I have an asp.net core web app and I am using the built-in authorization system from Microsoft.
I have a number of areas, controllers and actions; every area, controller and action has its own separate claim.
I am running into a problem in that the webapp just crashes after a user logs in (no errors in output window). I am guessing this has to do with a maximum somewhere but I am not sure.
Is it ok to use 200+ claims?
The documents / tutorials I found are not clear about this.
Ruud answered the question. https://leastprivilege.com/2016/12/16/identity-vs-permissions/ look in the comments above.
The link states claims or not meant for use in complex authorization.
I ended up building my own autorization system.
Related
I'm developing an intranet application that will be hosted behind an appliance that performs user authentication, then adds a unique user identifier to the header each authorized request it passes through. Which is to say, all the hard stuff is already done.
How can I configure ASP.NET Core to utilize the supplied header? User accounts with the associated request header are accessible from Entity Framework, but it's an Oracle provider, with a nonstandard schema. I'm using .net 5.0.
I assume this is relatively simple to implement, but I've been digging through documentation for a couple days and so far I've only found things that don't quite do what I need.
I'm not looking for a complete solution, just hoping to be pointed in the right direction. I'm not confident that what I've written so far is correct, but the project I'm experimenting on is based off the dotnet new mvc --auth individual starting template. Any advice or examples would be greatly appreciated.
If i get the question right, all the hard stuff was gone and now we just need to pull related information based on a given userId.
If that's the case, I would recommend to define your own AuthenticationMiddleware, that would not doing anything related to validate the user, but rather to pull user information from some where and cache it(with a reasonable expiration and clear cache by key mechanism).
Then, every request came after, just took the info from cache then build our own User object that would stick to each HttpContext. This is the final result we should aiming to.
All the process that should make use of AuthenticationSchemeOptions and AuthenticationHandler to build our own authentication middleware. Take a look at this would be good for a starting point.
When I started development of my current project I had no knowledge or prior experience of web development, ASP.Net (Core), C#, JS and so on.
With a lot of reading, excercising and testing I now have an ASP.Net Core 2.2 web application with multi-tenancy based on the database-per-tenant strategy hosted on Azure with Azure SQL as backend.
I have a solution with 2 projects:
the MVC web application that also has the .Net Core Identity from which I use the individual user accounts stored in ASPNet... tables (I did implement my custom UI, mainly so I could use the Localization middleware already used throughout the application)
a data layer that contains the db context's, the data models and the repository
Now I need at add an API.
The sole purpose of the API is cleary defined: give customers(tenants) the possibility to import and export data, most likely connected to other customer's application(s). This API will not be used by the UI. The API will not be hit with thousands of queries per second. It will be part of a business solution with 50 to 200 customers who will perform occassional import/export actions.
I have already implemented Identity and the authentication for the API should be done against the users setup in Identity but with a different authentication mechanism.
I have done a fair bit of searching and reading and found many tutorials/blogs on how to create a WebAPI with .Net Core but they all start from a new project and never go much more into depth. The once that really go in-depth are too complex for me ...
I have 3 questions unanswered at the moment although I know that there's probably more than 1 good answer to each of the questions but I think these are the likes of questions that many in my position, beyond the newbie/beginner but not yet a seasoned veteran, have and are searching for so I hope this post helps not just me but many others as well.
Question 1 - Architecture, where to create the API (project)?
There are 3 possibilities:
1 Add APIControllers to the MVC application (organize API-related classes in separate folders)
Benefits
quick and easy, everything else is already in place
deploys with the solution
Concerns
as it is part of the solution it becomes very monolithic, less flexible
Questions
can I implement a second authentication/authorization mechanism next to the implemented individual user accounts? (more detailed in the second question which is all about security)
2 Add a WebAPI project to the solution
Benefits
better separation but can still use/reference the resources of the other projects
probably gives benefits for scaling and tuning?
Questions
can I implement a second authentication/authorization mechanism next to the implemented individual user accounts leveraging the Identity of the MVC project? (more detailed in the second question which is all about security)
is this project separately published to Azure (or any cloud provider for that matter) using the www.example.com/api path (virtual directory) or is the solution published a whole?
3 Create a separate solution with the WebAPI project and include the data layer project
Benefits
full separation although sharing the use of the data layer project
completely independent with regards to deployment, scalability etc.
Concerns
maybe adds a layer of unnecessary complexity (the API will not handle thousands of requests per second)
Everything that is already configured/setup in the MVC project and that is required will need to be redone
Questions
can I include the data layer project in the solution (it is then part of 2 solutions) or should I reference it as a dll?
Question 2 - how to implement Authentication/Authorization that resides side-by-side with the Identity individual user account?
This is related only to the first 2 options of the architecture as in the third option the project would be on it's own.
The basic question is how to setup more than one authentication mechanism, one for UI users and another for API access.
First there is the choice of Authentication, most of tutorials blogs talk about JWT and Auth (OAuth?). I am not asking what the "best" solution is but which solution would be "preferred" by B2B customers who are the only ones that will use the API.
I am not sure how to redirect to the right authentication: when a request is sent to an API controller method with the Authorize attribute and the user hasn't been authenticated yet it needs to reply with an error.
Currently if a method with the Authorize attribute is executed by an unauthenticated user the user is redirected to the login page as configured in startup.cs:
public void ConfigureServices(IServiceCollection services)
{
...
services.PostConfigure<CookieAuthenticationOptions>(IdentityConstants.ApplicationScheme,
opt => {
opt.LoginPath = "/User/Login";
...
Do I need to configure this with something like the example I found below:
app.UseWhen(x => (x.Request.Path.StartsWithSegment("/api", StringComparison.OrdinalIgnoreCase)),
builder =>
{
builder.UseMiddleware<AuthenticationMiddleware>();
});
or is this configured in a different way?
