ASP. NET Identity

Asp. NET authentication method

Windwos authentication : Generally used for LAN applications. When Windows authentication is used, the user's Windows security token sends messages using HTTP requests during the user's access to the entire site. The application verifies the validity of the account with a security token in the local (or domain) scope , and evaluates the permissions that the user has in the role. Users are required to provide security credentials when user authentication is invalid or not authorized.

Forms Validation : In the Windows authentication mechanism, a problem occurs when a Web site is accessed by an extranet user that is outside the scope of the local domain controller. Using Forms authentication, ASP. NET needs to validate the encrypted HTTP cookie or query string to identify all of the user's requests. Cookies are closely related to the ASP (session), where sessions and cookies expire after the session times out or when the user closes the browser, and the user needs to re-login to the site to establish a new session.

Forms validation Process

1, user input account number and password.

2. Specify the validation policy to check whether the user is valid.

3, the authentication passes, then generates a cookie file on the client. The cookie file identifies that the user has been authenticated and does not need to be re-verified when you visit other resources on the site.

ASP. Membership

The use of Forms authentication solves basic authentication problems. However, most applications also contain storage issues for role and user management and permission information. The following work is also required:

• Create User and role tables
• Writing code to access a data table
• Provide authentication policies for users and passwords

Almost every application has these requirements. In response to these requirements, Microsoft offers a membership solution that addresses the common requirements of Web applications for membership, including forms authentication, storing user names, passwords, and user profiles (profile).

Membership simplifies the writing of applications, however, with the iterative change of requirements, the ASP. NET membership also shows weakness:

• The database schema is limited by SQL Server
• A stiff table storage structure.
• System dependency Database.
• You cannot use Owin. (Due to login, logout function based on form authentication, third-party account access is more difficult.) )

OWIN (Open Web Interface for. NET)

Owin is a specification that defines the interaction between a Web server and an application component. The purpose of this specification is to develop. NET-related Web server and application components ecosystem.

For more information refer to http://owin.org/

ASP. NET Identity

As a security framework provided by Microsoft, the ASP. NET identity has the following advantages:

A unified framework

Can be easily integrated into the various frameworks and programs of ASP. For example, ASP. Mvc,web froms,web Pages,web API, SIGNALR, and so on.

Customizing user Information

Convenient extension of user information. Such as: Add the user's birthday, age and so on.

Flexible role management

Role providers in the ASP. NET identity can restrict access to parts of an application based on roles.

Data persistence and compatibility

By default, the ASP. NET identity system stores all of the data in a SQL Server database and uses the entity Framework coder first to implement database management.

Unit testing Capabilities

The ASP. NET identity provides a complete unit testing mechanism.

Owin Integration

Asp. NET authentication (authentication) is based on Owin middleware and can be used on any Owin host. The ASP. NET identity is not dependent on system.web and is fully compatible with the Owin framework and can be used in any application hosted by Owin.

NuGet Package

The ASP. NET identity is published as a NuGet package and is provided as part of each Web project template in vs. Can be downloaded directly from the NuGet library.

This release approach allows the ASP to do a better job of development.

ASP. NET Identity Component

The ASP. NET identity mainly includes core function module, entityframework module and Owin module. Specific as follows:

Microsoft.AspNet.Identity.Core

Core library that contains the main features of the identity.

Microsoft.AspNet.Identity.EntityFramework

Mainly includes the implementation of the EF part.

Microsoft.AspNet.Identity.OWIN

Support for the Owin.

ASP. NET Identity