How to Implement .Net Framework Web API Token Based Authentication .

Sir i am having Trouble to understanding like what is  IUserStore and IRoleStore and register those with DI services3. i am beginner and i want to implement token and all stuff can u give me some more detail for better understanding start to end Thanku For Your Reply .

Sure, here’s a high-level overview of how you can implement token-based authentication and authorization in .NET Framework Web API without using Entity Framework:

1. Create and Configure a Web API Project: Create an empty solution for the project template “ASP.NET Web Application” and add a core reference of the Web API1.

2. Add References: Add NuGet References like Microsoft.Owin.Host.SystemWeb, Microsoft.Owin.Security.OAuth, and Microsoft.Owin.Cors2.

3. Implement UserStore and RoleStore: To not use Entity Framework, you must implement IUserStore and IRoleStore and register those with DI services3.

4. Create APIAuthorizationServerProvider Class: This class will provide credentials to access data depending on username, password, and roles2.

5. Implement Token-Based Authentication: The client application first sends a request to the Authentication server with valid credentials. The Authentication server sends an Access token to the client as a response. This token contains enough data to identify a particular user and it has an expiry time2.

Here’s a sample code for the ApiAuthorizationServerProvider class:

public class ApiAuthorizationServerProvider : OAuthAuthorizationServerProvider 
{
    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) 
    {
        context.Validated();
    }

    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context) 
    {
        var identity = new ClaimsIdentity(context.Options.AuthenticationType);
        if (context.UserName == "admin" && context.Password == "admin") 
        {
            identity.AddClaim(new Claim(ClaimTypes.Role, "admin"));
            identity.AddClaim(new Claim("username", "admin"));
            identity.AddClaim(new Claim(ClaimTypes.Name, "Hi Admin"));
            context.Validated(identity);
        } 
        else if (context.UserName == "user" && context.Password == "user") 
        {
            identity.AddClaim(new Claim(ClaimTypes.Role, "user"));
            identity.AddClaim(new Claim("username", "user"));
            identity.AddClaim(new Claim(ClaimTypes.Name, "Hi User"));
            context.Validated(identity);
        } 
        else 
        {
            context.SetError("invalid_grant", "Provided username and password are incorrect");
            return;
        }
    }
}

2

Please note that this is a simplified example and you might need to adjust it according to your specific requirements. For a more detailed guide, you can refer to the resources provided425.

You can refer below sites.

https://dotnettutorials.net/lesson/token-based-authentication-web-api/

https://medium.com/@craftingcode/how-to-implement-custom-authentication-and-authorization-mechanisms-in-asp-net-fd15ed516a9e

https://www.c-sharpcorner.com/article/web-ap/

Thanks