Create Custom Authentication Schemes in .NET Core

Quick Overview:
Authentication is a core process to determine a user’s identity over the internet for a particular application. Authentication acts as a fundamental building block to creating secure web applications for your business. ASP.NET Core in this domain offers several in-built authentication mechanisms however, under certain circumstances, the custom authentication system needs to meet several specific requirements. In this blog post, we will take a deep dive into the detailed step by step process of creating a custom authentication scheme in .NET Core to help you deliver a solid foundation on how to implement a custom authentication system that you can integrate within your own .NET business applications.

Starting with Custom Authentication Schemes in .NET Core

Below are the steps that you must follow to ensure the optimal implementation of the custom authentication schemes in .NET Core:

Prerequisites

When starting with the steps, the first thing to consider is that your system has all the basic needs fulfilled, meaning you have already installed the following:

• .NET Core SDK installed within your system
• An IDE or text editor of your preference

Step 1: Custom Authentication System – Designing Part

The first step requires you to design a custom authentication system for which you can consider the authentication methods that you wish to support including the username or password, social logins, token-based authentications or more. Then, you should determine the user data that you would require to store, like the username, roles, passwords, or any other relevant information. Then, you must outline the overall architecture and the flow of the authentication system depending on your project needs and requirements.

Step 2: User Management and Storage

The next step involves the implementation of the user management and the storage functionality. You must create a data model for the user account that includes details like usernames, roles, passwords, or more such relevant information. Then, decide the way you would like to store the user data, that is in a database, an external service, or any other similar mechanism. Then, implement the required logic for creating, retrieving, updating, and deleting the user accounts securely.

// Here is a code example for the user model
public class User
{
    public string Username { get; set; }
    public string Password { get; set; }
    public List<string> Roles { get; set; }
    // Now, add the additional properties based on your requirements
}

// This is the code for the user repository
public class UserRepository
{
    private List<User> _users = new List<User>();

    public void AddUser(User user)
    {
        _users.Add(user);
    }

    public User GetUserByUsername(string username)
    {
        return _users.FirstOrDefault(u => u.Username == username);
    }

    // You must implement the other methods for user management
}

Step 3: Authentication Middleware

After the user management and storage comes the authentication middleware which is responsible for intercepting the incoming requests and helping start the authentication process. You must configure the middleware pipeline to ensure that it is executed for the desired routes and requests. In the middleware, you need to validate and verify the incoming credentials and then generate the authentication tokens or the tickets depending on the authentication method.

// Here is the example code for the authentication middleware
public class AuthenticationMiddleware
{
    private readonly RequestDelegate _next;

    public AuthenticationMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // You can perform authentication logic here

        // the case where the authentication succeeds set the user principal
        var user = // Here, retrieve the user based on credentials
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, user.Username),
            // Now, add additional claims as required
        };

        var identity = new ClaimsIdentity(claims, "CustomAuth");
        var principal = new ClaimsPrincipal(identity);
        context.User = principal;

        await _next(context);
    }
}

// Then, register the middleware within the startup class
public void Configure(IApplicationBuilder app)
{
    // The additional other middleware registrations
    app.UseMiddleware<AuthenticationMiddleware>();
    // Further, additional configuration
}

Step 4: Authentication Handlers

Once, the authentication middleware is done comes the authentication handlers. You can implement the authentication handlers for performing the actual authentication process. The handlers here are responsible for validating the user credentials, authenticating the users depending on the selected authentication method, and then further generating the required authentication tokens or tickets. Based on your design, you can also have multiple authentication handlers that would support diverse authentication methods.

// This is the example code for username/password authentication handler
public class UsernamePasswordAuthenticationHandler
{
    private readonly UserRepository _userRepository;

    public UsernamePasswordAuthenticationHandler(UserRepository userRepository)
    {
        _userRepository = userRepository;
    }

    public bool Authenticate(string username, string password)
    {
        var user = _userRepository.GetUserByUsername(username);

        if (user != null && user.Password == password)
        {
            // This shows when the authentication is successful
            return true;
        }

        // Return this when the authentication failed
        return false;
    }
}

// This is the usage in the authentication middleware
var authenticationHandler = new UsernamePasswordAuthenticationHandler(userRepository);
var isAuthenticated = authenticationHandler.Authenticate(username, password);

Step 5: Integrating Authorization

Post, authentication handlers come to the integrating authorization. The integration of authorization mechanisms is needed to control the access to the resources depending on the user roles and permissions. Y must define the roles and the permissions that you need for your application and the implementation of the required authorization logic. You can achieve this using the middleware, policies, or custom authorization filters.

// Here is the example code for authorization middleware
public class AuthorizationMiddleware
{
    private readonly RequestDelegate _next;

    public AuthorizationMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        // You perform the authorization logic here

        // You must check if the user has the required roles or permissions

        if (/* When the Authorization check passes */)
        {
            await _next(context);
        }
        else
        {
            // Else return unauthorized response
            context.Response.StatusCode = 401;
            await context.Response.WriteAsync("Unauthorized");
        }
    }
}

// You must register the middleware in the startup class
public void Configure(IApplicationBuilder app)
{
    // The other middleware registrations
    app.UseMiddleware<AuthorizationMiddleware>();
    // Further additional configuration
}

Conclusion

In the end, we can infer that Authentication and Authorization in .NET Core is a crucial step to ensuring the security of your business application. But, we are sure that this blog post gives you a significant understanding of the steps to Create Custom Authentication Schemes in .NET Core. You can leverage this knowledge to create a secure and custom authentication system for your business applications and enhance the system further with add-on features such as multi-factor authentication integration with external identity providers or more. However, if you are a business owner and are confused about the ideal way to implement the same within your business application, then get in touch with a leading .NET application development company like Positiwise and get started today!