Single Sign-on Authentication and authorization in ASP.NET Core.png

sso.tar.gz

Stand Alone Auth Provider

Client App Only

Full Authentication Flow

Full Authentication Flow With Secondary App

Blazor WebAssembly OIDC

Client and back-end

Securing web applications is extremely important, as you do not want unauthorized people to gain access to your data. The most convenient way of securing an application is to use single sign-on (SSO) because it allows users to authenticate once and gain access to all apps within the same system.

In this course, you’ll cover the process of using SSO in ASP.NET Core apps. You’ll also cover its usage inside all application types supported by ASP.NET Core, including MVC, web API, gRPC services, Blazor, and SignalR.

By the end of this course, you will have learned what SSO consists of, what protocols it uses, and how it’s configured inside an ASP.NET Core middleware. You will also have learned how to secure any endpoints, pages, and views supported by ASP.NET Core.

Using Single Sign-On for Securing Applications in ASP.NET Core

**(Select all that apply.)** What does a JWT consist of?

(Select all that apply.) What does a JWT consist of?

Any field in the payload section of a JWT

A field in the payload of a JWT that grants special privileges to the user

What is a claim in the context of JWT?

Having a field in the payload called `role` with an array of role names assigned to the user

Having each available role assigned as a field in the payload with the value set to `true`

Having the field with the name `role` inside the payload with the string value containing a comma-separated list of the role names that the user has been assigned to

What is a common way of storing user roles inside a JWT?

What is a common way of storing user roles inside a JWT?

It mandates that the user must have a specific role in order to be authorized.

It mandates that the user must have a specific custom claim in order to be authorized.

It can contain any custom authorization logic.

It is used where there are more than one authorization criteria.

What is an authorization policy in the context of the `Authorize` attribute?

What is an authorization policy in the context of the <code>Authorize</code> attribute?

The `[Authorize]` attribute on the endpoints that don't require the `admin` role and `[Authorize(Roles="admin")]` on the ones that do

The `[Authorize]` attribute at the class level and `[Authorize(Roles="admin")]` on the endpoints that require the `admin` role

The `[Authorize(Roles="admin")]` attribute at the class level and `[Authorize]` on the endpoints that don't require the `admin` role

Only `[Authorize(Roles="admin")]` on the endpoints that require the `admin` role

Imagine that you have an API controller consisting of 10 endpoints that all require the users to be authenticated. However, two endpoints require the `admin` role. Which configuration will be the most appropriate?

Imagine that you have an API controller consisting of 10 endpoints that all require the users to be authenticated. However, two endpoints require the <code>admin</code> role. Which configuration will be the most appropriate?

Test your knowledge of JWT and Authorization Middleware.

Introduction to Single Sign-On (SSO)

JWT and Authorization Middleware

Enabling SSO in MVC Apps

Enabling SSO in Razor Pages

Enabling SSO in Web API

Enabling SSO in Blazor

Enabling SSO in gRPC

Enabling SSO in SignalR

Wrapping Up

Appendix

Quiz Yourself on Authorization Middleware