ASP.NET Core Identity Unleashed: Complete Guide to Registration, Roles, 2FA & Security (Part 13 of 40)

using Microsoft.AspNetCore.Identity;
using IdentityDemo.Models;

namespace IdentityDemo.Services
{
    public interface IRoleService
    {
        Task<List<IdentityRole>> GetAllRolesAsync();
        Task<IdentityRole?> GetRoleByIdAsync(string roleId);
        Task<IdentityResult> CreateRoleAsync(string roleName);
        Task<IdentityResult> UpdateRoleAsync(string roleId, string newRoleName);
        Task<IdentityResult> DeleteRoleAsync(string roleId);
        Task<List<ApplicationUser>> GetUsersInRoleAsync(string roleName);
        Task<IdentityResult> AddUserToRoleAsync(string userId, string roleName);
        Task<IdentityResult> RemoveUserFromRoleAsync(string userId, string roleName);
        Task<List<string>> GetUserRolesAsync(string userId);
        Task<bool> IsUserInRoleAsync(string userId, string roleName);
        Task<Dictionary<string, List<string>>> GetUsersWithRolesAsync();
    }

    public class RoleService : IRoleService
    {
        private readonly RoleManager<IdentityRole> _roleManager;
        private readonly UserManager<ApplicationUser> _userManager;
        private readonly ILogger<RoleService> _logger;

        public RoleService(
            RoleManager<IdentityRole> roleManager,
            UserManager<ApplicationUser> userManager,
            ILogger<RoleService> logger)
        {
            _roleManager = roleManager;
            _userManager = userManager;
            _logger = logger;
        }

        public async Task<List<IdentityRole>> GetAllRolesAsync()
        {
            return await _roleManager.Roles.ToListAsync();
        }

        public async Task<IdentityRole?> GetRoleByIdAsync(string roleId)
        {
            return await _roleManager.FindByIdAsync(roleId);
        }

        public async Task<IdentityResult> CreateRoleAsync(string roleName)
        {
            if (await _roleManager.RoleExistsAsync(roleName))
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = $"Role '{roleName}' already exists."
                });
            }

            var role = new IdentityRole(roleName);
            var result = await _roleManager.CreateAsync(role);

            if (result.Succeeded)
            {
                _logger.LogInformation("Role created: {RoleName}", roleName);
            }
            else
            {
                _logger.LogWarning("Failed to create role {RoleName}: {Errors}", 
                    roleName, string.Join(", ", result.Errors.Select(e => e.Description)));
            }

            return result;
        }

        public async Task<IdentityResult> UpdateRoleAsync(string roleId, string newRoleName)
        {
            var role = await _roleManager.FindByIdAsync(roleId);
            if (role == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "Role not found."
                });
            }

            role.Name = newRoleName;
            role.NormalizedName = newRoleName.ToUpper();

            var result = await _roleManager.UpdateAsync(role);

            if (result.Succeeded)
            {
                _logger.LogInformation("Role updated: {RoleId} to {NewRoleName}", roleId, newRoleName);
            }

            return result;
        }

        public async Task<IdentityResult> DeleteRoleAsync(string roleId)
        {
            var role = await _roleManager.FindByIdAsync(roleId);
            if (role == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "Role not found."
                });
            }

            // Check if there are users in this role
            var usersInRole = await _userManager.GetUsersInRoleAsync(role.Name!);
            if (usersInRole.Any())
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = $"Cannot delete role '{role.Name}' because it has users assigned."
                });
            }

            var result = await _roleManager.DeleteAsync(role);

            if (result.Succeeded)
            {
                _logger.LogInformation("Role deleted: {RoleName}", role.Name);
            }

            return result;
        }

        public async Task<List<ApplicationUser>> GetUsersInRoleAsync(string roleName)
        {
            return (await _userManager.GetUsersInRoleAsync(roleName)).ToList();
        }

        public async Task<IdentityResult> AddUserToRoleAsync(string userId, string roleName)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            if (!await _roleManager.RoleExistsAsync(roleName))
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = $"Role '{roleName}' does not exist."
                });
            }

            var result = await _userManager.AddToRoleAsync(user, roleName);

            if (result.Succeeded)
            {
                _logger.LogInformation("User {UserId} added to role {RoleName}", userId, roleName);
            }

            return result;
        }

        public async Task<IdentityResult> RemoveUserFromRoleAsync(string userId, string roleName)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            var result = await _userManager.RemoveFromRoleAsync(user, roleName);

