Introduction

Modern applications are complex and take many different forms: Web apps, mobile apps, desktop apps, CLI apps, other APIs, Bots, IoT apps, and so on. In this blog post we discuss what it takes for your API to let any app communicate with it securely via the OAuth 2.0 and OpenID Connect protocols.

By utilizing these standards, you can have a single Identity Provider protecting all of your apps. Allowing your users to sign into all of your apps using the same account, providing a seamless SSO (Single Sign On and Single Sign Out) experience. Another great benefit is you can easily allow 3rd party apps to connect to your APIs without compromising security.

OAuth

Overview and history of OAuth

OAuth is an open standard for autho

Different actors in OAuth

What's JWT

OpenID Connect

Overview and history of OIDC
Access Token vs Id Token

Authentication Flows

Authorization Code Flow
Authorization Code Flow + PKCE
Resource Owner Password Flow
Client Credentials Flow

Choosing an OpenID Connect Provider

Implementing your own OpenID Connect Provider
Using an open source OpenID Connect Provider
Using a cloud-based OpenID Connect Provider

Integrating ASP.NET Core API with Auth0

Overview of Auth0 and mapping concepts with OIDC
Integrate your API with Auth0
Test your API Authentication using Swagger
Where should we store user information
Using Auth0's API to onboard users
Role based authorization using Auth0
Permission based authorization using Auth0
Service to service communication

Bonus: Custom Authorization Implementation

Role based authorization
Permission based authorization