)
        {
       services.AddControllers().AddNewtonsoftJson();
       var connectionString = Configuration.GetConnectionString("DefaultConnection");
                
       //add Users and Role system
        services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(connectionString));

            //this configures the dependancy injection for the UserManager in the Identity controller constructor.
        services.AddIdentity<IdentityUser, IdentityRole>()
                .AddEntityFrameworkStores<ApplicationDbContext>()
                .AddDefaultTokenProviders();
    
       //add Client tokens system
      
       var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
            services.AddIdentityServer()
                .AddConfigurationStore(options =>
                {
                    options.ConfigureDbContext = builder =>
                        builder.UseSqlServer(connectionString,
                        sql => sql.MigrationsAssembly(migrationsAssembly));
                })
                .AddOperationalStore(options =>
                {
                    options.ConfigureDbContext = b => b.UseSqlServer(connectionString,
                        sql => sql.MigrationsAssembly(migrationsAssembly));
                })
               .AddAspNetIdentity<IdentityUser>();//required for Identity and IdentityServer4 to play nice together.
    
       //add authentication for this service
        services.AddAuthentication("Bearer")
           .AddIdentityServerAuthentication(options =>
           {
               options.Authority = "http://localhost:5001";//this service
               options.RequireHttpsMetadata = false;
               options.ApiName = "Identity";
           });
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            //  InitializeIdentityServerDatabase(app);

            app.UseHttpsRedirection();

            app.UseRouting();

            app.UseIdentityServer();

            app.UseAuthorization();
            
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }

you should read up on developing an IDP. With an IDP you want to redirect clients to your login page or a 3rd party login page instead of having the login page as part off the app trying to authenticate. — Kevin
@GuyLowe did you ever resolve this? I've been struggling with identity/identityserver4 for a loooooong time now, and I think I got it, would love to chat. — Aviad P.
No, not yet Aviad P We have put that development on hold for now but I would love to find out how you have gone with this. Can you add an answer here? — Guy Lowe

Tore Nestenius Tore Nestenius · Accepted Answer · 2020-08-27T06:59:21

The AddIdentityServerAuthentication will only kick in if you get a challenge back from the Authorization middleware, ie there is an authorize attribute on the controllers/actions.

In general I also I always recommend that you separate IdentityServer from your clients and APIs to get a better separation of concerns.

Using ASP.NET Core Identity with IdentityServer4 - Authentication

1 Answers