            if (result.Succeeded)
            {
                _logger.LogInformation("User {UserId} removed from role {RoleName}", userId, roleName);
            }

            return result;
        }

        public async Task<List<string>> GetUserRolesAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return new List<string>();
            }

            return (await _userManager.GetRolesAsync(user)).ToList();
        }

        public async Task<bool> IsUserInRoleAsync(string userId, string roleName)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null) return false;

            return await _userManager.IsInRoleAsync(user, roleName);
        }

        public async Task<Dictionary<string, List<string>>> GetUsersWithRolesAsync()
        {
            var users = _userManager.Users.ToList();
            var result = new Dictionary<string, List<string>>();

            foreach (var user in users)
            {
                var roles = await _userManager.GetRolesAsync(user);
                result[user.Id] = roles.ToList();
            }

            return result;
        }
    }
}

Role Management Controller

Controllers/RoleController.cs

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using IdentityDemo.Models;
using IdentityDemo.Services;

namespace IdentityDemo.Controllers
{
    [Authorize(Roles = "Admin")]
    public class RoleController : Controller
    {
        private readonly IRoleService _roleService;
        private readonly IUserService _userService;
        private readonly ILogger<RoleController> _logger;

        public RoleController(
            IRoleService roleService,
            IUserService userService,
            ILogger<RoleController> logger)
        {
            _roleService = roleService;
            _userService = userService;
            _logger = logger;
        }

        [HttpGet]
        public async Task<IActionResult> Index()
        {
            var roles = await _roleService.GetAllRolesAsync();
            return View(roles);
        }

        [HttpGet]
        public IActionResult Create()
        {
            return View();
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> Create(string roleName)
        {
            if (string.IsNullOrWhiteSpace(roleName))
            {
                ModelState.AddModelError("", "Role name is required.");
                return View();
            }

            var result = await _roleService.CreateRoleAsync(roleName.Trim());
            
            if (result.Succeeded)
            {
                TempData["SuccessMessage"] = $"Role '{roleName}' created successfully.";
                return RedirectToAction("Index");
            }

            foreach (var error in result.Errors)
            {
                ModelState.AddModelError("", error.Description);
            }

            return View();
        }

        [HttpGet]
        public async Task<IActionResult> Edit(string id)
        {
            var role = await _roleService.GetRoleByIdAsync(id);
            if (role == null)
            {
                return NotFound();
            }

            return View(role);
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> Edit(string id, string roleName)
        {
            if (string.IsNullOrWhiteSpace(roleName))
            {
                ModelState.AddModelError("", "Role name is required.");
                return View();
            }

            var result = await _roleService.UpdateRoleAsync(id, roleName.Trim());
            
            if (result.Succeeded)
            {
                TempData["SuccessMessage"] = "Role updated successfully.";
                return RedirectToAction("Index");
            }

            foreach (var error in result.Errors)
            {
                ModelState.AddModelError("", error.Description);
            }

            return View();
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> Delete(string id)
        {
            var result = await _roleService.DeleteRoleAsync(id);
            
            if (result.Succeeded)
            {
                TempData["SuccessMessage"] = "Role deleted successfully.";
            }
            else
            {
                TempData["ErrorMessage"] = result.Errors.First().Description;
            }

            return RedirectToAction("Index");
        }

        [HttpGet]
        public async Task<IActionResult> UsersInRole(string roleName)
        {
            var users = await _roleService.GetUsersInRoleAsync(roleName);
            ViewData["RoleName"] = roleName;
            return View(users);
        }

        [HttpGet]
        public async Task<IActionResult> ManageUserRoles(string userId)
        {
            var user = await _userService.GetUserByIdAsync(userId);
            if (user == null)
            {
                return NotFound();
            }

            var userRoles = await _roleService.GetUserRolesAsync(userId);
            var allRoles = await _roleService.GetAllRolesAsync();

            var model = new ManageUserRolesViewModel
            {
                UserId = userId,
                UserName = user.UserName!,
                UserRoles = userRoles,
                AllRoles = allRoles.Select(r => r.Name!).ToList()
            };

            return View(model);
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> ManageUserRoles(ManageUserRolesViewModel model)
        {
            var user = await _userService.GetUserByIdAsync(model.UserId);
            if (user == null)
            {
                return NotFound();
            }

