Authentication, authorisation and Identity — ASP.NET Core MVC (and Razor Pages)

12. Authentication, authorisation and Identity

Intermediate★ Must knowLesson 12 of 15

csharp

builder.Services.AddDefaultIdentity<IdentityUser>(o => o.SignIn.RequireConfirmedAccount = true)
    .AddRoles<IdentityRole>()
    .AddEntityFrameworkStores<AppDbContext>();

builder.Services.AddAuthorization(o =>
{
    o.AddPolicy("CanApprove", p => p.RequireRole("Manager").RequireClaim("department", "Finance"));
    o.FallbackPolicy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();  // secure by default
});

[Authorize(Policy = "CanApprove")]
public class ApprovalsController : Controller
{
    [AllowAnonymous] public IActionResult About() => View();
}

Authentication = who you are (cookie, JWT, OpenID Connect with Microsoft Entra ID/Google). Authorisation = what you may do (roles, claims, policies, resource-based checks via IAuthorizationService).
MVC apps typically use cookie authentication; APIs use JWT bearer tokens.
Identity stores users, hashed passwords (PBKDF2), roles, claims, 2FA, lockout, external logins.