How To Implement Authentication Using Identity Model In ASP.NET Core

Step 10. Now, build and run the applications. After running the application in the browser, click on the "Sign In" button.

Step 11. Since we do not have any login credentials, we need to register first and then try to log in.

Step 12. For that, click on the link Register as a New User.

Step 13. In the Registration form, provide a Username and Password to register.

Step 14. After successful registration, the application allows us to log into the application.

Step 15. Now, return to the SQL server and run a query to select records from the table dbo.AspNetUsers

Step 16. This Table contains the registered user details as below.

Scaffolding the Login (Shared Views)

Now, if we check our existing project code, we do not find any Login or Register user UI. but when we check the views folder, we find there is a shared view called _LoginPartial.cshtml. The shared view file contains the link details related to the Login and Register User UI. Actually, in this application, log-in and its related to all the UIs used as a shared UI. So, it takes the reference of that application and uses it accordingly. I have already discussed the basic concept of shared view in my previous article.

Now, if we want to customize the Login Form, then we can scaffold the Login or any other forms.

Step 1. First, select the Views folder and click and Select Add --> New Scaffold Item

Step 2. In the Scaffold Dialog Box, Select the Identity Option and Click on the Ok Button

Step 3. Now, the Identity Dialog Box appears when we can select any of the available files to override. We will Select Account\Login Form and Click on the Add Button.

Step 4. The Selected Identity Form is added under the Identity Folder in the Areas Section.

Step 5. Now we can change some UI design for the Login Page as below

@page
@model LoginModel
@{
    ViewData["Title"] = "Log in";
}
<h1>@ViewData["Title"]</h1>
<div class="row">
    <div class="col-md-4">
        <section>
            <form id="account" method="post">
                <h4>Existing User Login In</h4>
                <hr />
                <div asp-validation-summary="All" class="text-danger"></div>
                <div class="form-group">
                    <label asp-for="Input.Email"></label>
                    <input asp-for="Input.Email" class="form-control" />
                    <span asp-validation-for="Input.Email" class="text-danger"></span>
                </div>
                <div class="form-group">
                    <label asp-for="Input.Password"></label>
                    <input asp-for="Input.Password" class="form-control" />
                    <span asp-validation-for="Input.Password" class="text-danger"></span>
                </div>
                <div class="form-group">
                    <div class="checkbox">
                        <label asp-for="Input.RememberMe">
                            <input asp-for="Input.RememberMe" />
                            @Html.DisplayNameFor(m => m.Input.RememberMe)
                        </label>
                    </div>
                </div>
                <div class="form-group">
                    <button type="submit" class="btn btn-primary">Log in</button>
                </div>
                <div class="form-group">
                    <p>
                        <a id="forgot-password" asp-page="./ForgotPassword">Forgot your password?</a>
                    </p>
                    <p>
                        <a asp-page="./Register" asp-route-returnUrl="@Model.ReturnUrl">Register as a new user</a>
                    </p>
                </div>
            </form>
        </section>
    </div>
</div>
@section Scripts {
    <partial name="_ValidationScriptsPartial" />
}

Step 6. Now, we want to implement some password policy like

• Password Length must be at least 8 characters
• Password must contain alphanumeric fields
• Password must contain 1 Unique Character
• Application Default Timeout is 5 mins

To add the above functionality, we need to add the below code in the ConfigureService() in Startup.cs Files.

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
    {
        options.CheckConsentNeeded = context => true;
        options.MinimumSameSitePolicy = SameSiteMode.None;
    });
    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
    services.AddDefaultIdentity<IdentityUser>()
        .AddDefaultUI(UIFramework.Bootstrap4)
        .AddEntityFrameworkStores<ApplicationDbContext>();
    services.Configure<IdentityOptions>(options =>
    {
        // Password settings.
        options.Password.RequireDigit = true;
        options.Password.RequireLowercase = true;
        options.Password.RequireNonAlphanumeric = true;
        options.Password.RequireUppercase = true;
        options.Password.RequiredLength = 8;
        options.Password.RequiredUniqueChars = 1;
        // Lockout settings.
        options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
        options.Lockout.MaxFailedAccessAttempts = 5;
        options.Lockout.AllowedForNewUsers = true;
        // User settings.
        options.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+#";
        options.User.RequireUniqueEmail = false;
    });
    services.ConfigureApplicationCookie(options =>
    {
        // Cookie settings
        options.Cookie.HttpOnly = true;
        options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
        options.LoginPath = "/Identity/Pages/Account/Login";
        options.AccessDeniedPath = "/Identity/Account/AccessDenied";
        options.SlidingExpiration = true;
    });
    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
}

Now, run the application and check the above settings while registering a new user.

Conclusion

Now, in this article, we discussed the basic concepts of Identity-based Authentication in ASP.NET Core. I hope this will help the readers to understand how to implement identity-based authentication in any application. If anybody has any queries or doubts related to this article, please let me know. Feedback is most welcome related to this article. In the next article, we will discuss how to implement some external authentication in ASP.NET Core.