            // Get current roles
            var currentRoles = await _roleService.GetUserRolesAsync(model.UserId);

            // Roles to add
            var rolesToAdd = model.SelectedRoles.Except(currentRoles);
            foreach (var role in rolesToAdd)
            {
                await _roleService.AddUserToRoleAsync(model.UserId, role);
            }

            // Roles to remove
            var rolesToRemove = currentRoles.Except(model.SelectedRoles);
            foreach (var role in rolesToRemove)
            {
                await _roleService.RemoveUserFromRoleAsync(model.UserId, role);
            }

            TempData["SuccessMessage"] = "User roles updated successfully.";
            return RedirectToAction("Index", "UserManagement");
        }
    }

    public class ManageUserRolesViewModel
    {
        public string UserId { get; set; } = string.Empty;
        public string UserName { get; set; } = string.Empty;
        public List<string> UserRoles { get; set; } = new();
        public List<string> AllRoles { get; set; } = new();
        public List<string> SelectedRoles { get; set; } = new();
    }
}

7. Claims-Based Authorization {#claims-authorization}

Claims Management Service

Services/IClaimsService.cs

using Microsoft.AspNetCore.Identity;
using System.Security.Claims;
using IdentityDemo.Models;

namespace IdentityDemo.Services
{
    public interface IClaimsService
    {
        Task<List<Claim>> GetUserClaimsAsync(string userId);
        Task<IdentityResult> AddClaimToUserAsync(string userId, Claim claim);
        Task<IdentityResult> RemoveClaimFromUserAsync(string userId, Claim claim);
        Task<bool> UserHasClaimAsync(string userId, string claimType, string claimValue);
        Task<IdentityResult> AddClaimToRoleAsync(string roleId, Claim claim);
        Task<IdentityResult> RemoveClaimFromRoleAsync(string roleId, Claim claim);
        Task<List<Claim>> GetRoleClaimsAsync(string roleId);
    }

    public class ClaimsService : IClaimsService
    {
        private readonly UserManager<ApplicationUser> _userManager;
        private readonly RoleManager<IdentityRole> _roleManager;
        private readonly ILogger<ClaimsService> _logger;

        public ClaimsService(
            UserManager<ApplicationUser> userManager,
            RoleManager<IdentityRole> roleManager,
            ILogger<ClaimsService> logger)
        {
            _userManager = userManager;
            _roleManager = roleManager;
            _logger = logger;
        }

        public async Task<List<Claim>> GetUserClaimsAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null) return new List<Claim>();

            var claims = await _userManager.GetClaimsAsync(user);
            return claims.ToList();
        }

        public async Task<IdentityResult> AddClaimToUserAsync(string userId, Claim claim)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            // Check if claim already exists
            var existingClaims = await _userManager.GetClaimsAsync(user);
            if (existingClaims.Any(c => c.Type == claim.Type && c.Value == claim.Value))
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "Claim already exists for this user."
                });
            }

            var result = await _userManager.AddClaimAsync(user, claim);

            if (result.Succeeded)
            {
                _logger.LogInformation("Claim {ClaimType}:{ClaimValue} added to user {UserId}", 
                    claim.Type, claim.Value, userId);
            }

            return result;
        }

        public async Task<IdentityResult> RemoveClaimFromUserAsync(string userId, Claim claim)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            var result = await _userManager.RemoveClaimAsync(user, claim);

            if (result.Succeeded)
            {
                _logger.LogInformation("Claim {ClaimType}:{ClaimValue} removed from user {UserId}", 
                    claim.Type, claim.Value, userId);
            }

            return result;
        }

        public async Task<bool> UserHasClaimAsync(string userId, string claimType, string claimValue)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null) return false;

            var claims = await _userManager.GetClaimsAsync(user);
            return claims.Any(c => c.Type == claimType && c.Value == claimValue);
        }

        public async Task<IdentityResult> AddClaimToRoleAsync(string roleId, Claim claim)
        {
            var role = await _roleManager.FindByIdAsync(roleId);
            if (role == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "Role not found."
                });
            }

            var result = await _roleManager.AddClaimAsync(role, claim);

            if (result.Succeeded)
            {
                _logger.LogInformation("Claim {ClaimType}:{ClaimValue} added to role {RoleName}", 
                    claim.Type, claim.Value, role.Name);
            }

