Introduction
Authentication and authorization are essential parts of modern web applications and APIs. Users expect secure login experiences, while organizations need reliable ways to protect resources and manage identities.
Two standards commonly used for this purpose are OAuth 2.0 and OpenID Connect (OIDC).
You'll often see applications allowing users to sign in with Google, Microsoft, GitHub, or other identity providers. Behind the scenes, OAuth 2.0 and OpenID Connect make these secure authentication flows possible.
In this article, you'll learn the difference between OAuth 2.0 and OpenID Connect and how to implement them in an ASP.NET Core application.
What Is OAuth 2.0?
OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of a user without exposing their credentials.
Example:
User
↓
Google Login
↓
Access Token
↓
Application
OAuth 2.0 focuses on:
Authorization
Access tokens
Resource access
It answers the question:
What can the application access?
What Is OpenID Connect (OIDC)?
OpenID Connect is built on top of OAuth 2.0 and adds authentication capabilities.
It provides:
User authentication
Identity information
ID Tokens
It answers:
Who is the user?
When a user signs in with Google or Microsoft, OpenID Connect is commonly involved.
OAuth 2.0 vs OpenID Connect
| Feature | OAuth 2.0 | OpenID Connect |
|---|
| Purpose | Authorization | Authentication + Authorization |
| Access Token | Yes | Yes |
| ID Token | No | Yes |
| User Identity | No | Yes |
| Login Support | Limited | Yes |
In modern applications, OpenID Connect is typically used alongside OAuth 2.0.
Authentication Flow
A simplified OIDC flow:
User
↓
Identity Provider
↓
Authentication
↓
ID Token
↓
ASP.NET Core App
The application receives information about the authenticated user.
Create an ASP.NET Core Application
Create a new project:
dotnet new mvc
Or:
dotnet new webapp
This creates the foundation for implementing authentication.
Install Authentication Packages
For OpenID Connect support:
dotnet add package
Microsoft.AspNetCore.Authentication.OpenIdConnect
For cookie authentication:
dotnet add package
Microsoft.AspNetCore.Authentication.Cookies
These packages enable secure sign-in functionality.
Configure Authentication
In Program.cs:
builder.Services
.AddAuthentication(options =>
{
options.DefaultScheme =
"Cookies";
options.DefaultChallengeScheme =
"oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect(
"oidc",
options =>
{
options.Authority =
"https://your-provider";
options.ClientId =
"client-id";
options.ClientSecret =
"client-secret";
options.ResponseType = "code";
});
This configures OpenID Connect authentication.
Enable Middleware
Add authentication middleware.
app.UseAuthentication();
app.UseAuthorization();
These middleware components handle authentication and authorization requests.
Protecting Endpoints
Use the Authorize attribute.
[Authorize]
public IActionResult Dashboard()
{
return View();
}
Unauthenticated users will be redirected to the identity provider for login.
Access User Information
After successful login:
var userName =
User.Identity?.Name;
Access claims:
var email =
User.FindFirst("email")
?.Value;
Claims contain information about the authenticated user.
Working with Access Tokens
Access tokens are used to call protected APIs.
Example:
User Login
↓
Access Token
↓
API Request
Retrieve the token:
var accessToken =
await HttpContext
.GetTokenAsync(
"access_token");
The application can now access protected resources.
Real-World Example
Suppose you're building an employee portal.
Users sign in using Microsoft Entra ID.
Workflow:
Employee
↓
Microsoft Login
↓
ID Token
↓
ASP.NET Core App
Benefits:
Many enterprise applications follow this approach.
Security Best Practices
When implementing OAuth 2.0 and OIDC:
Always use HTTPS.
Protect client secrets.
Validate tokens.
Use authorization code flow.
Store tokens securely.
Configure token expiration.
Implement proper logout functionality.
These practices help protect user identities and application resources.
Common Identity Providers
ASP.NET Core integrates with many providers.
Examples:
Microsoft Entra ID
Google
GitHub
Auth0
Okta
Keycloak
All support OpenID Connect authentication.
Advantages of OAuth 2.0 and OIDC
Benefits include:
These advantages explain why OAuth and OIDC are widely adopted.
Conclusion
OAuth 2.0 and OpenID Connect have become the standard approach for securing modern applications and APIs. OAuth 2.0 handles authorization, while OpenID Connect adds authentication and identity management capabilities.
ASP.NET Core provides built-in support for these protocols, making it relatively easy to integrate with identity providers such as Microsoft Entra ID, Google, Auth0, and others.
By implementing OAuth 2.0 and OpenID Connect correctly, developers can build secure applications that provide a seamless login experience while protecting sensitive resources and user data.