I am finally in AUTH stage now! I have planned my databases clearly, using my personal NF rules. 1. Can be many to one? New Table 2. Only one to one? Same Table I am about to do start getting freaky freaky hands on when I realize that, hey, I need auth. And Now I'm here. With just 3 videos, ASP.NET MVC, Data Access and OAUTH, I feel like a professional now. I must say ASP.NET Core MVC is much more clearer and simpler now that I understand that models in ASP.NET MVC is just for views. Sorry for long text, you are the best.
0:00 - Intro 1:41 - ASP .NET Framework demo app with authentication 13:01 - Register vs Login explained 15:25 - Built in user registration and login 18:28 - Registration C# code overview 23:45 - Built in SQL 29:45 - Twitter authentication setup 45:37 - Implementing user restrictions 52:48 - Restrictions based on user role 1:01:03 - Who is logged in? 1:02:20 - Summary and concluding remarks
@@IAmTimCorey I have been looking for a tutorial like this . Can you help me with a tutorial that explains how to set redirect pages for different users when using default login in MVC with entity. Hopefully one that can also explain how to hide certain tabs in the nav bar based on user roles. Thank you in advance.
For those confused: The local authentication is also (still) called "Forms Authentication", although it's not about Webforms anymore. It's somewhat different though than the Webforms thing.
I don’t think it was ever about WinForms. It may have been a reference to WebForms, but I don’t think so. I think it is just about needing a login form.
Great video! It would be really handy to see a follow-up to this detailing how Authorize works behind the scenes and how to take more control over what entity framework is doing.
Great video man! Thinking of making an app into an asp.net MVC style and I was worried that authentication would be a nightmare. Thanks for making it more simple!!
Yeah I tried taking the ApiHelper/Token idea that you did an MVVM app with, took a while but was able to login. Then I decided that Owin was the next thing to learn, but I couldn't figure out why it didn't work out of the box. It turned out, that when I moved it from local to a named instance locally that I had the wrong connection string. So if you run into that issue, check that. I love your work Tim. Really helpful to shake off some of that rust.
Thanks Tim. I know everyone has different opinions and you’ll base your future videos on the majority , but I think the level of repetition is spot on and the content presented in a very clear manner. I am one of those people making my way up to mvc core, so this has been very helpful. You mentioned that you weren’t a big fan of entity, I’d appreciate a video on your take on this and what you do use.
Hi Tim. Thanks for great video. I wish I'd seen this a long time ago. I've read numerous tutorials but you've made a seemingly complicated subject a lot easier to understand, this video was perfect for me as a starting point for further study into the subject. Thanks again. :)
Brilliant! Thank you so much, Corey. Amazing as always. It would be really nice to see more about Access Control using MVC and C#. Security is super important, but also one of the biggest error zones where developers (especially new developers) make mistakes, often costly ones. In these times where there are hackers, trolls and ghouls all over the place, educating people on security and how to make it easy, but good, is relevant. Thanks, Martin.
Sounds almost like we should have a new start to finish course that is more MVC-focused from the beginning so we can see how to implement this stuff in the real world. ;-)
Gone are the days where one could download a shareware copy of Hotdog HTML editor and publish a site with having just a few files. (Which IMO, is a good thing. I feel the internet became convoluted with junk because people could just keep adding trash to the pile not having any technical skill or understanding what's going on under the hood.) Great video!
Hi Tim. Thank you very much for the videos that you provide - I've already watched a bunch of them, and found that they help me a lot. Just recently I read the book "Patterns of enterprise application architecture" by Martin Fowler, and figured that you haven't covered much of those patterns as is - other than of cause, general architectural principles that developers should adhere to, i.e. SOLID and DRY. When I read the book, a bunch of these patterns were sort of abstract. I understood the general ideas, but personally it would be extremely helpful to see a seasoned .net developer like you, show them in practical setting, and give your personal opinion on the most common ones. Additionally, now when we talk about patterns... When I see this video, i cant help thinking, how to implement this "out of the box" user authentication system in a common 3-layer application, where we don't use a local database but rather one on a server. How would you implement it in your business logic? would you even do that?
I will be covering more patterns and practices, although a lot of them are much more specialized. As for using this authentication on a remote server, you would just point your connection string to that remote database. I'm not a fan of how tied it is to the UI but that's a personal preference.
"leaving authentication to Microsoft" can also mean leaving it to your local active directory, not only to Microsoft online services such as azure. However, you may still build your own AUTHORISATION system if you don't want to create AD Groups for everything. Tim, as always, correct me if you shouldn't build that on your own either :)
Thank you for the video! I didn't know they made Authorization/Identity stuff so easy! If possible, I'd love to see an expansion where you talk about requiring authorization for Web API. Show how someone that wants to use my API for their own applications can authorize themselves for access.
Hi Tim, thanks for the wonderful tutorial! I am new to authorization and bit confused as to use third party tools like Auth0, IdentityServer5 , okta vs the Identity Framework provided by Microsoft. Is the Microsoft Identity really that unsecure as people on the internet say? All the third party auth tools are black box and have not so good documentation, where as identity is easy to setup.
Hi Tim. New to authentication and I followed the tutorial, however I still get the "The remote certificate is invalid according to the validation procedure" error.
Hey Tim... I can't thank you enough for this awesome stuff.. I'm using some of them in my teachings at university :D Will you be doing anything soon on Xamarin??
I'm loving this ASP.NET series. Thank you. Request: If you decide to make a lesson about EF, can you do a database first approach? Using Stored Procedures in EF would be nice also. Again Thank you.
I doubt I'll be doing an EF video any time soon since I'm really not a fan of EF (check out my video on connecting C# to SQL) but I'll keep it in mind.
Is there a simple way to specify to the template or just transform it into a non-MS-SQL-Server server database like MySQL or Amazon AWS Dynamo/María all the databases (at least get the instructions to build them) if not I need manually to change the provider, and create all the databases, this is cumbersome and may fail easily...
Please can you provide a short video in regarding of adding authentication and authorization to an application created previously. when I do so, it doesn't work. thanks
Hi Tim - i noticed the scaffolding code produces a lot of excess code which a develop may not use. Is there a way of modifying this, like deleting excess code, changing table names, adding extra columns etc to make it more specific to a business case?
