Implementing authentication

Authentication allows applications to identify a specific user. It is not used to manage user access rights, which is the role of authorization, nor is it used to protect data, which is the role of data protection.

There are several methods for authenticating application users, such as:

• Basic user forms authentication, using a login form with login and password boxes
• Single Sign-On (SSO) authentication, where the user only authenticates once for all their applications within the context of their company
• Social networks external provider authentication (such as Facebook and LinkedIn)
• Certificate or public key infrastructure (PKI) authentication

ASP.NET Core 2.0 supports all these methods, but in this chapter, we will concentrate on forms authentication with a user login and password, and external provider authentication via Facebook.

In the following examples, you will see how to use those methods for authenticating application users, as well as some more advanced features...