Search code examples
asp.net-coreasp.net-identityidentityserver4

Configure asp.net core 2 web application to use authentication from a separate IdentityServer4 server


I have a working implementation of IdentityServer4 with custom user stores, etc.

I have an asp.net core web app that I want to require user login for certain pages through the IdentityServer4 instance with my site having full ASP.Net Core Identity functionality e.g. my razor pages accessing User etc.

I have been searching for 3 days and while the internet seems to have lots of resources available on very similar topics, they all do things a little differently. I feel like I just don't know the right keywords to search for.

I have been following many online tutorials such as JWT Authentication on .Net Core and all of the quickstarts on identityserver4.io but they all leave out crucial steps.


Solution

  • IdentityServer is an implementation of oidc, which means that it serves as an independent, central authentication point. Client apps should be unaware of users credentials. That's part of the responsibility of IdentityServer.

    So the reason you won't find answers and you think steps are missing, is because you are not implementing oidc.

    It is not possible to 'hide' IdentityServer when a user has to login there.

    That leaves you with three options:

    1. implement Resource owner password flow. In that case you can collect the credentials and send it to IdentityServer. Please note that there may be security issues when you use this.

    2. Do not use IdentityServer but instead implement Asp.Net Core Identity.

    3. Send information to IdentityServer to identify the client and use custom presentation for that client. In that case the url may be different but the look and feel remains the same.