Thank you for good video and for redirecting me here. Once again I have found less information than I expected but presented in great way. You showed here how to use this generated things but I am a bit afraid of using something I don't understand. Menage controller has almost 400 rows, there are also some models that you didn't even open here. I understand that in this video with your speed it wouldn't be too good to speak about it because it would be too long, but I would really be glad if you could make 2nd part of this with more details. The most important thing for me right now is how to work with outside database. I'm not sure how to link my database in Web.config. I have found how to add my outside database to SQL Server Object Explorer and how to find its Connection string but even for the default database connection string here is different than the one used in Web.config and only first part (Data Source) is the same. I'm interested in this topic and will wait for more about it. Also I will subscribe you to not miss it.
I have two videos that might help you. First, I have a Connection Strings video that gives you a good overview of how to set up a connection string and where to find what yours is. Second, I have a video on Connecting C# to SQL. That will show you how to configure your web.config/app.config file so that you can connect to an external database. As for showing more details about the authentication side, I will be doing that in future videos, although I'm not sure I'll ever go line by line. Some of this is EF Code First and I really don't want to get into that whole issue. As far as setting up your own database to do the authentication, if you point your connection string to the right database, the first time the app runs it will set up the proper tables. I would recommend that you not mix databases though. Keep a separate database for your authentication vs. your other data. It is much easier to secure that way. You can still have them on the same server though.
Nicely explained... Please make a video on other functionalities of identity, e.g email verification before login, reset password, forgot password, Two-Factor Auth. Thanks a lot for providing such great contents.
Twitter authentication does not seem to work in this manner any more. Swapped in the solution from stackoverflow post that you showed. Plugged in my key/secret ... tried with both "get user email" checked and unchecked methods ... all of them seem to give a 403 error the moment I hit the "Twitter" button on the login page. Exception Details: System.Net.Http.HttpRequestException: Response status code does not indicate success: 403 (Forbidden). Looking through inspect Network tab shows that request goes to localhost:44395/Account/ExternalLogin and gets back a status of 500 (even though it gets back content showing 403 error). No request is ever sent to Twitter.
Great video. One thing to add - if you stack the Authorize declarations on a function/controller you can require the user to have all of the roles specified (AND), rather than just one OR more of them. There's an example here: docs.microsoft.com/en-us/aspnet/core/security/authorization/roles
Thank you Tim: A couple of questions. Is it possible to capture additional user data in the EF authentication process such as first name, last name, employee ID number, etc? (Would it be easy / possible to modify parts of the system to hold additional data for example such as the items mentioned above? If I understand this correctly, we are fine to develop this using the local SQL server and then when it is ready to be deployed, one can just say change the connection string to point to a SQL Azure database (for example) and the local database will be recreated in the cloud? Finally, if you want to manage the creation of the user accounts and not let people just come to the site and Register, could you create part of your app that would allow an admin user to create new accounts? (i.e. I get the feeling that you strongly recommend using this authentication system as opposed to building your own and storing the username and password data in a database. Thank you so much for your time and all of the videos that you do, they are wonderful!
The password hashing part at 27:57 - It doesn't appear as if the passwords are being salted prior to hash, do you reckon this would be easy enough to implement? For instance, adding in a "salt" column in the Users table and when a user registers, a cryptographically secure RNG value is created for that user which is then stored within the new column. The trick would be finding where, in the C# backend code, the passwords are being hashed.
You could do that. My big thing is that when I start messing with authentication code, I have the potential to make it worse. This has been tested by Microsoft and a LOT of other companies. My custom changes have not. I get concerned when we start talking about overriding parts, since that means I really need to know the system intimately in order to ensure I do it right.
@@IAmTimCorey Ah that's a really good point, if I were to implement a salting system, I'd need to conduct some really thorough testing to make sure I wasn't making the system insecure. I'm just really worried about rainbow table attacks against an application I'm developing. Many thanks for the reply!
Hello Tim Corey, I would like to suggest for you to create a complete website or system using asp.net mvc just like the retail manager. That would really help us,me specially to learn a lot from you.. thank you very much
I understand adding authentication while creating a new project. But how do we add authentication to an existing ASP.NET MVC 5 project? I can't find any resource for it.
Excellent video Tim, but I have query, all this stuff is inbuilt projects code provided by Microsoft. What if I want to use my own tables like Users, Roles etc. What kind of changes need to be done? e.g. In a code you have shown Authorize(Role=Admin) what if I want to use my own roles from my own role table? Do I have to create my own Authorize attribute for the same?
*** FIXED READ BELOW *** I did everything described in this video in regards to Twitter. I keep getting 403. Response status code does not indicate success: 403 (Forbidden). Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.Net.Http.HttpRequestException: Response status code does not indicate success: 403 (Forbidden). However, with the new signup procedure for a Twitter Developer account, I had to assign a URL for my website and an organization URL. I don't think this is the issue, but worth noting. I used the URL to my twitter profile for these values. I tried adding more callback urls 127.0.0.1 localhost:44306/Account localhost:44306/Account/ExternalLogin localhost:44306 That didn't seem to work either. Am I missing something? Is there an extra step in 2020 that I am missing? ***FIXED*** append "/signin-twitter" to your callback URL. In my case localhost:44306/signin-twitter. Now it works. Whew. ************
Hi tim! Thanks for the video. I followed this tutorial on a .net framework project, as i upgraded it to .net core 3.0, everything works fine, but i couldn't upgrade this to the project. Mycrosoft suggests this : services.AddAuthentication().AddTwitter(twitterOptions => { twitterOptions.ConsumerKey = "..."; twitterOptions.ConsumerSecret = "=..."; }); Doesn't seem to work for me. Do you have any ideas why? -> Error suggest -> "AuthenticationBuilder does not contain a definition for AddTwitter ... "
Hey Tim, I saw couple of your videos and you doing awesome job. How ever, I'm just curious you said in this video you are not a big fan of entity framework. So what you suggest in alternate?
I suggest Dapper. Much easier to use, much simpler, and it does not interfere with good database design. You can see more about it in my video here: ruclips.net/video/Et2khGnrIqc/видео.html
Hi @IAmTimCorey, I notice that once we get into twitter signup page, it asks us to have/create a developer account? Did you have to do that too or is this a new step that Twitter has just created since your video was published early this year. Thanks.
Great series of videos. One thing I like to do is put my Authorize attributes in a base controller and inherit from it so that I am not having to put Authorize everywhere, and I don't run the risk of forgetting to put Authorize on some controllers. Some might argue that I could also forget to inherit from the base controller, but in my case, the base controller does a few other things that are essential to my app, so I wouldn't get very far without inheriting from the base controller.
Good tip. Then, if you need to have something not protected, you add the AllowAnonymous tag instead. Essentially, your application is secure by default. I like it. Thanks for sharing.