            return result;
        }

        public async Task<IdentityResult> RemoveClaimFromRoleAsync(string roleId, Claim claim)
        {
            var role = await _roleManager.FindByIdAsync(roleId);
            if (role == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "Role not found."
                });
            }

            var result = await _roleManager.RemoveClaimAsync(role, claim);

            if (result.Succeeded)
            {
                _logger.LogInformation("Claim {ClaimType}:{ClaimValue} removed from role {RoleName}", 
                    claim.Type, claim.Value, role.Name);
            }

            return result;
        }

        public async Task<List<Claim>> GetRoleClaimsAsync(string roleId)
        {
            var role = await _roleManager.FindByIdAsync(roleId);
            if (role == null) return new List<Claim>();

            var claims = await _roleManager.GetClaimsAsync(role);
            return claims.ToList();
        }
    }
}

8. Two-Factor Authentication (2FA) {#2fa}

2FA Implementation

Services/TwoFactorService.cs

using Microsoft.AspNetCore.Identity;
using System.Text;
using IdentityDemo.Models;

namespace IdentityDemo.Services
{
    public interface ITwoFactorService
    {
        Task<bool> IsTwoFactorEnabledAsync(string userId);
        Task<IdentityResult> EnableTwoFactorAsync(string userId);
        Task<IdentityResult> DisableTwoFactorAsync(string userId);
        Task<string> GenerateTwoFactorTokenAsync(string userId);
        Task<bool> VerifyTwoFactorTokenAsync(string userId, string token);
        Task<List<string>> GenerateRecoveryCodesAsync(string userId);
        Task<IdentityResult> RedeemRecoveryCodeAsync(string userId, string code);
        Task<int> GetRecoveryCodesLeftAsync(string userId);
    }

    public class TwoFactorService : ITwoFactorService
    {
        private readonly UserManager<ApplicationUser> _userManager;
        private readonly IEmailService _emailService;
        private readonly ILogger<TwoFactorService> _logger;

        public TwoFactorService(
            UserManager<ApplicationUser> userManager,
            IEmailService emailService,
            ILogger<TwoFactorService> logger)
        {
            _userManager = userManager;
            _emailService = emailService;
            _logger = logger;
        }

        public async Task<bool> IsTwoFactorEnabledAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            return user != null && await _userManager.GetTwoFactorEnabledAsync(user);
        }

        public async Task<IdentityResult> EnableTwoFactorAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            var result = await _userManager.SetTwoFactorEnabledAsync(user, true);
            
            if (result.Succeeded)
            {
                user.IsTwoFactorEnabled = true;
                await _userManager.UpdateAsync(user);
                
                _logger.LogInformation("2FA enabled for user: {UserId}", userId);
            }

            return result;
        }

        public async Task<IdentityResult> DisableTwoFactorAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            var result = await _userManager.SetTwoFactorEnabledAsync(user, false);
            
            if (result.Succeeded)
            {
                user.IsTwoFactorEnabled = false;
                await _userManager.UpdateAsync(user);
                
                _logger.LogInformation("2FA disabled for user: {UserId}", userId);
            }

            return result;
        }

        public async Task<string> GenerateTwoFactorTokenAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                throw new InvalidOperationException("User not found.");
            }

            // Generate the token (this would typically be for authenticator app)
            // For email/SMS, we'll generate a custom token
            var token = await _userManager.GenerateTwoFactorTokenAsync(user, "Email");
            
            // For demo purposes, we'll generate a 6-digit code
            if (string.IsNullOrEmpty(token))
            {
                var random = new Random();
                token = random.Next(100000, 999999).ToString();
            }

            // Send the token via email
            await _emailService.SendTwoFactorCodeAsync(user.Email!, token);

            _logger.LogInformation("2FA token generated for user: {UserId}", userId);
            return token;
        }

        public async Task<bool> VerifyTwoFactorTokenAsync(string userId, string token)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return false;
            }

            var isValid = await _userManager.VerifyTwoFactorTokenAsync(user, "Email", token);
            
            if (isValid)
            {
                _logger.LogInformation("2FA token verified for user: {UserId}", userId);
            }
            else
            {
                _logger.LogWarning("Invalid 2FA token for user: {UserId}", userId);
            }

            return isValid;
        }

        public async Task<List<string>> GenerateRecoveryCodesAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                throw new InvalidOperationException("User not found.");
            }

            var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
            
            if (recoveryCodes != null)
            {
                _logger.LogInformation("Recovery codes generated for user: {UserId}", userId);
                
