ASP.NET Core SSO with Cookie Authentication (.NET 7 Minimal Apis C#)

👉 Try Rider
RD5K9-4TXXW-KMV3G-NYWSF-3ZSTP

🕰 Timestamps
00:00 Introduction
00:35 Cookie Authentication and Authorization Setup
04:50 Adding Data Protection Api
08:27 Domain Setup
12:56 Configuring Cookie Domain

#csharp #aspnetcore #sso

[themt.oceans]

I just subscribed! I love how clearly and quickly you get down to the details and skip all the talking and unnecessary (off topic) code. Well done!

[JoonhwanLee]

Your explanation is always fluent and smooth. Helped a lot!

[nayanchoudhary]

This is my 4th video from your channel and none was able to disappoint! Security concepts are important and you explained them very nicely. Subscribing for such clean presentations!

[allinvanguard]

Neat tutorial man. I recently went through that exact same issue as well, so it's good for me to see that I did it the right way. It's pretty straight forward once you know about dataprotection and schemes, but man, I wish that dotnet Identity made it a little bit easier to get through the whole scheme constants and setup mess.

Not to mention that some extension methods are severly bloated, and there's no real "minimal" setup method if you don't do it yourself. If you add scheme X, then it suddenly automatically overwrites scheme Y under the hood, which you setup with another previous method etc. ... Debugging it is hell, and no way you can do it without constantly looking into the framework sources

[huzzah]

Lol this is pretty funny timing. About a month ago I asked how to do this specific thing on your Do you need IdentityServer? video. And now when I finally sat down today to do it you came out with this video. Nice.

[PhilipDanielHayton]

This is exactly what I needed. Didn’t know about caddy but it looks like it’ll solve my local setup 👌🏻

Anyway, love your videos, keep them coming

[neutronstar]

Awesome video. I used IdentityServer3 one to secure 3 apis on the same domain, and this method is much more simpler.

[lasindunuwanga]

great show man! very clear, hard work, great knowledge sharing!

[ivandamyanov]

Exactly the thing I needed. Thinking about migration from .NET framework to .NET 6 and running both apps behind reverse proxy with shared cookies. Thank you!

[EzequielRegaldo]

You won a subscriber, AMAZING tutorial

[fieryscorpion]

This was great. Thanks!
4:50 I have a question: So after you logged into Identity -> 'localhost:7094/login' and tried to hit your app -> 'localhost:7240/protected', it redirected you to where login isn't implemented. So is there a way to just redirect the user to the login endpoint of Identity app when they try to hit protected endpoint in the app?

[sgroxatdgp]

I got a question here. As we are already using reverse proxy to map app.company.lcoal to localhost:port, do we need to add the app.company.local entry to hostfile explicitly? My understanding is any of that would work. Either hostfile or reverse proxy?

[lw]

thank you for the tutorial. When I use SignInManager to sign in user, it won't apply the cookie, but still the old ".AspNetCore.Identity.Application", and the domain keeps stay in the identity domain, not for all subdomains under .company.local. could you please help?

[rajuarge]

Thanks for the video and explained very well clearly. It is very helpful to everyone.

I would like to take some suggestions from you, I am thinking create a reusable single sign-on (SSO) component can allow users to authenticate once and gain access to multiple applications without having to sign in again. This component can be designed to work with different SSO protocols, such as SAML, OAuth2, or OpenID Connect, and can provide APIs for integrating with different identity providers, such as Active Directory, Google, or Facebook.

Is it good idea or not?
Is it useful if someone wants to implement SSO in their applications?

[alfonsdeda]

Amazing tutorial!
How can i share logged user between multiple blazor apps using identity in .net 8?

[cocoscacao]

One interesting observation... The amount of views you get baffled me for quite some time. Rare are the channels that deep dive into specifics. Actually, this is the only one I know of. Pretty much everyone just wants easily digestible, short content with a dumb thumbnail and a clickbait title. ADD bastards...

Keep up! Cheers for another good video ;)

[emabianchetti]

In my company we would like to migrate a set of applications from windows form to .NET Core Web app hosted in a local server. Since our PC belongs to a domain network, my idea was to structure the new infrastructure as you show in this video. So one app (IdentityServer) will be responsible to ask the user credentials and forward them via LDAP to the AD server that manages our domain credentials. When it authorizes the user, the identityserver looks for his permissions in our SQL db and then authorizes/non authorize the user to access the specific app resources… Could work?

[TheAzerue]

Very nice, simple and easy to follow video. One question when to use AspNetCore Identity can you please elaborate use cases for identity. And if we have mobile version. Can we use two schemes in one project. like JWT and Cookie.

[Classicv]

So are the persistent keys just pointers to cookies? What's the point of storing a keyring?

I have two apps sharing cookies and all I had to do was call:

[bilal-elmursi]

How can I use this approach (cookie-based authentication) with other apps that are using token-based authentication, such as SPA (JWT-based authentication) all under SSO umbrella?