They can, although I recommend using separate databases. You can see an example of this in the TimCo Retail Manager application here on this channel. If you use one connection string, you need to take care not to create a conflict with the EF updates. Plus, you are mixing your data types. I prefer to keep my security data away from my "regular" data. It makes for easier security.
Hi Tim,Thanks for this video,however i am just curious to know how [Authorize] works behind the scene.How it gets to know the user details and token and authorize the user.. It would really be helpful if you could provide me any pointers .
This is very helpful. Can you please create a video for allowing users to register using localdb but requires admin approval before they can start logging in? Thanks!
Hello, I get "Response status code does not indicate success: 401 (Authorization Required)." when I click on the Twitter login button. Both sites in the apps.twitter.com app are real websites. What could be the problem? Also, do you have a tutorial on enabling email verification by using the built-in things that MVC makes for us. I know there are Email & SMS verifications but not sure how to use them after a person has registered.
This thread might help (there are a lot of possible reasons for a 401): twittercommunity.com/t/error-401-unauthorized/367 As for configuring email and SMS verification, not yet I don't.
Trying to follow this with the new project template in Visual Studio 2019 and the Register and Login pages blow up with a Null Ref Exception on the model straight outta the box!
I copied the demo and dug around inside but could not find the actual SQL used for querying the database. Is this all hidden inside the entity framework stuff?
Hello Tim, thanks for the video! Could you please advise how can I configure the default user role to be assigned for new users automatically after registration?
Is there any video or article explaining every step of the logging process such as register, change password , log out for identity authentication in MVC 5?
Sorry for the multiple questions, but I have some gaps I can't fill. I've always built my sql tables on a server first, then coded my application, so I am apprehensive about building on localdb...every tutorial regarding identity I have come across starts with tables on localdb and assumes we magically know how to move it to production at some future point. My process before (I have never implemented authentication) has always been to first get database on a real server, build tables there, go back to my app , set up helpers, a dataaccess class and connection string, build model, build controller, build views...in that order. If I miss something I go back to sql build the table, then go back to the app, rinse and repeat. Now, I am thinking of starting a new db on azure and want to implement identity. If I were to follow this method of implementing identity locally first, what do I need to do to get the all my tables (including the other ones I add to the db) in the server instead of localdb, assuming I coded the whole thing locally first instead as in the demo. Is it possible to change the connection string before installing the owin nuget package and running the package in order to sidestep all that so I can continue working the way I have before (ie the table structure for identity stuff would just be created in the production server instead of localdb)? Or is there some easy button for moving that all into a production server after you have coded your entire project locally?
It does! Thanks much! I also appreciate the clear and distinct instructions your videos usually include. I do a lot of research and find your videos the easiest to understand, the most comprehensive, and have lead to a lot more ah-ha moments for me. I think I would still be scratching my head on a lot of ideas if it weren't for your channel.
How do you go about restricting the data seen on a page based on the logged in user? Example, user1 should see items a, b, c on the page and user2 should see items d, e, f
Do you mean change it to a different version of Bootstrap? The navbar is just HTML so you can change it however you want. Changing Bootstrap versions is also possible, although there is more to change since all of the pages are laid out using Bootstrap 3.
Hi Tim, is there an easy way to add this local auth to an existing project? I've got a pretty built out application but I didn't turn the authentication on in the beginning. Much appreciated!
It's really good explanation, I like when you showed the Role based authentication as well. Do you have a complex tutorial how I can implement with all Identity Register and Login , Forgot and Reset password and =>/ Facebook, Gmail etc / to an existing website with publishing too!?
Hi Tim, I created a fresh ASP.Net MVC - Individual User Account project (not CORE) as showed in the video. Included all the required OWIN, identity, Identity.EntityFramework NuGet references and ran the app on chrome. When I tried to register the new user, it is throwing me this error related to the default connection. Note: I did not connect my local DB to the project. I just created the project and ran it on the browser. Please help me what did I miss here? Error: SqlException (0x80131904): A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: SQL Network Interfaces, error: 56 - Unable to load the SQLUserInstance.dll from the location specified in the registry. Verify that the Local Database Runtime feature of SQL Server Express is properly installed.)
Your connection string does not point to a valid SQL Server location. If you are trying to create a local database, you will need to have SQL Express installed on the machine.
Tim, would it be possible to use Dapper to connect to SQL Azure in this scenario? I assume it would be possible, just wondering if it would be a good way to go. Any Dapper related videos planned?
Yes, Dapper can connect to SQL Azure. You just need to change the connection string. Everything else is the same compared to on-premises SQL. As for more Dapper videos, yep, they are coming.
I think I've got a good handle on this locally. How do you change the Database connection for this so it adds these tables to a database on a hosting server?
You just change the web.config file's connection string, which you can do even at runtime. However, usually what you do is when you deploy it, you transform the deployed web.config file to have the correct connection string.
I have question please, I'm currently develop webapp for my university, students can login by university account, example@kau.edu.sa , it has same interface of gmail, ,what is correct authentication should i use?
That sounds like Windows authentication but if your university does not use Active Directory for authentication, you might need to change to a different authentication system. It may be that you use OAuth like I did in this video but with a custom provider (your internal authentication system).
@@IAmTimCoreyThanks for your attention Tim. I'd be so thankfull to you if you take your time to pick up on it. I have really had a hard times to understand how this middleware and its properties behave after each request.
Hi Tim, this is great. Would love to see an example of impersonation following on from this video. i.e. login as an admin (with admin roles) and then impersonate a user already registered in the system to see their data. Or indeed any pointers on which classes etc. to read around to do this.
Ugh I spent 2 hours searching and replacing my callback Url but I just can't get it right. I keep getting the 403 Error. ***EDIT: fixed it by adding: localhost:44388/signin-twitter Amazing content as always Tim, Thank you!
Hi Tim, This is a really great video! Thanks for that. Quick question, I've followed your steps, using local authentication only. If I run my VS project, register and/or login, stop the VS project and then run it again, then I am still logged in. I need to run some code just after successfull authentication. Clearly this shouldn't be done in public async Task Login(LoginViewModel model, string returnUrl) since this only runs when the user clicks on the Login button. Where should post authentication code be run ? Thanks again for your work, helps tremendously!
Good question. You might find success running it on the homepage, since the user will hit that first (check if they are authenticated). The only problem is if the user is not logged in and attempts to go to a secured page. When they log in, it will direct them to the page they attempted to go to instead of the homepage. So if you can do it in two places, the homepage and the login would be the two places to do it.