                // Store recovery codes securely (in real app, you might want to hash them)
                var codes = recoveryCodes.ToList();
                
                // Send recovery codes via email
                await _emailService.SendRecoveryCodesAsync(user.Email!, codes);
                
                return codes;
            }

            return new List<string>();
        }

        public async Task<IdentityResult> RedeemRecoveryCodeAsync(string userId, string code)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            var result = await _userManager.RedeemTwoFactorRecoveryCodeAsync(user, code);
            
            if (result.Succeeded)
            {
                _logger.LogInformation("Recovery code redeemed for user: {UserId}", userId);
            }
            else
            {
                _logger.LogWarning("Failed to redeem recovery code for user: {UserId}", userId);
            }

            return result;
        }

        public async Task<int> GetRecoveryCodesLeftAsync(string userId)
        {
            var user = await _userManager.FindByIdAsync(userId);
            if (user == null) return 0;

            var recoveryCodes = await _userManager.CountRecoveryCodesAsync(user);
            return recoveryCodes;
        }
    }
}

9. User Management & Administration {#user-management}

User Management Service

Services/IUserService.cs

using Microsoft.AspNetCore.Identity;
using IdentityDemo.Models;

namespace IdentityDemo.Services
{
    public interface IUserService
    {
        Task<List<ApplicationUser>> GetAllUsersAsync();
        Task<ApplicationUser?> GetUserByIdAsync(string userId);
        Task<ApplicationUser?> GetUserByEmailAsync(string email);
        Task<IdentityResult> UpdateUserAsync(ApplicationUser user);
        Task<IdentityResult> DeleteUserAsync(string userId);
        Task<IdentityResult> DeactivateUserAsync(string userId);
        Task<IdentityResult> ActivateUserAsync(string userId);
        Task<List<ApplicationUser>> GetInactiveUsersAsync();
        Task<Dictionary<string, object>> GetUserStatisticsAsync();
        Task LogUserActivityAsync(string userId, string activity, string description);
        Task<List<UserLoginHistory>> GetUserLoginHistoryAsync(string userId, int days = 30);
        Task<bool> IsUserActiveAsync(string userId);
    }

    public class UserService : IUserService
    {
        private readonly UserManager<ApplicationUser> _userManager;
        private readonly ApplicationDbContext _context;
        private readonly ILogger<UserService> _logger;

        public UserService(
            UserManager<ApplicationUser> userManager,
            ApplicationDbContext context,
            ILogger<UserService> logger)
        {
            _userManager = userManager;
            _context = context;
            _logger = logger;
        }

        public async Task<List<ApplicationUser>> GetAllUsersAsync()
        {
            return await _userManager.Users
                .Include(u => u.LoginHistory)
                .OrderByDescending(u => u.RegistrationDate)
                .ToListAsync();
        }

        public async Task<ApplicationUser?> GetUserByIdAsync(string userId)
        {
            return await _userManager.Users
                .Include(u => u.LoginHistory)
                .Include(u => u.Profiles)
                .FirstOrDefaultAsync(u => u.Id == userId);
        }

        public async Task<ApplicationUser?> GetUserByEmailAsync(string email)
        {
            return await _userManager.FindByEmailAsync(email);
        }

        public async Task<IdentityResult> UpdateUserAsync(ApplicationUser user)
        {
            user.LastUpdated = DateTime.UtcNow;
            var result = await _userManager.UpdateAsync(user);

            if (result.Succeeded)
            {
                _logger.LogInformation("User updated: {UserId}", user.Id);
            }
            else
            {
                _logger.LogWarning("Failed to update user {UserId}: {Errors}", 
                    user.Id, string.Join(", ", result.Errors.Select(e => e.Description)));
            }

            return result;
        }

        public async Task<IdentityResult> DeleteUserAsync(string userId)
        {
            var user = await GetUserByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            var result = await _userManager.DeleteAsync(user);

            if (result.Succeeded)
            {
                _logger.LogInformation("User deleted: {UserId}", userId);
            }

            return result;
        }

        public async Task<IdentityResult> DeactivateUserAsync(string userId)
        {
            var user = await GetUserByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            user.IsActive = false;
            user.LastUpdated = DateTime.UtcNow;

            var result = await _userManager.UpdateAsync(user);

