Introduction

This article explains how to log in with JWT (json web token) and set custom authentication for every role logged in into the web application in ASP.NET Core 3.1.
So, for login, we will see how to get a JWT token with user claims and store it in the session storage key “JWToken”, then apply the authentication filter by Role, assign it to that user and restrict to another user unauthorized user and how to logout users.

Overview

JWT-(Json Web Token)
Authentication- Authentication is the process of determining who you are.
Claims-based authentication
Claims are a statement about or a property of a particular identity. That consists of name and value for ex. You could have UserName claim, EmailAddress claim, or Role claim.
  • This is a single identity that contains a no. of claims.
Let’s start with an example:
Step 1
Create an ASP.NET Core web application with MVC in .NET Core 3.1.
Step 2
Create Login Controller.cs and make a login view over the index action.
  1. public class LoginController : BaseController
  2. {
  3. ApplicationDbContext db;
  4. public LoginController(ApplicationDbContext db)
  5. {
  6. this.db = db;
  7. }
  8. [HttpGet, AllowAnonymous]
  9. public IActionResult Index()
  10. {
  11. return View();
  12. }
  13. }
Step 3
Create a BaseController.cs and create an asynced "CreateAuthenticationTicket " function.
  1. public class BaseController : Controller
  2. {
  3. public async Task CreateAuthenticationTicket(AdminLogin user)
  4. {
  5. var key = Encoding.ASCII.GetBytes(SiteKeys.Token);
  6. var JWToken = new JwtSecurityToken(
  7. issuer: SiteKeys.WebSiteDomain,
  8. audience: SiteKeys.WebSiteDomain,
  9. claims: GetUserClaims(user),
  10. notBefore: new DateTimeOffset(DateTime.Now).DateTime,
  11. expires: new DateTimeOffset(DateTime.Now.AddDays(1)).DateTime,
  12. signingCredentials: new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
  13. );
  15. var token = new JwtSecurityTokenHandler().WriteToken(JWToken);
  16. HttpContext.Session.SetString("JWToken", token);
  17. }
  20. private IEnumerable<Claim> GetUserClaims(AdminLogin user)
  21. {
  22. List<Claim> claims = new List<Claim>();
  23. Claim _claim;
  24. _claim = new Claim(ClaimTypes.Name, user.UserName);
  25. claims.Add(_claim);
  27. _claim = new Claim("Role", Role.Admin);
  28. claims.Add(_claim);
  30. return claims.AsEnumerable<Claim>();
  31. }
  32. }
Create a Role struct in BaseController.cs and set different roles under this.
  1. public struct Role
  2. {
  3. public const string Admin = "Admin";
  4. public const string Guest = "Guest";
  5. }
Create Sitekeys.cs class for getting configurations from the appsettings.json file
SiteKeys.cs
  1. using Microsoft.Extensions.Configuration;
  2. using System;
  3. using System.Collections.Generic;
  4. using System.Linq;
  5. using System.Threading.Tasks;
  7. namespace DemoIntro.Models
  8. {
  9. public class SiteKeys
  10. {
  11. private static IConfigurationSection _configuration;
  12. public static void Configure(IConfigurationSection configuration)
  13. {
  14. _configuration = configuration;
  15. }
  17. public static string WebSiteDomain => _configuration["WebSiteDomain"];
  18. public static string Token => _configuration["Secret"];
  20. }
  21. }
Step 4
Now create the Login Post method
  1. [HttpPost, AllowAnonymous]
  2. public IActionResult LoginNow(AdminLogin model)
  3. {
  4. var admin = db.AdminLogin.Where(x => x.UserName.Trim() == model.UserName.Trim() && x.Password ==model.Password).FirstOrDefault();
  5. try
  6. {
  7. if (admin != null)
  8. {
  9. _ = CreateAuthenticationTicket(admin);
  10. // Show Success Message -"Welcome!"
  11. return RedirectToAction(nameof(ProfileController.CreateEditProfile), "Profile");
  12. }
  13. else
  14. {
  15. // Show Error Message- "Invalid Credentials."
  16. return View("Index", model);
  17. }
  18. }
  19. catch (Exception ex)
  20. {
  21. //Show Error Message- ex.Message
  22. return View("Index", model);
  23. }
  24. }
Step 5
Create index.cshtml
  1. @model DemoIntro.Data.Tables.AdminLogin
  2. @{
  3. Layout = null;