Not sure what you mean. I use Dapper with SQL, I use MongoDB, I use CosmosDB, I use Redis - basically, I use whatever database solution is best for the situation.
hello Tim , What If The User disabled cookies , how can i authenticate them then ? did that means user with disabled cookies cant't use the application ?! , thanks in advance
If you are storing the auth token in a cookie and the user turns off all cookies, you would have an issue but typically the user disables tracking cookies, which are different. Also, you don't need to store in cookies. You can use session variables.
Tim, can you use a DB you set up for the rest of the application by changing the connection string for the authentication system? Will it add the tables automatically?
You could mix the two databases, but I prefer not to for a couple of reasons. First, you don't want to fight with EF for database structure design. You would need to stay away from certain tables that EF controls while modifying others manually. That is messy. Also, I don't like mixing my authentication system data with my "regular" data for security reasons.
Twitter has changed things around since this video. It looks like they really want a public URL. You can use localtest.me as the solution for non-production apps: readme.localtest.me/ There are also some other suggestions in the comments as well.
On the Twitter set up - on the Website URL all i get is 'Invalid website url' I have tried 127.0.0.1/ and 127.0.0.1:8080/ and 127.0.0.1:53243/ but not getting any nearer - any ideas
You could try https. If that does not work, try a URL shortener (like bit.ly) to shorten your url (with the port number) and use the resulting bit.ly link.
Hi Tim, awesome video as usual. I've learned a huge deal from you in my steps to become a software dev already working on my own project now. In this one however i have a problem and i cant get the twitter login to work no matter what.I have added the code and even found some other Digicert keys as in some forums they were saying the one in this video have expired, but still i cant get it to work getting always the same error with the secure connection. Any ideas? Have they changed anything, is there a place to find the current keys?
Hey Tim, you made a comment about using an API so you can easily add/change new frontends. I'm currently building a Blazor-server app and was just wondering if it's possible to have an API running along side it? I know the Blazor server app wouldnt need to use it, but if I wanted to add an app or something in the future. How would you approch this? Thanks
Interesting I find the Role-Management. I have to do some research, if you always need to specify the Roles by a String "User, Admin". It would be much easier, if it could be done with the UserID, because then you can easier group them, like saying Access to RoleID > 2... But I guess that is also possible somehow. Anyway, thanks for the very clear tutorial.
You can assign permissions to a user, not just to a role, but that is too specific and hard-coded to be very useful. You can't apply conditional logic to the role decorators (without dropping the check into the code), so >2 wouldn't really work well.
Because of your 'Connecting to SQL video' I am a Dapper convert and never want to touch EF. Is this the only instance on which you would have EF installed into your app? Are there no other MVC type authentications which don't involve EF?
Hi Tim! Love your tuts. Will you ever do something about Auth, without Microsoft Identity Framework? I would love to build my auth without any pre-scaffolded code. Thanks!
Hi, Tim. I created a blazor app with authentication and authorization. I wanted to know if there was a way to customize the login page, ie the equivalent to the IdentityConfig.cs
You would need to add a new Scaffolded Item (under the Add right-click menu when on the project in Solution Explorer). Add in Identity, then select the pages you want to override. Fill in the other options and you should be set.
Not sure I'm following. You can use any database for your authentication DB. Just change the connection string to point to a remote database and you are all set.
Yes it is. With authorization, typically you get a token that you then put in the header of all future calls to indicate who you are. You would just store that token and send it on any API call you make from your WPF application (or JavaScript application or Console app, etc.) I'll be doing a video on that in the future.
Excellent video and very timely for me. I do have a question. You mention that the local database is not the preferred storage for account data. What is involved in moving to a MySQL database for the account storage information rather than the local SQL database?
It would be easier to just move your SQL database to a "full" SQL Server (or Azure SQL) but here are instructions on using MySQL: docs.microsoft.com/en-us/aspnet/identity/overview/getting-started/aspnet-identity-using-mysql-storage-with-an-entityframework-mysql-provider
I am finally in AUTH stage now! I have planned my databases clearly, using my personal NF rules.
1. Can be many to one? New Table
2. Only one to one? Same Table
I am about to do start getting freaky freaky hands on when I realize that, hey, I need auth. And Now I'm here.
With just 3 videos, ASP.NET MVC, Data Access and OAUTH, I feel like a professional now. I must say ASP.NET Core MVC is much more clearer and simpler now that I understand that models in ASP.NET MVC is just for views. Sorry for long text, you are the best.
I'm glad it is sinking in for you.
God loves me so much that I have found your channel :)
I'm glad you enjoy it.
0:00 - Intro
1:41 - ASP .NET Framework demo app with authentication
13:01 - Register vs Login explained
15:25 - Built in user registration and login
18:28 - Registration C# code overview
23:45 - Built in SQL
29:45 - Twitter authentication setup
45:37 - Implementing user restrictions
52:48 - Restrictions based on user role
1:01:03 - Who is logged in?
1:02:20 - Summary and concluding remarks
Thank you!
Tim is King!!!. you make everything easy. I normally dread long videos but this one seemed like it was 5min the way I was enjoying it.
Glad you enjoyed it
@@IAmTimCorey I have been looking for a tutorial like this . Can you help me with a tutorial that explains how to set redirect pages for different users when using default login in MVC with entity. Hopefully one that can also explain how to hide certain tabs in the nav bar based on user roles. Thank you in advance.
Best tutorial on OAuth. Clean and to the point explanation. Thank you TIM !!
Glad it was helpful!
For those confused: The local authentication is also (still) called "Forms Authentication", although it's not about Webforms anymore. It's somewhat different though than the Webforms thing.
I don’t think it was ever about WinForms. It may have been a reference to WebForms, but I don’t think so. I think it is just about needing a login form.
@@IAmTimCorey Sorry, I corrected it to "Webforms". I always confound these terms.
Great video! It would be really handy to see a follow-up to this detailing how Authorize works behind the scenes and how to take more control over what entity framework is doing.
I noted your recommendation by adding it to Tim's list of possible future topics, thanks.
Great video man! Thinking of making an app into an asp.net MVC style and I was worried that authentication would be a nightmare. Thanks for making it more simple!!
Great!
Yeah I tried taking the ApiHelper/Token idea that you did an MVVM app with, took a while but was able to login. Then I decided that Owin was the next thing to learn, but I couldn't figure out why it didn't work out of the box. It turned out, that when I moved it from local to a named instance locally that I had the wrong connection string. So if you run into that issue, check that. I love your work Tim. Really helpful to shake off some of that rust.
