Multiple JWTs in .NET: How to Implement Multi-Token Authentication

[@MilanJovanovicTech]

Want to master Clean Architecture? Go here: bit.ly/3PupkOJ
Want to unlock Modular Monoliths? Go here: bit.ly/3SXlzSt
Join a community of 1000+ .NET developers: www.patreon.com/milanjovanovic

Díky!

[@MilanJovanovicTech]

Thank you very much!

[@mreshboboyev]

This is absolutely useful , thank you Milan!

[@MilanJovanovicTech]

@@mreshboboyev Glad you enjoyed it. This has been asked many times in the channel, so figured I'd cover it.

[@thiagomatu]

Nice, I work on an application that supports multiple authentication providers, but this your code is so much clean and easier to understand, thanks for sharing this Milan!

[@MilanJovanovicTech]

Glad it helped!

[@ruekkart]

Awesome! I was thinking about this for a multitenant app where each tenant can define its own auth provider, and this seems pretty helpful for that.

[@MilanJovanovicTech]

That's a great idea!

[@AbdulHaseeb-vc5yv]

Exactly what I needed. Thanks!

[@MilanJovanovicTech]

Awesome

[@kabal911]

Nice.
I coincidentally did a pretty similar thing yesterday, where I wanted to support Cookie auth OR JWT auth.
Took a bit of time to figure out the existence of AuthorizationBuiler and the DefaultPolicy

[@MilanJovanovicTech]

Nice work!

[@johncerpa3782]

Great video!

[@MilanJovanovicTech]

Thanks!

[@cesarmauricioguerrerobatre591]

Amazing, it was a masterful explanation, what happens when I have several clients coming from keycloak and I need a certain client to access a certain number of enpoints, how do I do this?

[@MilanJovanovicTech]

Check out Keycloak authorization

[@timur2887]

Thank you!

[@MilanJovanovicTech]

You're welcome!

[@yaelsleman660]

Mr please.. I need to know what is you opinion about ABP framework and it is important to learn it?

[@MilanJovanovicTech]

Can't say

[@eduardoyupanqui]

Wow, its no necessary add policyscheme to select the scheme to validate?

[@MilanJovanovicTech]

But you can if you want to

[@nenzax2701]

Great Video, quick question, how do we tie a particular controller method to a specific jwttoken, ex: api/getusers should use keycloak, api/getadmins should use supabse

[@MilanJovanovicTech]

Authorize[AuthenticationSchemes: "custom_scheme_name"]
I may have missed the exact syntax, but you can specify the scheme you want to use for a given controller/endpoint

[@vichustephen4475]

@@MilanJovanovicTech But if I put both schemes , the middleware will make public cert verification requests to both endpoints . Need to use AddPolicyScheme with forward selector

[@michxkowal4282]

Hi, do you know how to change the secret key while the API is running? I would like to be able to externally change secret in certain situations.

[@MilanJovanovicTech]

Update the ENV var

[@thomasvlima]

And a multitenant API where each tenant has its own user pool?

[@MilanJovanovicTech]

But same auth provider?

[@thomasvlima]

@MilanJovanovicTech yes. For example, using cognito, each tenant has its own user pool. And each user pool can have its own AD integration

[@binoypatel09]

Is Microsoft Entra ID work same way?

[@MilanJovanovicTech]

In what way do you mean?

[@binoypatel09]

Let say I have a server app with the multiple different client apps, some apps use built-in authentication in the server app and some uses Microsoft Entra ID withe the same server app, so how am I going to accomplish this?

[@mr-black_rock321]

How to secure jwt access token in SPA (Single Page Application)

[@MilanJovanovicTech]

Same-site + Secure cookie

[@mr-black_rock321]

@@MilanJovanovicTech BFF can secure the access token ?

[@codenetw]

Thx!

[@MilanJovanovicTech]

Any time