This code sample demonstrates how to implement authentication with Auth0 by Okta in a ASP.NET Core v5 web application using the Auth0 SDK for ASP.NET Core applications. This #C code sample implements the following security tasks:
- How to add user login, sign-up, and logout to ASP.NET Core v5 Applications.
- How to use the ASP.NET Core Authorization Middleware to protect ASP.NET Core v5 application routes.
- How to make API calls from ASP.NET Core to request data from a protected API.
- How to get user profile information to personalize an ASP.NET Core user interface.
ASP.NET Core v5 Code Sample Specs
This code sample uses the following tools:
- ASP.NET Core
v5.0 - Auth0 SDK for ASP.NET Core
v1.0.3
The application was tested using Microsoft.AspNetCore.App v5.0.408 and Microsoft.NETCore.App v5.0.408.
Quick Auth0 Set Up
First and foremost, if you haven't already, sign up for an Auth0 account to connect your web application with the Auth0 Identity Platform.
Next, you'll connect your web application with Auth0. You'll need to create an application registration in the Auth0 Dashboard and get three configuration values: the Auth0 Domain, the Auth0 Client ID, and the Auth0 Client Secret. You'll also need to define an Auth0 Audience value within your project to practice making secure calls to an external API.
Get the Auth0 domain and client ID
-
Open the Applications section of the Auth0 Dashboard.
-
Click on the Create Application button and fill out the form with the following values:
Hello World Client
- Click on the Create button.
An Auth0 Application page loads up.
As such, click on the "Settings" tab of your Auth0 Application page, locate the "Application URIs" section, and fill in the following values:
http://localhost:4040/callback
http://localhost:4040
Scroll down and click the "Save Changes" button.
Next, locate the "Basic Information" section.
When you enter a value in the input fields present on this page, any code snippet that uses such value updates to reflect it. Using the input fields makes it easy to copy and paste code as you follow along.
As such, enter the "Domain" and "Client ID" values in the following fields to set up your web application in the next section:
Set Up and Run the ASP.NET Core v5 Code Sample
Start by cloning the project into your local machine:
git clone https://github.com/auth0-developer-hub/web-app_aspnet-core-v5_csharp_hello-world.git
Make the project directory your current working directory:
cd web-app_aspnet-core-v5_csharp_hello-world
Then, check out the basic-authentication branch, which holds all the ASP.NET Core v5 code related to implementing basic user authentication with Auth0:
git checkout basic-authentication
Create a .env file under the root project directory:
touch .env
Populate the .env with the following environment variables:
PORT=4040AUTH0_DOMAIN=AUTH0-DOMAINAUTH0_CLIENT_ID=AUTH0-CLIENT-IDAUTH0_CLIENT_SECRET=AUTH0-CLIENT-SECRETAUTH0_CALLBACK_PATH=/callback
Get the Auth0 Client Secret
Head back to the "Settings" tab of your Auth0 application page in the Auth0 Dashboard to get the value for AUTH0_CLIENT_SECRET.
Locate the "Client Secret" field, copy its value, and paste it as the AUTH0_CLIENT_SECRET environment value in the .env file.
Run the ASP.NET Core v5 Code Sample
Execute the following command to run the ASP.NET Core v5 web application:
dotnet run
This ASP.NET Core v5 code sample offers a functional application with views and services to hydrate the user interface. It is important to notice that the service implemented in the basic-authentication branch simulates the external API by placing the responses directly on the code.
Later, you'll integrate this ASP.NET Core v5 web application with a real API server using any of the "Auth0 Hello World" API code samples with the backend technology of your choice.
Use the ASP.NET Core v5 Sample Application
You can now visit http://localhost:4040/ to access the application.
When you click on the "Log In" button, ASP.NET Core takes you to the Auth0 Universal Login page. Your users can log in to your application through a page hosted by Auth0, which provides them with a secure, standards-based login experience that you can customize with your own branding and various authentication methods, such as logging in with a username and password or with a social provider like Facebook or Google.
Once you log in, visit the protected "Profile" page to see all the user profile information that Auth0 securely shares with your application using ID tokens:
You can test that the protected ASP.NET Core routes require users to log in before accessing them. Click on the "Log Out" button and try to access the Profile page, Protected page, or the Admin page:
If everything is working as expected, ASP.NET Core redirects you to log in with Auth0.
Connect the ASP.NET Core v5 Code Sample with an API Server
Before you can practice requesting protected resources from an external API server using access tokens, you need to set up and configure an API with Auth0. You can pair this ASP.NET Core v5 code sample with any of our "Hello World" API server code samples.
Set up a Hello World API server
Pick an API code sample in your preferred backend framework and language from the list below and follow the instructions on the code sample page to set it up. Once you complete the sample API server set up, please return to this ASP.NET Core v5 code sample page to learn how to integrate that API server with your ASP.NET Core v5 web application.
While setting up the API server code sample, you created an Auth0 Audience value. Store that value in the following field so that you can use it throughout the instructions present in this section easily:
Set up the ASP.NET Core v5 client application
If you haven't cloned the repository already, start by cloning the ASP.NET Core v5 project into your local machine:
git clone https://github.com/auth0-developer-hub/web-app_aspnet-core-v5_csharp_hello-world.git
Make the project directory your current working directory:
cd web-app_aspnet-core-v5_csharp_hello-world
Then, check out the basic-authentication-with-api-integration branch:
git checkout basic-authentication-with-api-integration
Now, either create or update the .env file under the ASP.NET Core v5 project directory with the following:
PORT=4040AUTH0_DOMAIN=AUTH0-DOMAINAUTH0_CLIENT_ID=AUTH0-CLIENT-IDAUTH0_CLIENT_SECRET=AUTH0-CLIENT-SECRETAUTH0_CALLBACK_PATH=/callbackAPI_SERVER_URL=http://localhost:6060AUTH0_AUDIENCE=AUTH0-AUDIENCE
This time around, you include the API_SERVER_URL and AUTH0_AUDIENCE values.
The API_SERVER_URL is the URL where your sample API server listens for requests. In production, you'll change this value to the URL of your live server.
The AUTH0_AUDIENCE is an identifier that represents the compatible Hello World API you just registered in your Auth0 tenant. This identifier is also known as the Auth0 audience. Your ASP.NET Core v5 web application must provide this value to the Auth0 authorization server in order to get a valid access token to make authenticated requests to the compatible external API.
If you haven't started the ASP.NET Core v5 web application yet, execute this command to run it:
dotnet run
Now your ASP.NET Core is all set up to request protected data from the "Hello World" API server of your choice. Ensure that your API server is running and visit the Admin page of your ASP.NET Core v5 web application:
Verify that this page is displaying the relevant messages from the API.
This basic-authentication-with-api-integration branch of the code sample repository demonstrates "how to request protected data from an API using access tokens in ASP.NET Core v5".