Single Sign-on Authentication and authorization in ASP.NET Core.png

sso.tar.gz

Stand Alone Auth Provider

Client App Only

Full Authentication Flow

Full Authentication Flow With Secondary App

Blazor WebAssembly OIDC

Client and back-end

Securing web applications is extremely important, as you do not want unauthorized people to gain access to your data. The most convenient way of securing an application is to use single sign-on (SSO) because it allows users to authenticate once and gain access to all apps within the same system.

In this course, you’ll cover the process of using SSO in ASP.NET Core apps. You’ll also cover its usage inside all application types supported by ASP.NET Core, including MVC, web API, gRPC services, Blazor, and SignalR.

By the end of this course, you will have learned what SSO consists of, what protocols it uses, and how it’s configured inside an ASP.NET Core middleware. You will also have learned how to secure any endpoints, pages, and views supported by ASP.NET Core.

Using Single Sign-On for Securing Applications in ASP.NET Core

To enable asynchronous calls in the browser

To send data from the server to the client

To establish a persistent two-way communication channel between the client and the server

What is the primary role of SignalR?

It's a resource in the cloud that scales out SignalR connections.

To define pieces of logic that can be invocable by the connected clients

The whole application becomes a SignalR hub if it configures the SignalR dependencies.

To send messages to the connected clients

What is the role of a SignalR hub?

SignalR has its own bespoke authentication mechanism.

SignalR itself cannot be protected by authentication and it relies on the host app to secure it.

**(Select all that apply.)** Which authentication mechanisms can be used to secure a SignalR hub? 

(Select all that apply.) Which authentication mechanisms can be used to secure a SignalR hub?

In the `Authorization` header with the value prefixed with `Bearer`

In the `access_token` query string parameter

How can an access token be passed to the SignalR hub if you use WebSockets in a client application that is hosted separately from the server application?

How can an access token be passed to the SignalR hub if you use WebSockets in a client application that is hosted separately from the server application?

Adding the `[Authorize]` attribute to the hub class signature

Adding the `[Authorize]` attribute to every individual method we want to restrict

Leaving no attributes on the method that you don't want to restrict

Adding the `[AllowAnonymous]` attribute to the method you don't want to restrict

Assume you want to restrict all but one SignalR hub method to be accessible only by authenticated users. Which step will be the most efficient for this? 

Assume you want to restrict all but one SignalR hub method to be accessible only by authenticated users. Which step will be the most efficient for this?

Test your knowledge of securing SignalR endpoints.

Introduction to Single Sign-On (SSO)

JWT and Authorization Middleware

Enabling SSO in MVC Apps

Enabling SSO in Razor Pages

Enabling SSO in Web API

Enabling SSO in Blazor

Enabling SSO in gRPC

Enabling SSO in SignalR

Wrapping Up

Appendix

Quiz Yourself on SSO in SignalR