Glad its helpful, and thanks for sharing.
Thanks Tim. I know everyone has different opinions and you’ll base your future videos on the majority , but I think the level of repetition is spot on and the content presented in a very clear manner.
I am one of those people making my way up to mvc core, so this has been very helpful.
You mentioned that you weren’t a big fan of entity, I’d appreciate a video on your take on this and what you do use.
I wrote a blog post that addresses your question about EF: www.iamtimcorey.com/blog/137806/entity-framework
Hi Tim. Thanks for great video. I wish I'd seen this a long time ago. I've read numerous tutorials but you've made a seemingly complicated subject a lot easier to understand, this video was perfect for me as a starting point for further study into the subject. Thanks again. :)
Awesome! I’m glad it was helpful.
Brilliant! Thank you so much, Corey. Amazing as always. It would be really nice to see more about Access Control using MVC and C#. Security is super important, but also one of the biggest error zones where developers (especially new developers) make mistakes, often costly ones. In these times where there are hackers, trolls and ghouls all over the place, educating people on security and how to make it easy, but good, is relevant.
Thanks,
Martin.
Sounds almost like we should have a new start to finish course that is more MVC-focused from the beginning so we can see how to implement this stuff in the real world. ;-)
Thanks Tim, Finally found someone that can explain how this works.
Excellent!
Gone are the days where one could download a shareware copy of Hotdog HTML editor and publish a site with having just a few files. (Which IMO, is a good thing. I feel the internet became convoluted with junk because people could just keep adding trash to the pile not having any technical skill or understanding what's going on under the hood.)
Great video!
Thank you!
I will explain you how it works > 19:00 by large you can leave this as it is and just works
Wow, awesome explanation
Hi Tim. Thank you very much for the videos that you provide - I've already watched a bunch of them, and found that they help me a lot.
Just recently I read the book "Patterns of enterprise application architecture" by Martin Fowler, and figured that you haven't covered much of those patterns as is - other than of cause, general architectural principles that developers should adhere to, i.e. SOLID and DRY.
When I read the book, a bunch of these patterns were sort of abstract. I understood the general ideas, but personally it would be extremely helpful to see a seasoned .net developer like you, show them in practical setting, and give your personal opinion on the most common ones.
Additionally, now when we talk about patterns... When I see this video, i cant help thinking, how to implement this "out of the box" user authentication system in a common 3-layer application, where we don't use a local database but rather one on a server. How would you implement it in your business logic? would you even do that?
I will be covering more patterns and practices, although a lot of them are much more specialized. As for using this authentication on a remote server, you would just point your connection string to that remote database. I'm not a fan of how tied it is to the UI but that's a personal preference.
"leaving authentication to Microsoft" can also mean leaving it to your local active directory, not only to Microsoft online services such as azure. However, you may still build your own AUTHORISATION system if you don't want to create AD Groups for everything. Tim, as always, correct me if you shouldn't build that on your own either :)
Thanks and you really made it so simple. One word for this. Amazing!
Awesome!
Thank you for the video! I didn't know they made Authorization/Identity stuff so easy!
If possible, I'd love to see an expansion where you talk about requiring authorization for Web API. Show how someone that wants to use my API for their own applications can authorize themselves for access.
I will be doing authorization through WebAPI in a video in the near future.
Thanks for making these tutorials! Fantastic content
You are welcome.
Hi Tim, thanks for the wonderful tutorial! I am new to authorization and bit confused as to use third party tools like Auth0, IdentityServer5 , okta vs the Identity Framework provided by Microsoft. Is the Microsoft Identity really that unsecure as people on the internet say? All the third party auth tools are black box and have not so good documentation, where as identity is easy to setup.
Hi Tim. New to authentication and I followed the tutorial, however I still get the "The remote certificate is invalid according to the validation procedure" error.
It sounds like you have a problem with your developer certificate. Try this answer: stackoverflow.com/a/58957501/733798
Extremely well explained. Very top level as Indian Eng. haha who save my butt more than once.
Thanks!
Hey Tim... I can't thank you enough for this awesome stuff.. I'm using some of them in my teachings at university :D
Will you be doing anything soon on Xamarin??
Yes, I am ramping up my development work in Xamarin so I will be ready to teach it soon.
I'm loving this ASP.NET series. Thank you. Request: If you decide to make a lesson about EF, can you do a database first approach? Using Stored Procedures in EF would be nice also. Again Thank you.
I doubt I'll be doing an EF video any time soon since I'm really not a fan of EF (check out my video on connecting C# to SQL) but I'll keep it in mind.
Thank you. I like your videos. Keep posting please
Will do.
Is there a simple way to specify to the template or just transform it into a non-MS-SQL-Server server database like MySQL or Amazon AWS Dynamo/María all the databases (at least get the instructions to build them) if not I need manually to change the provider, and create all the databases, this is cumbersome and may fail easily...
Please can you provide a short video in regarding of adding authentication and authorization to an application created previously. when I do so, it doesn't work. thanks
Thanks for the suggestion. Please add it to the list on the suggestion site so others can vote on it as well: suggestions.iamtimcorey.com/
Hi Tim - i noticed the scaffolding code produces a lot of excess code which a develop may not use. Is there a way of modifying this, like deleting excess code, changing table names, adding extra columns etc to make it more specific to a business case?
I don’t believe so. You can tweak some of it, but most is necessary.
How do we can edit user profile using this system?
Thank you for good video and for redirecting me here. Once again I have found less information than I expected but presented in great way. You showed here how to use this generated things but I am a bit afraid of using something I don't understand. Menage controller has almost 400 rows, there are also some models that you didn't even open here. I understand that in this video with your speed it wouldn't be too good to speak about it because it would be too long, but I would really be glad if you could make 2nd part of this with more details.
The most important thing for me right now is how to work with outside database. I'm not sure how to link my database in Web.config. I have found how to add my outside database to SQL Server Object Explorer and how to find its Connection string but even for the default database connection string here is different than the one used in Web.config and only first part (Data Source) is the same.
I'm interested in this topic and will wait for more about it. Also I will subscribe you to not miss it.
I have two videos that might help you. First, I have a Connection Strings video that gives you a good overview of how to set up a connection string and where to find what yours is. Second, I have a video on Connecting C# to SQL. That will show you how to configure your web.config/app.config file so that you can connect to an external database.
