This course will be retired on June 1, 2025.
Heads up! To view this whole video, sign in with your Courses account or enroll in your free 7-day trial. Sign In Enroll
Preview
Start a free Courses trial
to watch this video
Now let's take a look at the authentication process again, this time with ASP.NET Identity specifically in mind.
Microsoft's Azure Cloud Computing Platform
For more information about Microsoft's Azure cloud computing platform, see the official website at https://azure.microsoft.com/.
Identity Releases
Here's a list of the features included in each of the major releases of the ASP.NET Identity authentication system.
1.0
- One ASP.NET Identity system
- Compatible with MVC and Web API (and Web Forms, Web Pages, and SignalR)
- Easy to customize the user and profile data schemas
- Easy to customize the persistence of user and profile data
- Works well with EF
- Supports unit testing
- Support for user roles
- Support claims-based authentication
- Allows you to be more descriptive than simple roles provide
- Support for social logins
- Support for Azure Active Directory
- OWIN integration
- Identity works with any OWIN compliant host
- Identity does not have a dependency on System.Web
- Delivered using NuGet packages
2.0
- Ability to delete users and roles
- Security Token Provider
- Account confirmation
- Password reset
- Two-factor auth
- Account lockout
2.1
- SignInManager
- VS templates updated to use two-factor auth
2.2
- Bug fixes and performance improvements
What is Katana?
Katana is the Microsoft developed implementation of the OWIN specification. For more information, see this article:
ASP.NET Core and OWIN
ASP.NET Core fully embraces the ideas introduced in OWIN: everything in ASP.NET Core is implemented as middleware. Even existing OWIN components can be used as ASP.NET Core middleware. For more information about using OWIN with ASP.NET Core, see this article:
Open Web Interface for .NET (OWIN) with ASP.NET Core
Main Identity Classes
Here are the main Identity classes that we'll be working with in this course:
Related Discussions
Have questions about this video? Start a discussion with the community and Treehouse staff.
Sign upRelated Discussions
Have questions about this video? Start a discussion with the community and Treehouse staff.
Sign up
Now that we've combined key based
authentication and HTTP cookies to
0:00
implement user authentication,
let's take a look at the authentication
0:04
process one more time, this time with
ASP.NET Indentity specifically in mind.
0:09
ASP.NET Identity sits between your web
app and the client, the user's browser.
0:14
This allows identity to
inspect each incoming request.
0:20
Identity starts by looking for
an authentication cookie and
0:24
if it doesn't find one it'll redirect
the user to the sign-in page.
0:28
Using a form on the sign in page,
the user posts their user name and
0:33
password to the server.
0:36
An MVC controller in your web
app handles the request and
0:38
uses identity to verify
the provided username and password.
0:42
If the log in is successful,
identity is then used to sign in the user.
0:47
Signing in the user causes identity to
create an authentication cookie containing
0:52
information about the user and attaches it
to the response returned to the client.
0:58
The user information stored in the cookie
is encrypted in order to keep it safe.
1:03
After receiving the authentication cookie,
1:09
the browser will include the cookie in
every subsequent request to the server.
1:11
This time, when Identity inspects
the incoming request looking for
1:16
an authentication cookie you'll find one.
1:20
The user information stored in
the cookie is then decrypted and
1:23
added to the request.
1:27
This makes the user information available
to the rest of the code that will run
1:28
as part of processing the request and
preparing the response to the client.
1:33
Because all of the identity
information is kept in the cookie,
1:38
the server doesn't need to keep track
of the users who are authenticated.
1:41
The presence of
the authentication cookie alone
1:46
is what determines if a user
is signed in to our web app.
1:48
In order to process incoming requests and
modify outgoing responses from your
1:53
ASP.NET web app, identity provides
a set of OWIN middleware components.
1:57
ASP.NET applications are built
to run on a web server.
2:03
A web server is a special
type of application.
2:07
Web servers listen for
HTTP requests and host websites and
2:11
web apps which are used to process
requests and prepare HTTP responses.
2:15
Microsoft's Internet Information Services,
or IIS,
2:21
is a commonly used web server for
hosting ASP.NET applications.
2:26
OWIN is the Open Web Interface for .NET.
2:31
OWIN represents a web server as two
separate concepts, a host and a server.
2:36
The host manages the startup of your
web apps which includes selecting and
2:43
starting the server.
2:46
Once started, the server listens for
HTTP requests.
2:48
When you write code for OWIN,
you write components called middleware.
2:52
These are components that sit in
the middle between the server and
2:56
your web app.
3:01
A series of middleware components
are combined to form a request pipeline.
3:02
When the server receives an HTTP request
it passes it through the request pipeline.
3:07
Each incoming HTTP request passes through
each of the middleware components in
3:12
the pipeline in the order that they were
configured, before reaching the webapp.
3:19
After the web app has processed
the request and created a response,
3:23
the response then passes back through
the pipeline in the reverse order.
3:28
If the middleware component is
able to fully process a request
3:34
it can immediately return a response,
3:37
short circuiting the remaining
middleware components and the web app.
3:39
When using OWIN, your code interacts
with only the OWIN host and
3:44
server abstractions instead of interacting
directly with the underlying web server.
3:48
This approach decouples your code from
the specific web server that you use for
3:54
development, testing and production.
3:58
While it's possible for an entire web
applications to be written using nothing
4:02
but OWIN middleware components, this isn't
the approach that ASP.NET identity takes.
4:06
As mentioned earlier, ASP.NET identity
sits between your web app and the client.
4:12
To make this possible, identity leverages
OWIN middleware components to inspect
4:18
each incoming request and
to modify request and responses as needed.
4:23
By using OWIN middleware identity is also
able to work multiple frameworks including
4:29
ASP.NET MVC and web API while supporting
any OWIN compliant host including IIS,
4:35
Microsoft's Azure Cloud Computing
platform and self hosting scenarios.
4:43
Don't worry if you find any of
this information confusing.
4:49
The important thing to remember is
that OWIN middleware components
4:53
are used to process incoming requests
before they reach your web app.
4:57
And they're able to modify the responses
that are created by your web app before
5:01
they're sent back to the client.
5:06
We'll continue to revisit each of
the key user authentication concepts and
5:08
components throughout
the remainder of this course.
5:12
So don't worry if you feel overwhelmed or
confused, you've got this.
5:15
In the next step,
let's review the Visual Studio solution
5:21
that we'll be working with throughout
the remainder of this course.
5:24
You need to sign up for Treehouse in order to download course files.
Sign upYou need to sign up for Treehouse in order to set up Workspace
Sign up