Is there a better way of JWT Web Token combined with Windows Auth. for building auth service in an ASP.NET Core project?

Question

The reason behind my question is that, there is a beginner developer team at a company, starting to create a new business project after finishing some vital courses for web applications.

The aim is to have a Web Application within the company's intranet in the following form: On Angular SPA frontend with ASP.NET Core WebAPI, using Entity Framework Core with a Microsoft SQL Server database running on Windows Server.

The current authentication method of course is Windows Authentication. In order to create proper auth services, it was suggested to use JWT Web Token, however it is hard to tell whether there is a better approach for using authentication by combining them on the above mentioned Web Application.

As we are lacking of experience, a review of any familiars' would be highly appreciated in this matter!

Answer 1

The current authentication method of course is Windows Authentication. In order to create proper auth services, it was suggested to use JWT Web Token.

As you may know JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.Therefore, JWT creates a JSON web token and encodes, sterilizes, and adds a signature with a secret key that cannot be tampered with; Thus, it would ensure your application security well.

It is hard to tell whether there is a better approach for using authentication by combining them on the above mentioned Web Application.

Depending on your current application eco-system you could use Jwt without any concern as you have SPAs and other application running on intranet. While, implementing jwt it would allow you to ensure your authentication regardless of any platform. For instance, It could be windows app, SPA or any cross platform app. You can authenticate all the platfroms using this infrastructure.

As we are lacking of experience, a review of any familiars' would be highly appreciated in this matter!

Considering your scenario, here is the implementaion steps, you could follow. You always can customize it based on your requirement. Altough, I am share you the basic steps which might assist you.

Note: Following implementation, can be used either in any internal(intranet) or public web application(internet app) in any platforms.

Implementaion Guideline:

appsettings.json:

"Jwt": {
    "Key": "Set_Your_SecretKey",
    "Issuer": "YourApplication_URL"
  }

Jwt Token View Model:

public class LoginViewModel
    {
        [Required]
        [EmailAddress]
        public string Email { get; set; } = string.Empty;

        [Required]
        [DataType(DataType.Password)]
        public string Password { get; set; } = string.Empty;
    }

Jwt Token Interface:

public interface IAuthenticationRepository
    {
        Task<TokenViewModel> AuthenticateLogin(LoginViewModel loginInfo);
    }

Repository Implementation:

public class AuthenticationRepository : IAuthenticationRepository
    {
        private readonly ApplicationDbContext _dbContext;
        private readonly IMapper _mapper;
        private readonly IConfiguration _config;



        public AuthenticationRepository(ApplicationDbContext dbContext, IMapper mapper, IConfiguration config)
        {
            _dbContext = dbContext;
            _mapper = mapper;
            _config = config;
        }

        public async Task<TokenViewModel> AuthenticateLogin(LoginViewModel loginInfo)
        {
            try
            {
                var isAuthenticate = await _dbContext.Users.FirstOrDefaultAsync(u => u.UserEmail == loginInfo.Email && u.Password == loginInfo.Password);
                var tokenViewModel = new TokenViewModel();
                if (isAuthenticate != null)
                {
                    var getToken = GenerateJSONWebToken(loginInfo);
                    tokenViewModel = _mapper.Map<TokenViewModel>(isAuthenticate);
                    tokenViewModel.Token = getToken;

                }
                return tokenViewModel;
            }
            catch (Exception ex)
            {

                throw;
            }
        }

        private string GenerateJSONWebToken(LoginViewModel userInfo)
        {
            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:Key"]));
            var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

            var claims = new[] {
                        new Claim(JwtRegisteredClaimNames.Sub, userInfo.Email),
                        new Claim(JwtRegisteredClaimNames.Email, userInfo.Password),
                        new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
               };

            var token = new JwtSecurityToken(_config["Jwt:Issuer"],
                _config["Jwt:Issuer"],
                claims,
                expires: DateTime.Now.AddMinutes(120),
                signingCredentials: credentials);

            return new JwtSecurityTokenHandler().WriteToken(token);
        }

Response Model I Have Used:

public class ResponseViewModel
    {
        public string output { get; set; }
        public string msg { get; set; }
        public object apiResponse { get; set; }
    }

Auth Controller:

    [Route("api/Authentication")]
    [ApiController]
    public class AuthenticationController : ControllerBase
    {
        private readonly IAuthenticationRepository _authenticationService;

        public AuthenticationController(IAuthenticationRepository authenticationService)
        {
            this._authenticationService = authenticationService;
        }

        [AllowAnonymous]
        [Route("login")]
        [HttpPost]
        public async Task<IActionResult> LoginAsync([FromBody] LoginViewModel loginInfo)
        {
            IActionResult response = Unauthorized();

            var user = await _authenticationService.AuthenticateLogin(loginInfo);

            if (user.Token != null)
            {
                response = Ok(new ResponseViewModel { output = "success", msg = "Login Successfully", apiResponse = user });
            }

            return response;
        }

Authenticate Your Access:

Once you have successfully generate jwt auth token, now you can pass that as Bearer token for any authorization and to restrict access you can use [Authorize] before any resource where you wants to restrict access.

Output:

Note: If you would like to know more details on jwt token you could check our official document here