In the case of creating the API as a separate project should I use the "Multiple startup projects" option? I guess this means that I need to create the whole startup.cs again?
Question 3 - if I want to offer my customers a REST API and an OData API, can I handle this through a single API or do I need to develop a second to support OData?
I know it is lengthy but I'm sure that others are looking for similar information and I'd appreciate any input.
Thanks
I want to make a quick, safe and nice application.
For many years I have been programming in PHP and regular ASP. But wanted to go on with .NET and vue.js.
So I have an idea, I wanted to create and plan to do it like this:
I was thinking of using hosting from an external service.
Then I would have three projects:
domain.com/index - Vue.js which will be a SPA, where the user can filter through a catalog, press like and send few api requests (mainly get-requests).
secure.domain.com - Here I will have a .net mvc project where I can use identity. This will make it simple to handle/register users. I will also give the correct session here for authenticated users. And it will affect domain.com/index, where they only are allowed to do some of the things if they are logged in
api.domain.com - This will be the webapi api. Only authenticated users will be allowed to send some of the requests.
I have used several weeks at looking into how to structure this.
But as I do not have much experience with this.
What pitfalls and bad consequences do you see in structuring it like this?
Are there any heads up you want to give me? Or any other recommendations?
I have been trying to melt all of this together in one project, but that has been difficult, because they operate in different ways. So now I have ended up with this, and look forward to
Size of project
It will be a relative small project.
People should be able to register/authenticate themselves (through facebook/google/server login).
Authenticated People should be able to add records(links) to a database. When adding this to the database they may also want to upload files, and choose some additional information.
All people should be able to filter through the catalog of records (5000+) ( Here I am using vue.js/vuex/axios). Here they should be able to comment too on links too.
Webapi will have 8 entities/tables and one view which will GET all the information. 3 tables should be able to have POST.
So it is more or less a catalog, where people should be able to add records and find new ones.
I was planning to use the identity from asp.net core 3.1. It is a "template" where I can easily add 3rd party logins. (https://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity?view=aspnetcore-3.1&tabs=visual-studio)
Additional questions:
Can you tell me how request from SPA will be authenticated in your API? (Jwt or cookie)? Why would you like to have a separate identity service, also Why you would like to use asp.net identity (is it because of ease of setup)?
I have not been thinking about authenticating API requests. Was thinking to only have authenticated users who can send POST-requests. And the rest will be get requests. Limited only from the server. Should I have some additional authentication? Does JWT make web APIs safe enough for my use?
Was thinking of using .net identity because it is simple. And I don't want to use time on setting it up.
Since this is your first project of this type, I would recommend to keep it simple.
Just create one web site. Otherwise you might get issues with the cookies not working for subdomains and you will also get issues with CORS. That is, you will get all problems at the same to time (configuration issues, infrastructure issues and the pain from writing the application itself).
You can still have a clean separation by using sub folders (or Areas in MVC) and by using class libraries for the backend (API) business logic.
Once you have mastered the basics (i.e. writing the actual application) you can start looking at other means of separation etc.
I want to get two statistics (Visits today, visits total) from my GoogleAnalytics account.
I checked Google Analytics resources such as
https://developers.google.com/analytics/devguides/reporting/?hl=en
https://developers.google.com/analytics/devguides/reporting/core/v3/reference
But it seems pretty time-consuming to get a certain ID, oAuth and everything working.
I do not need any user authentication, just an API request from my backend (GA authentication should be provided via request url for example).
To be honest, I found myself jumping from one link to another when doing tutorial and did not accomplish anything at the end.
What is the quickest way to get everything working? If there is a nice tutorial on getting JUST basic (two numbers) stuff from GoogleAnalytics I would be very grateful (everything I see is working almost as GA itself - just with custom styles/graphs etc. I need plain and simple number returned via REST api for instance.)
Thanks for any info!
Auth is understandably complicated, but it sounds like you need service account authentication since you are querying your own data and need it to run on the back end.
The quickest way to get from zero to querying the API is to follow the Hello Analytics Guide. I have linked you to the PHP service account page. But there are examples of service accounts, web apps, and installed apps in four different languages.
But an outline of the main steps are
Create a project in the Google developer console
Within that project create a service account and download the p12 file.
add that service account email to the particular view you wish to query.
You are now ready to modify the Hello Analytics example.
Below is a simple query for the number sessions today:
function getResults(&$analytics) {
return $analytics->data_ga->get(
'ga:XXXX', // Replace with your view ID.
'today',
'today',
'ga:sessions');
}
Feel free to ask any clarifying questions in the comments section.
I'm pretty much a newbie in programming C# and I've been looking for quite some time now.
I need help with page authentication in a Silverlight navigation application.
I have a SQL Database running and a WCF service that gets the credentials out of that database. When the user is logged in he needs to see a link in the upper right corner with his profile.
How can I do this without using any help from silverlight? Is this even possible? Can I write a class that says "this user is authenticated and can see the following pages" on my own?
This is a really urgent issue. So thanks in advance for anyone's help!
Firstly use AspNet Membership ,
Most of classes you need implemented yet.
This link shows you how to setup membershipt tables to your SQL Server DB.
http://weblogs.asp.net/sukumarraju/archive/2009/10/02/installing-asp-net-membership-services-database-in-sql-server-expreess.aspx
In membership struct you can register,delete, lock - unlock ,store user details operations,... and more easier.
Here is an article explains implementation of membership for you,
http://blogs.msdn.com/b/kylemc/archive/2010/05/10/using-asp-net-membership-in-silverlight.aspx