Delve into using Single Sign-On (SSO) to secure ASP.NET Core applications, including MVC, web API, and more. Discover protocols, configuration, and securing pages and endpoints.

Single Sign-on Authentication and authorization in ASP.NET Core.png

sso.tar.gz

Stand Alone Auth Provider

Client App Only

Full Authentication Flow

Full Authentication Flow With Secondary App

Blazor WebAssembly OIDC

Client and back-end

Securing web applications is extremely important, as you do not want unauthorized people to gain access to your data. The most convenient way of securing an application is to use single sign-on (SSO) because it allows users to authenticate once and gain access to all apps within the same system.

In this course, you’ll cover the process of using SSO in ASP.NET Core apps. You’ll also cover its usage inside all application types supported by ASP.NET Core, including MVC, web API, gRPC services, Blazor, and SignalR.

By the end of this course, you will have learned what SSO consists of, what protocols it uses, and how it’s configured inside an ASP.NET Core middleware. You will also have learned how to secure any endpoints, pages, and views supported by ASP.NET Core.

Using Single Sign-On for Securing Applications in ASP.NET Core

No NuGet package is needed because this functionality is built into the MVC project template.

`Microsoft.AspNetCore.Authentication.OpenIdConnect`

Which NuGet package can you use to enable the OIDC authentication flow in an MVC application?

Which NuGet package can you use to enable the OIDC authentication flow in an MVC application?

**(Select all that apply.)** Which OIDC settings must match between the client MVC app and the IdP server so that the MVC app can instantiate the OIDC authentication flow? 

(Select all that apply.) Which OIDC settings must match between the client MVC app and the IdP server so that the MVC app can instantiate the OIDC authentication flow?

There aren't any additional steps to take because this will be done automatically if you have a valid OICD configuration in the `AddAuthentication()` invocation in the application startup code.

Having the `UseAuthentication()` and `UseAuthorization()` invocations in the request processing pipeline

You need to apply the `Authorize` attribute either on the `HomeController` class or its `Index()` action method.

You need to apply the `Authorize` attribute inside the `Index.cshtml` view.

What should you use if you want to automatically initiate the OIDC authentication flow when an unauthenticated user visits the home page of an MVC application?

What should you use if you want to automatically initiate the OIDC authentication flow when an unauthenticated user visits the home page of an MVC application?

The OIDC flow will be initiated again, and the user will be asked to re-authenticate.

The user will still be authenticated and will not be asked to authenticate again.

The user will go through the partial authentication flow where they need to confirm their identity but won't be forced to reenter the password.

The user will be shown that they are still logged in but will be asked to reenter their password.

What happens if the user successfully authenticates in an MVC app, closes the browser, and then, shortly after this, reopens the browser and returns to the app?

What happens if the user successfully authenticates in an MVC app, closes the browser, and then, shortly after this, reopens the browser and returns to the app?

The `403` error code is returned from the server and displayed in the browser.

The user is logged out and is redirected to log in again under a different account that has the required permissions.

The user is redirected to the `AccessDenied` View of the `Account` Controller.

What happens if an authenticated but unauthorized user tries to access the view in an MVC application?

What happens if an authenticated but unauthorized user tries to access the view in an MVC application?

Test your knowledge of applying SSO on MVC apps.

Introduction to Single Sign-On (SSO)

JWT and Authorization Middleware

Enabling SSO in MVC Apps

Enabling SSO in Razor Pages

Enabling SSO in Web API

Enabling SSO in Blazor

Enabling SSO in gRPC

Enabling SSO in SignalR

Wrapping Up

Appendix

Quiz Yourself on SSO in MVC Apps