Delve into using Single Sign-On (SSO) to secure ASP.NET Core applications, including MVC, web API, and more. Discover protocols, configuration, and securing pages and endpoints.

Single Sign-on Authentication and authorization in ASP.NET Core.png

sso.tar.gz

Stand Alone Auth Provider

Client App Only

Full Authentication Flow

Full Authentication Flow With Secondary App

Blazor WebAssembly OIDC

Client and back-end

Securing web applications is extremely important, as you do not want unauthorized people to gain access to your data. The most convenient way of securing an application is to use single sign-on (SSO) because it allows users to authenticate once and gain access to all apps within the same system.

In this course, you’ll cover the process of using SSO in ASP.NET Core apps. You’ll also cover its usage inside all application types supported by ASP.NET Core, including MVC, web API, gRPC services, Blazor, and SignalR.

By the end of this course, you will have learned what SSO consists of, what protocols it uses, and how it’s configured inside an ASP.NET Core middleware. You will also have learned how to secure any endpoints, pages, and views supported by ASP.NET Core.

Using Single Sign-On for Securing Applications in ASP.NET Core

While MVC uses only the standard OIDC authentication protocol, Razor Pages also uses the bearer token authentication.

SSO is configured in the exact same way in both application types.

Razor Pages needs to have additional NuGet packages to make the SSO work.

Razor Pages doesn't require the `CallbackPath` setting to be set.

How is SSO configured differently in Razor Pages compared to MVC?

How is SSO configured differently in Razor Pages compared to MVC?

Razor Pages don't require any additional NuGet packages in an ASP.NET Core application

`Microsoft.AspNetCore.Authentication.OpenIdConnect`

Which NuGet package needs to be installed to enable Razor Pages in a .NET application?

Which NuGet package needs to be installed to enable Razor Pages in a .NET application?

Apply the `Authorize` attribute on all the page models.

Add the `RequireAuthorization()` invocation to the `MapRazorPages()` call in the `Program.cs` file.

Inside the `AddRazorPages()` invocation in the `Program.cs` file, add the `AuthorizePage()` call for every Razor Page.

Inside the `AddRazorPages()` invocation in the `Program.cs` file, add the `AuthorizeFolder()` call for every subfolder containing Razor Pages.

What is the most efficient way to enforce authentication requirements on all the Razor Pages within a web application?

What is the most efficient way to enforce authentication requirements on all the Razor Pages within a web application?

Add the policy to the `Authorize` attribute on the page model for that page.

Page-specific authorization requirements cannot be applied in Razor Pages.

Invoke the `AuthorizePage()` method inside the `AddRazorPages()` call and apply the path to the page and the policy name as the parameters.

Invoke the `AuthorizeFolder()` method inside the `AddRazorPages()` call and apply the path to the folder containing the page and the policy name as the parameters.

How can you apply a specific authorization policy to a specific Razor Page?

How can you apply a specific authorization policy to a specific Razor Page?

Invoke the `AllowAnonymousToFolder()` method inside the `AddRazorPages()` call and apply the path to the folder as the parameter.

Invoke the `AllowAnonymousToPage()` method inside the `AddRazorPages()` call for every Razor Page inside the folder.

Don't invoke the `RequireAuthorization()` method on the `MapRazorPages()` call and instead apply the `AuthorizeFolder()` method for every subfolder except the one you want to grant anonymous access.

Don't invoke the `RequireAuthorization()` method on the `MapRazorPages()` call and instead apply the `AuthorizePage()` method for every Razor Page you want to enforce authentication on.

If you enforce application-wide authentication requirements in Razor Pages, what is the most efficient way of granting unauthenticated access to all the Razor Pages within a specific folder?

If you enforce application-wide authentication requirements in Razor Pages, what is the most efficient way of granting unauthenticated access to all the Razor Pages within a specific folder?

Test your knowledge of configuring SSO inside Razor Pages.

Introduction to Single Sign-On (SSO)

JWT and Authorization Middleware

Enabling SSO in MVC Apps

Enabling SSO in Razor Pages

Enabling SSO in Web API

Enabling SSO in Blazor

Enabling SSO in gRPC

Enabling SSO in SignalR

Wrapping Up

Appendix

Quiz Yourself on SSO in Razor Pages