As for showing more details about the authentication side, I will be doing that in future videos, although I'm not sure I'll ever go line by line. Some of this is EF Code First and I really don't want to get into that whole issue. As far as setting up your own database to do the authentication, if you point your connection string to the right database, the first time the app runs it will set up the proper tables. I would recommend that you not mix databases though. Keep a separate database for your authentication vs. your other data. It is much easier to secure that way. You can still have them on the same server though.
Nicely explained... Please make a video on other functionalities of identity, e.g email verification before login, reset password, forgot password, Two-Factor Auth.
Thanks a lot for providing such great contents.
It is on the list. Thanks for the suggestions.
Twitter authentication does not seem to work in this manner any more. Swapped in the solution from stackoverflow post that you showed. Plugged in my key/secret ... tried with both "get user email" checked and unchecked methods ... all of them seem to give a 403 error the moment I hit the "Twitter" button on the login page.
Exception Details: System.Net.Http.HttpRequestException: Response status code does not indicate success: 403 (Forbidden).
Looking through inspect Network tab shows that request goes to localhost:44395/Account/ExternalLogin and gets back a status of 500 (even though it gets back content showing 403 error). No request is ever sent to Twitter.
Yeah, Twitter has changed some things. There are some suggestions in the comments section about things to try that might help you out.
Great video. One thing to add - if you stack the Authorize declarations on a function/controller you can require the user to have all of the roles specified (AND), rather than just one OR more of them. There's an example here: docs.microsoft.com/en-us/aspnet/core/security/authorization/roles
Good tip. Thanks!
Thank you Tim: A couple of questions. Is it possible to capture additional user data in the EF authentication process such as first name, last name, employee ID number, etc? (Would it be easy / possible to modify parts of the system to hold additional data for example such as the items mentioned above?
If I understand this correctly, we are fine to develop this using the local SQL server and then when it is ready to be deployed, one can just say change the connection string to point to a SQL Azure database (for example) and the local database will be recreated in the cloud?
Finally, if you want to manage the creation of the user accounts and not let people just come to the site and Register, could you create part of your app that would allow an admin user to create new accounts? (i.e. I get the feeling that you strongly recommend using this authentication system as opposed to building your own and storing the username and password data in a database.
Thank you so much for your time and all of the videos that you do, they are wonderful!
Did you manually create the database tables for the user accounts (AspNetRoles, AspNetUsers, etc.) ?
Great video. Can expand it include user and role management via a webpage.
I'll be covering this in future videos. Thanks for the suggestion.
I'd like to see that too!
The password hashing part at 27:57 - It doesn't appear as if the passwords are being salted prior to hash, do you reckon this would be easy enough to implement?
For instance, adding in a "salt" column in the Users table and when a user registers, a cryptographically secure RNG value is created for that user which is then stored within the new column. The trick would be finding where, in the C# backend code, the passwords are being hashed.
You could do that. My big thing is that when I start messing with authentication code, I have the potential to make it worse. This has been tested by Microsoft and a LOT of other companies. My custom changes have not. I get concerned when we start talking about overriding parts, since that means I really need to know the system intimately in order to ensure I do it right.
@@IAmTimCorey
Ah that's a really good point, if I were to implement a salting system, I'd need to conduct some really thorough testing to make sure I wasn't making the system insecure. I'm just really worried about rainbow table attacks against an application I'm developing.
Many thanks for the reply!
Thank you Tim, excellent tutorial.
You are welcome.
Hello Tim Corey, I would like to suggest for you to create a complete website or system using asp.net mvc just like the retail manager. That would really help us,me specially to learn a lot from you.. thank you very much
That suggestion is on the list. Thanks!
@@IAmTimCorey thank you Tim!
I understand adding authentication while creating a new project.
But how do we add authentication to an existing ASP.NET MVC 5 project?
I can't find any resource for it.
You have to manually do it. Create a new project with authentication and then copy the settings and files over.
Excellent video Tim, but I have query, all this stuff is inbuilt projects code provided by Microsoft. What if I want to use my own tables like Users, Roles etc. What kind of changes need to be done? e.g. In a code you have shown Authorize(Role=Admin) what if I want to use my own roles from my own role table? Do I have to create my own Authorize attribute for the same?
Hey Tim! Twitter doesn't allow to use localhost anymore to create an App, how do we solve this?
Twitter doesn't allow 127/0.0.1 either ... what to do?
I believe it is because you need https but check the documentation.
I'm trying to find a tutorial for doing oauth with yahoo! sports and I cannot find any useful resources... does anyone know where I should look?
Hi Tim , thanks very much for a useful video
You are welcome.
All what i can say is, this is a great tutorials and thank you for It:)
I'm glad. Thanks!
Thank you so much!! You explained it amazing
You are welcome.
*** FIXED READ BELOW ***
I did everything described in this video in regards to Twitter.
I keep getting 403.
Response status code does not indicate success: 403 (Forbidden).
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Net.Http.HttpRequestException: Response status code does not indicate success: 403 (Forbidden).
However, with the new signup procedure for a Twitter Developer account, I had to assign a URL for my website and an organization URL. I don't think this is the issue, but worth noting. I used the URL to my twitter profile for these values.
I tried adding more callback urls
127.0.0.1
localhost:44306/Account
localhost:44306/Account/ExternalLogin
localhost:44306
That didn't seem to work either.
Am I missing something? Is there an extra step in 2020 that I am missing?
***FIXED***
append "/signin-twitter" to your callback URL.
In my case localhost:44306/signin-twitter. Now it works. Whew.
************
Glad you figured it out.
Hi tim! Thanks for the video.
I followed this tutorial on a .net framework project, as i upgraded it to .net core 3.0, everything works fine, but i couldn't upgrade this to the project.
Mycrosoft suggests this :
services.AddAuthentication().AddTwitter(twitterOptions =>
{
twitterOptions.ConsumerKey = "...";
twitterOptions.ConsumerSecret = "=...";
});
Doesn't seem to work for me. Do you have any ideas why? -> Error suggest -> "AuthenticationBuilder does not contain a definition for AddTwitter ... "
It sounds like you need a NuGet package to support Twitter authentication.
Learned alot from this thanks !
Excellent!
RequireNonLetterOrDigit means Require Non(letter or Digit) or require something other than an alphanumeric character (So, a special character).
Yep, you are right. Drew a blank when looking at it.
Hey Tim, I saw couple of your videos and you doing awesome job.
How ever, I'm just curious you said in this video you are not a big fan of entity framework. So what you suggest in alternate?
I suggest Dapper. Much easier to use, much simpler, and it does not interfere with good database design. You can see more about it in my video here: ruclips.net/video/Et2khGnrIqc/видео.html
I agree with Tim now, I used EF a while ago and hated it, I find Dapper much easier now (after I saw it on one of Tims Videos) - Thanks Tim.