            if (result.Succeeded)
            {
                await LogUserActivityAsync(userId, "Account Deactivated", "User account deactivated by administrator");
                _logger.LogInformation("User deactivated: {UserId}", userId);
            }

            return result;
        }

        public async Task<IdentityResult> ActivateUserAsync(string userId)
        {
            var user = await GetUserByIdAsync(userId);
            if (user == null)
            {
                return IdentityResult.Failed(new IdentityError
                {
                    Description = "User not found."
                });
            }

            user.IsActive = true;
            user.LastUpdated = DateTime.UtcNow;

            var result = await _userManager.UpdateAsync(user);

            if (result.Succeeded)
            {
                await LogUserActivityAsync(userId, "Account Activated", "User account activated by administrator");
                _logger.LogInformation("User activated: {UserId}", userId);
            }

            return result;
        }

        public async Task<List<ApplicationUser>> GetInactiveUsersAsync()
        {
            return await _userManager.Users
                .Where(u => !u.IsActive)
                .OrderByDescending(u => u.LastUpdated)
                .ToListAsync();
        }

        public async Task<Dictionary<string, object>> GetUserStatisticsAsync()
        {
            var totalUsers = await _userManager.Users.CountAsync();
            var activeUsers = await _userManager.Users.CountAsync(u => u.IsActive);
            var verifiedUsers = await _userManager.Users.CountAsync(u => u.EmailConfirmed);
            var usersWith2FA = await _userManager.Users.CountAsync(u => u.TwoFactorEnabled);

            var recentRegistrations = await _userManager.Users
                .Where(u => u.RegistrationDate >= DateTime.UtcNow.AddDays(-7))
                .CountAsync();

            var stats = new Dictionary<string, object>
            {
                ["TotalUsers"] = totalUsers,
                ["ActiveUsers"] = activeUsers,
                ["VerifiedUsers"] = verifiedUsers,
                ["UsersWith2FA"] = usersWith2FA,
                ["RecentRegistrations"] = recentRegistrations,
                ["InactiveUsers"] = totalUsers - activeUsers
            };

            return stats;
        }

        public async Task LogUserActivityAsync(string userId, string activity, string description)
        {
            try
            {
                var loginHistory = new UserLoginHistory
                {
                    UserId = userId,
                    LoginTime = DateTime.UtcNow,
                    IpAddress = "System", // You can get real IP from HttpContext
                    UserAgent = "System",
                    Success = true,
                    FailureReason = null
                };

                _context.UserLoginHistory.Add(loginHistory);
                await _context.SaveChangesAsync();

                _logger.LogInformation("User activity logged: {UserId} - {Activity}", userId, activity);
            }
            catch (Exception ex)
            {
                _logger.LogError(ex, "Error logging user activity for {UserId}", userId);
            }
        }

        public async Task<List<UserLoginHistory>> GetUserLoginHistoryAsync(string userId, int days = 30)
        {
            var cutoffDate = DateTime.UtcNow.AddDays(-days);
            
            return await _context.UserLoginHistory
                .Where(lh => lh.UserId == userId && lh.LoginTime >= cutoffDate)
                .OrderByDescending(lh => lh.LoginTime)
                .ToListAsync();
        }

        public async Task<bool> IsUserActiveAsync(string userId)
        {
            var user = await GetUserByIdAsync(userId);
            return user?.IsActive ?? false;
        }
    }
}

User Management Controller

Controllers/UserManagementController.cs

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using IdentityDemo.Models;
using IdentityDemo.Services;

namespace IdentityDemo.Controllers
{
    [Authorize(Roles = "Admin,Manager")]
    public class UserManagementController : Controller
    {
        private readonly IUserService _userService;
        private readonly IRoleService _roleService;
        private readonly IClaimsService _claimsService;
        private readonly ILogger<UserManagementController> _logger;

        public UserManagementController(
            IUserService userService,
            IRoleService roleService,
            IClaimsService claimsService,
            ILogger<UserManagementController> logger)
        {
            _userService = userService;
            _roleService = roleService;
            _claimsService = claimsService;
            _logger = logger;
        }

        [HttpGet]
        public async Task<IActionResult> Index()
        {
            var users = await _userService.GetAllUsersAsync();
            return View(users);
        }