  4. }
  6. <!DOCTYPE html>
  7. <html>
  8. <head>
  10. </head>
  11. <body class="hold-transition login-page">
  12. <div class="login-box">
  13. <div class="card">
  14. <div class="card-body login-card-body">
  15. <p class="login-box-msg">Sign in to start your session</p>
  17. <form id="frmLogin" asp-action="LoginNow" asp-controller="Login" asp-route-returnurl="@ViewData["ReturnUrl"]" method="post">
  20. <div class="form-group">
  21. <div class="input-group mb-3">
  22. <input asp-for="@Model.UserName" class="form-control" placeholder="Email">
  23. <div class="input-group-append">
  24. <div class="input-group-text">
  25. <span class="fas fa-envelope"></span>
  26. </div>
  27. </div>
  28. </div>
  29. <span asp-validation-for="@Model.UserName" class="text-danger"></span>
  30. </div>
  33. <div class="form-group">
  34. <div class="input-group mb-3">
  35. <input asp-for="@Model.Password" class="form-control" placeholder="Password">
  36. <div class="input-group-append">
  37. <div class="input-group-text">
  38. <span class="fas fa-lock"></span>
  39. </div>
  40. </div>
  41. </div>
  42. <span asp-validation-for="@Model.Password" class="text-danger"></span>
  43. </div>
  46. <div class="row">
  48. <!-- /.col -->
  49. <div class="col-4">
  50. <button type="submit" class="btn btn-primary btn-block">Sign In</button>
  51. </div>
  52. <!-- /.col -->
  53. </div>
  54. </form>
  55. </div>
  56. <!-- /.login-card-body -->
  57. </div>
  58. </div>
  59. </body>
  60. </html>
Step 6
Set a few JWT authentication tags in Startup.cs file. services.AddAuthentication ,services.AddSession
  1. public void ConfigureServices(IServiceCollection services)
  2. {
  3. services.AddDbContext<ApplicationDbContext>(options =>
  4. options.UseSqlServer(
  5. Configuration.GetConnectionString("DefaultConnection")));
  6. services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
  7. .AddEntityFrameworkStores<ApplicationDbContext>();
  8. services.AddControllersWithViews();
  9. services.AddRazorPages();
  12. #region "JWT Token For Authentication Login"
  13. SiteKeys.Configure(Configuration.GetSection("AppSettings"));
  14. var key = Encoding.ASCII.GetBytes(SiteKeys.Token);
  16. services.AddSession(options =>
  17. {
  18. options.IdleTimeout = TimeSpan.FromMinutes(60);
  19. });
  22. services.AddAuthentication(auth =>
  23. {
  24. auth.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
  25. auth.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
  26. })
  27. .AddJwtBearer(token =>
  28. {
  29. token.RequireHttpsMetadata = false;
  30. token.SaveToken = true;
  31. token.TokenValidationParameters = new TokenValidationParameters
  32. {
  33. ValidateIssuerSigningKey = true,
  34. IssuerSigningKey = new SymmetricSecurityKey(key),
  35. ValidateIssuer = true,
  36. ValidIssuer = SiteKeys.WebSiteDomain,
  37. ValidateAudience = true,
  38. ValidAudience = SiteKeys.WebSiteDomain,
  39. RequireExpirationTime = true,
  40. ValidateLifetime = true,
  41. ClockSkew = TimeSpan.Zero
  42. };
  43. });
  45. #endregion
  47. }
Add JWToken in Authorization Bearer in the request header:
  1. public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  2. {
  3. if (env.IsDevelopment())
  4. {
  5. app.UseDeveloperExceptionPage();
  6. app.UseDatabaseErrorPage();
  7. }
  8. else
  9. {
  10. app.UseExceptionHandler("/Home/Error");
  11. // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
  12. app.UseHsts();
  13. }
  14. app.UseHttpsRedirection();
  15. app.UseStaticFiles();
  16. app.UseRouting();
  18. #region "JWT Token For Authentication Login"
  20. app.UseCookiePolicy();
  21. app.UseSession();
  22. app.Use(async (context, next) =>
  23. {
  24. var JWToken = context.Session.GetString("JWToken");
  25. if (!string.IsNullOrEmpty(JWToken))
  26. {
  27. context.Request.Headers.Add("Authorization", "Bearer " + JWToken);
  28. }
  29. await next();
  30. });
  31. app.UseAuthentication();
  32. app.UseAuthorization();
  35. #endregion
  37. app.UseEndpoints(endpoints =>
  38. {
  39. //Routing Area Admin
  40. endpoints.MapAreaControllerRoute(
