Configuring SSO Inside an MVC Application

In this lesson, we will learn how to set up an SSO authentication flow in an ASP.NET Core MVC application. There are several ways of doing it. However, we will focus on the most standard way of doing it by using the library provided by Microsoft.

In the following playground, we have two applications:

• A basic MVC application

• An IdP application

Note: Because we have to build two ASP.NET Core applications and populate the IdP database with the initial seed data, the build process is expected to take at least a few minutes.

If we launch the playground by clicking the "Run" button, both applications will be built and executed. The URL next to the "Your app can be found at" label is the address of our MVC application. However, let’s suppose we visit this address for the first time. In that case, we will be redirected to a different address to log in because the application is capable of detecting that we haven't authenticated yet and that we need to be authenticated to access the home page.

The address we will be redirected to is the URL of the IdP application. But before we can log in, we will have to register our user. This can be done if we click the "Register" button on the login page that we got redirected to.

Once we register our user, we can navigate back to the original application URL. If we log in, the IdP page will ask if we want to confirm that the MVC application is allowed to authenticate. If we click "Yes," we will be redirected back to the home page of the MVC application.

After we click "Yes" to grant the application to our data, we will be redirected to the home page of the MVC application, which looks like this:

Once we log in, a cookie in the browser will retain the authentication token. This is how the MVC application knows we are authenticated. This cookie will be cleared if we sign out. Likewise, ...