        [HttpGet]
        public async Task<IActionResult> Details(string id)
        {
            var user = await _userService.GetUserByIdAsync(id);
            if (user == null)
            {
                return NotFound();
            }

            var userRoles = await _roleService.GetUserRolesAsync(id);
            var userClaims = await _claimsService.GetUserClaimsAsync(id);
            var loginHistory = await _userService.GetUserLoginHistoryAsync(id, 30);

            var model = new UserDetailsViewModel
            {
                User = user,
                Roles = userRoles,
                Claims = userClaims,
                LoginHistory = loginHistory
            };

            return View(model);
        }

        [HttpGet]
        public async Task<IActionResult> Edit(string id)
        {
            var user = await _userService.GetUserByIdAsync(id);
            if (user == null)
            {
                return NotFound();
            }

            var model = new EditUserViewModel
            {
                Id = user.Id,
                FirstName = user.FirstName,
                LastName = user.LastName,
                Email = user.Email!,
                PhoneNumber = user.PhoneNumber,
                DateOfBirth = user.DateOfBirth,
                Address = user.Address,
                City = user.City,
                State = user.State,
                ZipCode = user.ZipCode,
                Country = user.Country,
                Bio = user.Bio,
                IsActive = user.IsActive
            };

            return View(model);
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> Edit(EditUserViewModel model)
        {
            if (!ModelState.IsValid)
            {
                return View(model);
            }

            var user = await _userService.GetUserByIdAsync(model.Id);
            if (user == null)
            {
                return NotFound();
            }

            user.FirstName = model.FirstName;
            user.LastName = model.LastName;
            user.Email = model.Email;
            user.UserName = model.Email;
            user.PhoneNumber = model.PhoneNumber;
            user.DateOfBirth = model.DateOfBirth;
            user.Address = model.Address;
            user.City = model.City;
            user.State = model.State;
            user.ZipCode = model.ZipCode;
            user.Country = model.Country;
            user.Bio = model.Bio;
            user.IsActive = model.IsActive;

            var result = await _userService.UpdateUserAsync(user);
            
            if (result.Succeeded)
            {
                TempData["SuccessMessage"] = "User updated successfully.";
                return RedirectToAction("Details", new { id = model.Id });
            }

            foreach (var error in result.Errors)
            {
                ModelState.AddModelError("", error.Description);
            }

            return View(model);
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        [Authorize(Roles = "Admin")]
        public async Task<IActionResult> Deactivate(string id)
        {
            var result = await _userService.DeactivateUserAsync(id);
            
            if (result.Succeeded)
            {
                TempData["SuccessMessage"] = "User deactivated successfully.";
            }
            else
            {
                TempData["ErrorMessage"] = result.Errors.First().Description;
            }

            return RedirectToAction("Details", new { id });
        }

        [HttpPost]
        [ValidateAntiForgeryToken]
        [Authorize(Roles = "Admin")]
        public async Task<IActionResult> Activate(string id)
        {
            var result = await _userService.ActivateUserAsync(id);
            
            if (result.Succeeded)
            {
                TempData["SuccessMessage"] = "User activated successfully.";
            }
            else
            {
                TempData["ErrorMessage"] = result.Errors.First().Description;
            }

            return RedirectToAction("Details", new { id });
        }

        [HttpGet]
        public async Task<IActionResult> Statistics()
        {
            var stats = await _userService.GetUserStatisticsAsync();
            return View(stats);
        }

        [HttpGet]
        public async Task<IActionResult> InactiveUsers()
        {
            var users = await _userService.GetInactiveUsersAsync();
            return View(users);
        }
    }

    public class UserDetailsViewModel
    {
        public ApplicationUser User { get; set; } = null!;
        public List<string> Roles { get; set; } = new();
        public List<Claim> Claims { get; set; } = new();
        public List<UserLoginHistory> LoginHistory { get; set; } = new();
    }

    public class EditUserViewModel
    {
        public string Id { get; set; } = string.Empty;

        [Required]
        [StringLength(100)]
        [Display(Name = "First Name")]
        public string FirstName { get; set; } = string.Empty;

        [Required]
        [StringLength(100)]
        [Display(Name = "Last Name")]
        public string LastName { get; set; } = string.Empty;

        [Required]
        [EmailAddress]
        public string Email { get; set; } = string.Empty;

        [Phone]
        [Display(Name = "Phone Number")]
        public string? PhoneNumber { get; set; }

        [Required]
        [Display(Name = "Date of Birth")]
        [DataType(DataType.Date)]
        public DateTime DateOfBirth { get; set; }

