TodoWithIdentityServer

Deep dive in using IdentityServer4 to perform authentication for ASP.NET Core Api and Web app.

This Demo code was heavily referenced from the "IdentityServer4Demo" at start up code, and then to be changed quite a lot implementation code plus adding few new features.

There have a lot comments in code to explain in details. The solution contains 3 projects which are IdentityServer, TodoApi(web api) and TodoWebClient(mvc client). All users authentication requests from "TodoApi" and "TodoWebClient" are handled by IdentityServer, while authorization are managed by "TodoApi".

Below are some of key features covered in this demo solution.

1. Customizing IdentityServer4 UI with adding User Registration.
2. Securing ASP.NET Core Web client application with OpenID Connect at Authentication by IdentityServer.
3. Securing ASP.NET Core Api with OAuth2 at Authentication by IdentityServer and Authorization by Policy.
4. Hybrid Flow, UserInfo Endpoint, Identity Token, Access Token.
5. Claims Transformation, Attribute-based Access Control, Role-based Access Control, Authorization Policy.
6. Refresh Tokens, Reference Tokens and Revocation, Revoking Tokens.
7. Integrating custom user database with IdentityServer.
8. Persisting Configuration and Operational data store into SQL Server.
9. Working with External Identity Providers such as Google, Microsoft, Twitter and Facebook.
10. Mapping user login for external provider to an existing user account.
11. 2-Factor Authentication, sending verification code with Twilio.

References:

1. Quickstart UI for an in-memory IdentityServer4 v2

2. Getting Started with IdentityServer 4

3. Authenticate with OAuth 2.0 in ASP.NET Core 2.0

4. IdentityServer4 Documenting

5. Why use OpenID Connect instead of plain OAuth2?

6. When To Use Which (OAuth2) Grants and (OIDC) Flows