  41. name: "routeArea",
  42. areaName: "Admin",
  43. pattern: "Admin/{controller=Home}/{action=Index}/{id?}");
  44. endpoints.MapRazorPages();
  46. //Routing Front
  47. endpoints.MapControllerRoute(
  48. name: "default",
  49. pattern: "{controller=Main}/{action=Index}/{id?}");
  50. endpoints.MapRazorPages();
  51. });
  53. }
Step 7
Add connection and configurations in the appsettings.json file.
  1. {
  2. "ConnectionStrings": {
  4. "DefaultConnection": "Server=LOKESH007\\LOKESH007;Database=DemoIntro;user=sa;password=admin@1234;Trusted_Connection=False;"
  6. },
  7. "Logging": {
  8. "LogLevel": {
  9. "Default": "Information",
  10. "Microsoft": "Warning",
  11. "Microsoft.Hosting.Lifetime": "Information"
  12. }
  13. },
  14. "AllowedHosts": "*",
  16. "AppSettings": {
  17. "Secret": "WriteMySecretKeyForAuthentication",
  18. "WebSiteDomain": "http://localhost/Demo/",
  19. "WebSiteName": "khushbu Saini"
  20. }
  22. }
Step 8
Now create our custom Authorize filter validating each user role, restrict unauthorized users, auto redirect to login if session timeout or unauthorized request hit.
Authorize.cs
  1. using Microsoft.AspNetCore.Http;
  2. using Microsoft.AspNetCore.Mvc;
  3. using Microsoft.AspNetCore.Mvc.Filters;
  4. using System;
  5. using System.Collections.Generic;
  6. using System.Linq;
  7. using System.Net;
  8. using System.Security.Claims;
  9. using System.Threading.Tasks;
  11. namespace DemoIntro.filters
  12. {
  13. public class AuthorizeAttribute : TypeFilterAttribute
  14. {
  15. public AuthorizeAttribute(params string[] claim) : base(typeof(AuthorizeFilter))
  16. {
  17. Arguments = new object[] { claim };
  18. }
  19. }
  21. public class AuthorizeFilter : IAuthorizationFilter
  22. {
  23. readonly string[] _claim;
  25. public AuthorizeFilter(params string[] claim)
  26. {
  27. _claim = claim;
  28. }
  30. public void OnAuthorization(AuthorizationFilterContext context)
  31. {
  32. var IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;
  33. var claimsIndentity = context.HttpContext.User.Identity as ClaimsIdentity;
  35. if (IsAuthenticated)
  36. {
  37. bool flagClaim = false;
  38. foreach (var item in _claim)
  39. {
  40. if (context.HttpContext.User.HasClaim("Role", item))
  41. flagClaim = true;
  42. }
  43. if (!flagClaim)
  44. {
  45. if (context.HttpContext.Request.IsAjaxRequest())
  46. context.HttpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized; //Set HTTP 401
  47. else
  48. context.Result = new RedirectResult("~/Login/Index");
  49. }
  50. }
  51. else
  52. {
  53. if (context.HttpContext.Request.IsAjaxRequest())
  54. {
  55. context.HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden; //Set HTTP 403 -
  56. }
  57. else
  58. {
  59. context.Result = new RedirectResult("~/Login/Index");
  60. }
  61. }
  62. return;
  63. }
  64. }
  65. }
Step 9
Set the access role to each user controller
  1. [Authorize(Role.Admin)]
  2. public class AchievementsController : BaseController
  3. {
  4. ////
  5. }
  1. [Authorize(Role.Guest)]
  2. public class AccessoriesController : BaseController
  3. {///
  4. }
Step 10
Finally, the logout function for each use logout is here:
  1. [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
  2. public IActionResult Logout()
  3. {
  4. HttpContext.Session.Clear();
  5. return RedirectToAction("Index");
  6. }
Output
Here is the login page, I have the first login with the admin. It shows me successful login and redirects to the admin dashboard.
Now, click on Accessories Controller. Because I have provided the access of this controller to Guest only, the admin can't unable to access it and auto-redirect to login view.

Summary

In this article, I discussed how we can get log in with multiple identity claim users. We also saw how we create our custom authentication filter so that we can custom authenticate each user while logging in and also validate that user role. Furthermore, we saw how to restrict other unauthorized users for login and also restrict them with URL rewriting. At last, we saw how to log out.