        [StringLength(200)]
        public string? Address { get; set; }

        [StringLength(100)]
        public string? City { get; set; }

        [StringLength(100)]
        public string? State { get; set; }

        [StringLength(20)]
        [Display(Name = "Zip Code")]
        public string? ZipCode { get; set; }

        [StringLength(100)]
        public string? Country { get; set; }

        [StringLength(500)]
        public string? Bio { get; set; }

        [Display(Name = "Active Account")]
        public bool IsActive { get; set; } = true;
    }
}

10. Database Seeding & Initialization {#database-seeding}

Seed Data Implementation

Data/SeedData.cs

using Microsoft.AspNetCore.Identity;
using IdentityDemo.Models;

namespace IdentityDemo.Data
{
    public static class SeedData
    {
        public static async Task InitializeAsync(
            ApplicationDbContext context,
            UserManager<ApplicationUser> userManager,
            RoleManager<IdentityRole> roleManager)
        {
            context.Database.EnsureCreated();

            // Seed Roles
            await SeedRolesAsync(roleManager);

            // Seed Admin User
            await SeedAdminUserAsync(userManager);

            // Seed Sample Users
            await SeedSampleUsersAsync(userManager);
        }

        private static async Task SeedRolesAsync(RoleManager<IdentityRole> roleManager)
        {
            string[] roleNames = { "Admin", "Manager", "User" };

            foreach (var roleName in roleNames)
            {
                var roleExist = await roleManager.RoleExistsAsync(roleName);
                if (!roleExist)
                {
                    await roleManager.CreateAsync(new IdentityRole(roleName));
                }
            }
        }

        private static async Task SeedAdminUserAsync(UserManager<ApplicationUser> userManager)
        {
            var adminUser = new ApplicationUser
            {
                UserName = "[email protected]",
                Email = "[email protected]",
                FirstName = "System",
                LastName = "Administrator",
                DateOfBirth = new DateTime(1980, 1, 1),
                PhoneNumber = "+1234567890",
                EmailConfirmed = true,
                IsEmailVerified = true,
                IsActive = true,
                RegistrationDate = DateTime.UtcNow
            };

            var admin = await userManager.FindByEmailAsync(adminUser.Email);
            if (admin == null)
            {
                var createAdmin = await userManager.CreateAsync(adminUser, "Admin123!");
                if (createAdmin.Succeeded)
                {
                    await userManager.AddToRoleAsync(adminUser, "Admin");
                    await userManager.AddToRoleAsync(adminUser, "Manager");
                    await userManager.AddToRoleAsync(adminUser, "User");
                }
            }
        }

        private static async Task SeedSampleUsersAsync(UserManager<ApplicationUser> userManager)
        {
            var sampleUsers = new[]
            {
                new
                {
                    Email = "[email protected]",
                    FirstName = "John",
                    LastName = "Manager",
                    Password = "Manager123!",
                    Roles = new[] { "Manager", "User" }
                },
                new
                {
                    Email = "[email protected]",
                    FirstName = "Alice",
                    LastName = "User",
                    Password = "User123!",
                    Roles = new[] { "User" }
                },
                new
                {
                    Email = "[email protected]",
                    FirstName = "Bob",
                    LastName = "User",
                    Password = "User123!",
                    Roles = new[] { "User" }
                }
            };

            foreach (var userInfo in sampleUsers)
            {
                var user = await userManager.FindByEmailAsync(userInfo.Email);
                if (user == null)
                {
                    var newUser = new ApplicationUser
                    {
                        UserName = userInfo.Email,
                        Email = userInfo.Email,
                        FirstName = userInfo.FirstName,
                        LastName = userInfo.LastName,
                        DateOfBirth = new DateTime(1990, 1, 1),
                        EmailConfirmed = true,
                        IsEmailVerified = true,
                        IsActive = true,
                        RegistrationDate = DateTime.UtcNow
                    };

                    var createUser = await userManager.CreateAsync(newUser, userInfo.Password);
                    if (createUser.Succeeded)
                    {
                        foreach (var role in userInfo.Roles)
                        {
                            await userManager.AddToRoleAsync(newUser, role);
                        }
                    }
                }
            }
        }
    }
}

This comprehensive ASP.NET Core Identity guide provides complete, production-ready examples that cover all aspects of modern identity management. The implementation includes user registration, role-based authorization, claims management, two-factor authentication, and comprehensive administration features.