Implementing OAuth 2.0 and OpenID Connect in ASP.NET Core

Introduction

Authentication and authorization are essential parts of modern web applications and APIs. Users expect secure login experiences, while organizations need reliable ways to protect resources and manage identities.

Two standards commonly used for this purpose are OAuth 2.0 and OpenID Connect (OIDC).

You'll often see applications allowing users to sign in with Google, Microsoft, GitHub, or other identity providers. Behind the scenes, OAuth 2.0 and OpenID Connect make these secure authentication flows possible.

In this article, you'll learn the difference between OAuth 2.0 and OpenID Connect and how to implement them in an ASP.NET Core application.

What Is OAuth 2.0?

OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of a user without exposing their credentials.

Example:

User
  ↓
Google Login
  ↓
Access Token
  ↓
Application

OAuth 2.0 focuses on:

Authorization
Access tokens
Resource access

It answers the question:

What can the application access?

What Is OpenID Connect (OIDC)?

OpenID Connect is built on top of OAuth 2.0 and adds authentication capabilities.

It provides:

User authentication
Identity information
ID Tokens

It answers:

Who is the user?

When a user signs in with Google or Microsoft, OpenID Connect is commonly involved.

OAuth 2.0 vs OpenID Connect

Feature	OAuth 2.0	OpenID Connect
Purpose	Authorization	Authentication + Authorization
Access Token	Yes	Yes
ID Token	No	Yes
User Identity	No	Yes
Login Support	Limited	Yes

In modern applications, OpenID Connect is typically used alongside OAuth 2.0.

Authentication Flow

A simplified OIDC flow:

User
  ↓
Identity Provider
  ↓
Authentication
  ↓
ID Token
  ↓
ASP.NET Core App

The application receives information about the authenticated user.

Create an ASP.NET Core Application

Create a new project:

dotnet new mvc

Or:

dotnet new webapp

This creates the foundation for implementing authentication.

Install Authentication Packages

For OpenID Connect support:

dotnet add package
Microsoft.AspNetCore.Authentication.OpenIdConnect

For cookie authentication:

dotnet add package
Microsoft.AspNetCore.Authentication.Cookies

These packages enable secure sign-in functionality.

Configure Authentication

In Program.cs:

builder.Services
    .AddAuthentication(options =>
{
    options.DefaultScheme =
        "Cookies";

    options.DefaultChallengeScheme =
        "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect(
    "oidc",
    options =>
{
    options.Authority =
        "https://your-provider";

    options.ClientId =
        "client-id";

    options.ClientSecret =
        "client-secret";

    options.ResponseType = "code";
});

This configures OpenID Connect authentication.

Enable Middleware

Add authentication middleware.

app.UseAuthentication();

app.UseAuthorization();

These middleware components handle authentication and authorization requests.

Protecting Endpoints

Use the Authorize attribute.

[Authorize]
public IActionResult Dashboard()
{
    return View();
}

Unauthenticated users will be redirected to the identity provider for login.

Access User Information

After successful login:

var userName =
    User.Identity?.Name;

Access claims:

var email =
    User.FindFirst("email")
        ?.Value;

Claims contain information about the authenticated user.

Working with Access Tokens

Access tokens are used to call protected APIs.

Example:

User Login
     ↓
Access Token
     ↓
API Request

Retrieve the token:

var accessToken =
    await HttpContext
        .GetTokenAsync(
            "access_token");

The application can now access protected resources.

Real-World Example

Suppose you're building an employee portal.

Users sign in using Microsoft Entra ID.

Workflow:

Employee
    ↓
Microsoft Login
    ↓
ID Token
    ↓
ASP.NET Core App

Benefits:

Centralized authentication
Single Sign-On (SSO)
Improved security

Many enterprise applications follow this approach.

Security Best Practices

When implementing OAuth 2.0 and OIDC:

Always use HTTPS.
Protect client secrets.
Validate tokens.
Use authorization code flow.
Store tokens securely.
Configure token expiration.
Implement proper logout functionality.

These practices help protect user identities and application resources.

Common Identity Providers

ASP.NET Core integrates with many providers.

Examples:

Microsoft Entra ID
Google
GitHub
Auth0
Okta
Keycloak

All support OpenID Connect authentication.

Advantages of OAuth 2.0 and OIDC

Benefits include:

Secure authentication
Single Sign-On support
Reduced password management
Standardized protocols
Better user experience
Improved security

These advantages explain why OAuth and OIDC are widely adopted.

Conclusion

OAuth 2.0 and OpenID Connect have become the standard approach for securing modern applications and APIs. OAuth 2.0 handles authorization, while OpenID Connect adds authentication and identity management capabilities.

ASP.NET Core provides built-in support for these protocols, making it relatively easy to integrate with identity providers such as Microsoft Entra ID, Google, Auth0, and others.

By implementing OAuth 2.0 and OpenID Connect correctly, developers can build secure applications that provide a seamless login experience while protecting sensitive resources and user data.