Hi @IAmTimCorey, I notice that once we get into twitter signup page, it asks us to have/create a developer account? Did you have to do that too or is this a new step that Twitter has just created since your video was published early this year. Thanks.
Not sure but if Twitter says you have to do it, go for it. It is probably just a conversion of your existing account to allow for more features.
Thank you so much. Comprehensive content. Liked, subbed and belled.
Excellent! I'm glad you enjoy the content.
Great series of videos. One thing I like to do is put my Authorize attributes in a base controller and inherit from it so that I am not having to put Authorize everywhere, and I don't run the risk of forgetting to put Authorize on some controllers. Some might argue that I could also forget to inherit from the base controller, but in my case, the base controller does a few other things that are essential to my app, so I wouldn't get very far without inheriting from the base controller.
Good tip. Then, if you need to have something not protected, you add the AllowAnonymous tag instead. Essentially, your application is secure by default. I like it. Thanks for sharing.
anybody know example how dapper and identity can live together? because identity use entity framework, do i need to have different connection strings?
They can, although I recommend using separate databases. You can see an example of this in the TimCo Retail Manager application here on this channel. If you use one connection string, you need to take care not to create a conflict with the EF updates. Plus, you are mixing your data types. I prefer to keep my security data away from my "regular" data. It makes for easier security.
@@IAmTimCorey thanks man was very helpful
Hi Tim,Thanks for this video,however i am just curious to know how [Authorize] works behind the scene.How it gets to know the user details and token and authorize the user..
It would really be helpful if you could provide me any pointers .
It uses the header token and converts that over to identify the user. From there, it figures out if you have access privileges or not.
@@IAmTimCorey Have you covered this in any videos? Would be very useful to get more insight into how asp.identity works!
This is very helpful. Can you please create a video for allowing users to register using localdb but requires admin approval before they can start logging in? Thanks!
I will add it to the list. Thanks for the suggestion.
@@IAmTimCorey You're the best!
Hello, I get "Response status code does not indicate success: 401 (Authorization Required)." when I click on the Twitter login button. Both sites in the apps.twitter.com app are real websites. What could be the problem? Also, do you have a tutorial on enabling email verification by using the built-in things that MVC makes for us. I know there are Email & SMS verifications but not sure how to use them after a person has registered.
This thread might help (there are a lot of possible reasons for a 401): twittercommunity.com/t/error-401-unauthorized/367
As for configuring email and SMS verification, not yet I don't.
God bless you tim! we love you
Thank you!
Trying to follow this with the new project template in Visual Studio 2019 and the Register and Login pages blow up with a Null Ref Exception on the model straight outta the box!
I copied the demo and dug around inside but could not find the actual SQL used for querying the database. Is this all hidden inside the entity framework stuff?
Entity Framework creates the authentication database, yes.
hi, Tim. Do you know how to change the type of ID in AspNetUsers table? I need it to be as int because of autoincrement
No, the system is based upon GUIDs. Why do you need it to be an int? GUIDs work just fine and don't need to be autoincremented.
Hello Tim, thanks for the video! Could you please advise how can I configure the default user role to be assigned for new users automatically after registration?
Is there any video or article explaining every step of the logging process such as register, change password , log out for identity authentication in MVC 5?
We use the Identity process for logging in and out (and registering) in the TimCo Retail Manager.
Thank u for great Tutorial
You are welcome.
Sorry for the multiple questions, but I have some gaps I can't fill. I've always built my sql tables on a server first, then coded my application, so I am apprehensive about building on localdb...every tutorial regarding identity I have come across starts with tables on localdb and assumes we magically know how to move it to production at some future point. My process before (I have never implemented authentication) has always been to first get database on a real server, build tables there, go back to my app , set up helpers, a dataaccess class and connection string, build model, build controller, build views...in that order. If I miss something I go back to sql build the table, then go back to the app, rinse and repeat. Now, I am thinking of starting a new db on azure and want to implement identity. If I were to follow this method of implementing identity locally first, what do I need to do to get the all my tables (including the other ones I add to the db) in the server instead of localdb, assuming I coded the whole thing locally first instead as in the demo. Is it possible to change the connection string before installing the owin nuget package and running the package in order to sidestep all that so I can continue working the way I have before (ie the table structure for identity stuff would just be created in the production server instead of localdb)? Or is there some easy button for moving that all into a production server after you have coded your entire project locally?
I decided to answer your question here: iamtimcorey.com/ask-tim-database-authentication-setup/
I hope that helps.
It does! Thanks much! I also appreciate the clear and distinct instructions your videos usually include. I do a lot of research and find your videos the easiest to understand, the most comprehensive, and have lead to a lot more ah-ha moments for me. I think I would still be scratching my head on a lot of ideas if it weren't for your channel.
Tims your works alwalys kills me .
Hopefully in a good way. :-)
basically my database is show in server explorer, is it any problem if i used that database?
Not for development, no. You might want to look at a full SQL database when you go to production though.
How do you go about restricting the data seen on a page based on the logged in user? Example, user1 should see items a, b, c on the page and user2 should see items d, e, f
You do that in the queries based upon the UserId of the logged in user. We will be doing that shortly in the TimCo Retail Manager Series.
Hey. Is there a way to change the navbar to the older version or any other alternatives than to downgrade?
Do you mean change it to a different version of Bootstrap? The navbar is just HTML so you can change it however you want. Changing Bootstrap versions is also possible, although there is more to change since all of the pages are laid out using Bootstrap 3.
Hi Tim, is there an easy way to add this local auth to an existing project? I've got a pretty built out application but I didn't turn the authentication on in the beginning. Much appreciated!
For .NET Framework? Not really. You create a blank project with authentication, then copy over the changes to your project.
It's really good explanation, I like when you showed the Role based authentication as well. Do you have a complex tutorial how I can implement with all Identity Register and Login , Forgot and Reset password and =>/ Facebook, Gmail etc / to an existing website with publishing too!?
I don’t. Sorry.
Hi Tim, I created a fresh ASP.Net MVC - Individual User Account project (not CORE) as showed in the video.
Included all the required OWIN, identity, Identity.EntityFramework NuGet references and ran the app on chrome. When I tried to register the new user, it is throwing me this error related to the default connection.
Note: I did not connect my local DB to the project. I just created the project and ran it on the browser. Please help me what did I miss here?
Error:
SqlException (0x80131904): A network-related or instance-specific error occurred while establishing a connection to SQL Server.
