Authentication Fundamentals

What is Authentication?

Authentication is the process of determining who the user is. It verifies the user's identity through credentials like username/password, tokens, or external providers.

Authentication vs Authorization

Aspect	Authentication	Authorization
Question	Who are you?	What can you do?
Purpose	Verify identity	Grant permissions
Example	Login with username/password	Admin can delete users
Happens	First	After authentication

Authentication Schemes

ASP.NET Core supports multiple authentication schemes:

Scheme	Description	Use Case
Cookie	Browser-based authentication	Traditional web apps (MVC, Razor Pages)
JWT Bearer	Token-based authentication	APIs, SPAs, mobile apps
OAuth 2.0	Delegated authorization	Third-party access (Google, Facebook)
OpenID Connect	Identity layer on OAuth 2.0	Single sign-on (SSO)

Claims and Principals

Claims

A claim is a piece of information about the user (name, email, role, etc.).

var claims = new List<Claim>
{
    new Claim(ClaimTypes.Name, "john@example.com"),
    new Claim(ClaimTypes.Email, "john@example.com"),
    new Claim(ClaimTypes.Role, "Admin"),
    new Claim("UserId", "123")
};

ClaimsIdentity

A collection of claims representing a single identity.

var identity = new ClaimsIdentity(claims, "CookieAuth");

ClaimsPrincipal

Represents the current user (can have multiple identities).

var principal = new ClaimsPrincipal(identity);

// Access in controllers/pages
var userName = User.Identity?.Name;
var isAuthenticated = User.Identity?.IsAuthenticated;
var email = User.FindFirst(ClaimTypes.Email)?.Value;

Authentication Middleware

var builder = WebApplication.CreateBuilder(args);

// Add authentication services
builder.Services.AddAuthentication("CookieAuth")
    .AddCookie("CookieAuth");

var app = builder.Build();

// Use authentication middleware (BEFORE authorization)
app.UseAuthentication();
app.UseAuthorization();

app.Run();

Accessing User Information

public class HomeController : Controller
{
    public IActionResult Index()
    {
        // Check if authenticated
        if (User.Identity?.IsAuthenticated == true)
        {
            var userName = User.Identity.Name;
            var email = User.FindFirst(ClaimTypes.Email)?.Value;
            var userId = User.FindFirst("UserId")?.Value;
        }

        return View();
    }
}

@if (User.Identity?.IsAuthenticated == true)
{
    <p>Welcome, @User.Identity.Name!</p>
}
@else
{
    <a href="/login">Login</a>
}

Key Takeaways

• Authentication: Verifying who the user is
• Authorization: Determining what the user can do
• Claims: Information about the user
• ClaimsIdentity: Collection of claims
• ClaimsPrincipal: Represents the current user
• Schemes: Cookie, JWT, OAuth, OpenID Connect
• Middleware: UseAuthentication() before UseAuthorization()