C# ASP.NET MVC Authentication - Logging in locally or with OAuth (using Twitter) credentials

Setting up an ASP.NET MVC site to allow people to log in is not that hard. In this video, I demonstrate how you can set up a login system for users, how you can upgrade that system to include Twitter authentication (using OAuth), and then how you can lock down your site to only allow certain people access to certain areas. We will create security groups and lock things down even further.

0:00 - Intro
1:41 - ASP .NET Framework demo app with authentication
13:01 - Register vs Login explained
15:25 - Built in user registration and login
18:28 - Registration C# code overview
23:45 - Built in SQL
29:45 - Twitter authentication setup
45:37 - Implementing user restrictions
52:48 - Restrictions based on user role
1:01:03 - Who is logged in?
1:02:20 - Summary and concluding remarks

Thanks to Ralfs HBK for the chapter breakdown

[default]

I am finally in AUTH stage now! I have planned my databases clearly, using my personal NF rules.
1. Can be many to one? New Table
2. Only one to one? Same Table
I am about to do start getting freaky freaky hands on when I realize that, hey, I need auth. And Now I'm here.
With just 3 videos, ASP.NET MVC, Data Access and OAUTH, I feel like a professional now. I must say ASP.NET Core MVC is much more clearer and simpler now that I understand that models in ASP.NET MVC is just for views. Sorry for long text, you are the best.

[RalfsBalodis]

0:00 - Intro
1:41 - ASP .NET Framework demo app with authentication
13:01 - Register vs Login explained
15:25 - Built in user registration and login
18:28 - Registration C# code overview
23:45 - Built in SQL
29:45 - Twitter authentication setup
45:37 - Implementing user restrictions
52:48 - Restrictions based on user role
1:01:03 - Who is logged in?
1:02:20 - Summary and concluding remarks

[Babaelow]

For those confused: The local authentication is also (still) called "Forms Authentication", although it's not about Webforms anymore. It's somewhat different though than the Webforms thing.

[martinvaughan]

Great video! It would be really handy to see a follow-up to this detailing how Authorize works behind the scenes and how to take more control over what entity framework is doing.

[lindelihlesambo]

Tim is King!!!. you make everything easy. I normally dread long videos but this one seemed like it was 5min the way I was enjoying it.

[timothywestern]

Yeah I tried taking the ApiHelper/Token idea that you did an MVVM app with, took a while but was able to login. Then I decided that Owin was the next thing to learn, but I couldn't figure out why it didn't work out of the box. It turned out, that when I moved it from local to a named instance locally that I had the wrong connection string. So if you run into that issue, check that. I love your work Tim. Really helpful to shake off some of that rust.

[ab_obada]

God loves me so much that I have found your channel :)

[jeppechristensen]

Hi Tim. Thank you very much for the videos that you provide - I've already watched a bunch of them, and found that they help me a lot.
Just recently I read the book "Patterns of enterprise application architecture" by Martin Fowler, and figured that you haven't covered much of those patterns as is - other than of cause, general architectural principles that developers should adhere to, i.e. SOLID and DRY.

When I read the book, a bunch of these patterns were sort of abstract. I understood the general ideas, but personally it would be extremely helpful to see a seasoned .net developer like you, show them in practical setting, and give your personal opinion on the most common ones.

Additionally, now when we talk about patterns... When I see this video, i cant help thinking, how to implement this "out of the box" user authentication system in a common 3-layer application, where we don't use a local database but rather one on a server. How would you implement it in your business logic? would you even do that?

[satyabratamohapatra]

Best tutorial on OAuth. Clean and to the point explanation. Thank you TIM !!

[preshnaidoo]

Thanks Tim. I know everyone has different opinions and you’ll base your future videos on the majority, but I think the level of repetition is spot on and the content presented in a very clear manner.

I am one of those people making my way up to mvc core, so this has been very helpful.

You mentioned that you weren’t a big fan of entity, I’d appreciate a video on your take on this and what you do use.

[Babaelow]

"leaving authentication to Microsoft" can also mean leaving it to your local active directory, not only to Microsoft online services such as azure. However, you may still build your own AUTHORISATION system if you don't want to create AD Groups for everything. Tim, as always, correct me if you shouldn't build that on your own either :)

[cloudhot]

Great video man! Thinking of making an app into an asp.net MVC style and I was worried that authentication would be a nightmare. Thanks for making it more simple!!

[jacklee]

Hi Tim. Thanks for great video. I wish I'd seen this a long time ago. I've read numerous tutorials but you've made a seemingly complicated subject a lot easier to understand, this video was perfect for me as a starting point for further study into the subject. Thanks again. :)

[TheAngelOfDeath]

Brilliant! Thank you so much, Corey. Amazing as always. It would be really nice to see more about Access Control using MVC and C#. Security is super important, but also one of the biggest error zones where developers (especially new developers) make mistakes, often costly ones. In these times where there are hackers, trolls and ghouls all over the place, educating people on security and how to make it easy, but good, is relevant.

Thanks,
Martin.

[blackdog]

Hi Tim, thanks for the wonderful tutorial! I am new to authorization and bit confused as to use third party tools like Auth0, IdentityServer5, okta vs the Identity Framework provided by Microsoft. Is the Microsoft Identity really that unsecure as people on the internet say? All the third party auth tools are black box and have not so good documentation, where as identity is easy to setup.

[davesimon]

Gone are the days where one could download a shareware copy of Hotdog HTML editor and publish a site with having just a few files. (Which IMO, is a good thing. I feel the internet became convoluted with junk because people could just keep adding trash to the pile not having any technical skill or understanding what's going on under the hood.)

Great video!

[MegasXLR]

Hello, I get "Response status code does not indicate success: 401 (Authorization Required)." when I click on the Twitter login button. Both sites in the apps.twitter.com app are real websites. What could be the problem? Also, do you have a tutorial on enabling email verification by using the built-in things that MVC makes for us. I know there are Email & SMS verifications but not sure how to use them after a person has registered.

[tnysvntr]

Hello Tim Corey, I would like to suggest for you to create a complete website or system using asp.net mvc just like the retail manager. That would really help us, me specially to learn a lot from you.. thank you very much

[chineduokolie]

Hi Tim. New to authentication and I followed the tutorial, however I still get the "The remote certificate is invalid according to the validation procedure" error.

[drimadoh]

Hey Tim... I can't thank you enough for this awesome stuff.. I'm using some of them in my teachings at university :D
Will you be doing anything soon on Xamarin??