Decoupling ASP.NET Identify From Your MVC 5 Application

For many of the same reasons I created class library that abstracts SimpleMembership I have created a class library for ASP.NET Identity.  I used the same interface I used in SimpleSecurity, which is basically the interface used by the class WebSecurity in SimpleMembership.  The beauty of this approach is that I could take my old models, views, and controllers from an application that used SimpleMembership and now just plugin the new ASP.NET Identity.  The main difference is that anywhere that the user ID that uniquely defines a member is used it is now a string instead of an integer, because that is the default for ASP.NET Identity. There are methods to have it use an integer as well and I am debating incorporating that into this class library.

All of the code for this is open source and available on the SimpleSecurity Project.  Just go to the Source Code page and download it. The class library is located in AspNetIdentity\SimpleSecurity.AspNetIdentity.  The filters for authorization are located in AspNetIdentity\SimpleSecurity.AspNetIdentity.Filters and there is a reference application in AspNetIdentity\SimpleSecurity.AspNetIdentity.RefApp. The reference application demonstrates how to setup migrations, email confirmation during registration, password reset with a token, using basic authentication on Web API's, how to create an authorization attribute that uses ASP.NET Identity, and how to decouple your security model from your application model.

To use this in a new project it will have to be an MVC 5 application. If you have an existing MVC 4 application there are instruction for upgrading to MVC 5 here.  You get the new MVC 5 assemblies with NuGet. You will also need to use NuGet to get the assemblies for OWIN and ASP.NET Identity. You can use the reference application to see exactly what assemblies are required.  You will also need to incorporate Startup.Auth.cs in your App_Start directory and Startup.cs in the root of your application. Again, use the reference application to get the content of these classes.  You will also need to configure the database initializer for migrations of SimpleSecurity database in your web.config.

I hope this helps you get a jump start on using ASP.NET Identity. The lack of documentation is rather frustrating at this time and hopefully these examples will help.  I also think that using SimpleSecurity is a better approach to using ASP.NET Identity rather than the code that is generated by the T4 template that peppers your application code with Entity Framework and data storage details that should not be part of your application domain.  And since ASP.NET Identity is still in flux it gives you one class library to update rather than finding code scattered in your MVC application.

As always, I am interested in ways to make SimpleSecurity better and I am interested in your comments. You can comment on this blog or on the Issues page in the SimpleSecurity project.


Comments

Post a Comment

Popular posts from this blog

Using Claims in ASP.NET Identity

Claims can simplify and increase the performance of authentication and authorization processes. I wrote about how you can use the roles stored as claims to eliminate back-end queries every time authorization takes place .  ASP.NET Identity has good support for claims-based identity and it creates several claims for you automatically when you create a new identity.  Here is how we create the identity for a new user during the log-in process UserManager<applicationuser> userManager = new UserManager<applicationuser>(new UserStore<applicationuser>(new SecurityContext())); ClaimsIdentity identity = userManager.CreateIdentity(user, DefaultAuthenticationTypes.ApplicationCookie); If you inspect the Claims property of ClaimsIdentity after calling CreateIdentity you will see that there are there are three or more claims. There is a claim for the user ID, user name, identity provider and one for each role assigned. So what if you want to add some more claims? Here is an ex
Keep reading

Customizing Claims for Authorization in ASP.NET Core 2.0

Image
There have been some major changes to ASP.NET Identity with the release of Core 2.0, which you can read about here .  One of the major changes is that it does not rely on using middleware anymore to customize it.  Instead dependency injection is used by configuring via services in the ConfigureServices method of StartUp.cs .   There is not much documentation or examples on how to do this so I am going to explore how to customize ASP.NET Identity and publish some examples in this blog.  First I wanted to look at how you would add custom claims to the identity and then use those claims for authorization. To begin create a new ASP.NET Core Web Application  project in Visual Studio 2017.  Be sure to select . NET Core and ASP.NET Core 2.0 in the two drop downs at the top.  Select the template for Web Application (Model-View-Controller) and Change the Authentication to Individual User Accounts .  When the project is created you are ready to add some code. For this example we are s
Keep reading

Seeding & Customizing ASP.NET MVC SimpleMembership

Image
In ASP.NET MVC 4 Microsoft introduced a new membership provider that is referred to as SimpleMembership.  SimpleMembership makes it easier to customize user profiles and incorporates  OAuth support.  I have seen a lot of questions on StackOverflow on how to customize SimpleMembership and seed it with data and in this post I will discuss some methods for achieving both . SimpleMembership uses Entity Framework (EF) 5 and the code-first model. To initialize the database that contains the users and roles a filter is used called  InitializeSimpleMembershipAttribute.   This attribute is decorated on the AccountController as shown here: [Authorize] [InitializeSimpleMembership] public class AccountController : Controller { ... } This is setup this way so that the initialization code is only called when accessing the actions on the AccountController .  If you look at the code for  InitializeSimpleMembershipAttribute you will see a lot of code to setup initialization which is basically
Keep reading