The server was not found or was not accessible.
Verify that the instance name is correct and that SQL Server is configured to allow remote connections.
(provider: SQL Network Interfaces, error: 56 - Unable to load the SQLUserInstance.dll from the location specified in the registry.
Verify that the Local Database Runtime feature of SQL Server Express is properly installed.)
Your connection string does not point to a valid SQL Server location. If you are trying to create a local database, you will need to have SQL Express installed on the machine.
Were you able to fix this? I had to make some registry setting changes in order to get the LocalDB to work and populate the object.
Tim, would it be possible to use Dapper to connect to SQL Azure in this scenario? I assume it would be possible, just wondering if it would be a good way to go. Any Dapper related videos planned?
Yes, Dapper can connect to SQL Azure. You just need to change the connection string. Everything else is the same compared to on-premises SQL. As for more Dapper videos, yep, they are coming.
I think I've got a good handle on this locally. How do you change the Database connection for this so it adds these tables to a database on a hosting server?
You just change the web.config file's connection string, which you can do even at runtime. However, usually what you do is when you deploy it, you transform the deployed web.config file to have the correct connection string.
@@IAmTimCorey I managed to get this working on my Go Daddy server; not sure why it wasn't working before. Thanks!
I have question please, I'm currently develop webapp for my university, students can login by university account, example@kau.edu.sa , it has same interface of gmail, ,what is correct authentication should i use?
That sounds like Windows authentication but if your university does not use Active Directory for authentication, you might need to change to a different authentication system. It may be that you use OAuth like I did in this video but with a custom provider (your internal authentication system).
I wish someone to explain Authentication middleware in detail. What is Authenticaion Type? How does it work regarding cookie based authentication ?
Sounds like a good in-depth video. I'll add it to the suggestion list.
@@IAmTimCoreyThanks for your attention Tim. I'd be so thankfull to you if you take your time to pick up on it. I have really had a hard times to understand how this middleware and its properties behave after each request.
Hi Tim, this is great. Would love to see an example of impersonation following on from this video. i.e. login as an admin (with admin roles) and then impersonate a user already registered in the system to see their data. Or indeed any pointers on which classes etc. to read around to do this.
Thanks for the suggestion.
Ugh I spent 2 hours searching and replacing my callback Url but I just can't get it right. I keep getting the 403 Error.
***EDIT: fixed it by adding: localhost:44388/signin-twitter
Amazing content as always Tim, Thank you!
I am glad you figured it out.
Hi there is there a way to remove authentication message in the page,? tnx a lot
Hi Tim,
This is a really great video! Thanks for that.
Quick question, I've followed your steps, using local authentication only. If I run my VS project, register and/or login, stop the VS project and then run it again, then I am still logged in. I need to run some code just after successfull authentication. Clearly this shouldn't be done in
public async Task Login(LoginViewModel model, string returnUrl)
since this only runs when the user clicks on the Login button. Where should post authentication code be run ?
Thanks again for your work, helps tremendously!
Good question. You might find success running it on the homepage, since the user will hit that first (check if they are authenticated). The only problem is if the user is not logged in and attempts to go to a secured page. When they log in, it will direct them to the page they attempted to go to instead of the homepage. So if you can do it in two places, the homepage and the login would be the two places to do it.
Thank you very much
Lovely❤️
You are welcome.
Good day sir, what alternative do you use for your database access? Thank you and more power to you.God bless
Not sure what you mean. I use Dapper with SQL, I use MongoDB, I use CosmosDB, I use Redis - basically, I use whatever database solution is best for the situation.
Thank You. Really Help me to learn
Glad to hear that
hello Tim , What If The User disabled cookies , how can i authenticate them then ? did that means user with disabled cookies cant't use the application ?! , thanks in advance
If you are storing the auth token in a cookie and the user turns off all cookies, you would have an issue but typically the user disables tracking cookies, which are different. Also, you don't need to store in cookies. You can use session variables.
Thanks , i love you Tim.
You are welcome.
Tim, can you use a DB you set up for the rest of the application by changing the connection string for the authentication system? Will it add the tables automatically?
You could mix the two databases, but I prefer not to for a couple of reasons. First, you don't want to fight with EF for database structure design. You would need to stay away from certain tables that EF controls while modifying others manually. That is messy. Also, I don't like mixing my authentication system data with my "regular" data for security reasons.
@@IAmTimCorey So if you leave it as -is, it will create the DB automatically when you deploy your site, correct?
Upon creating the twitter app
Website URL accepts neither localhost nor 127.0.0.1
Twitter has changed things around since this video. It looks like they really want a public URL. You can use localtest.me as the solution for non-production apps: readme.localtest.me/ There are also some other suggestions in the comments as well.
On the Twitter set up - on the Website URL all i get is 'Invalid website url'
I have tried 127.0.0.1/ and 127.0.0.1:8080/ and 127.0.0.1:53243/
but not getting any nearer - any ideas
You could try https. If that does not work, try a URL shortener (like bit.ly) to shorten your url (with the port number) and use the resulting bit.ly link.
its too long but very useful and informative tutorial ,yo did just simply grate works , i request you to give email verification tutorial ,
thanks
Thanks for the suggestion.
Hi Tim, awesome video as usual. I've learned a huge deal from you in my steps to become a software dev already working on my own project now. In this one however i have a problem and i cant get the twitter login to work no matter what.I have added the code and even found some other Digicert keys as in some forums they were saying the one in this video have expired, but still i cant get it to work getting always the same error with the secure connection. Any ideas? Have they changed anything, is there a place to find the current keys?
Hey Tim, you made a comment about using an API so you can easily add/change new frontends. I'm currently building a Blazor-server app and was just wondering if it's possible to have an API running along side it? I know the Blazor server app wouldnt need to use it, but if I wanted to add an app or something in the future. How would you approch this? Thanks
Yes, you can use an API to support Blazor. I'll probably show that in a future video.
@@IAmTimCorey Awesome, thanks for the reply!
Interesting I find the Role-Management. I have to do some research, if you always need to specify the Roles by a String "User, Admin". It would be much easier, if it could be done with the UserID, because then you can easier group them, like saying Access to RoleID > 2...
But I guess that is also possible somehow.
Anyway, thanks for the very clear tutorial.
You can assign permissions to a user, not just to a role, but that is too specific and hard-coded to be very useful. You can't apply conditional logic to the role decorators (without dropping the check into the code), so >2 wouldn't really work well.
Because of your 'Connecting to SQL video' I am a Dapper convert and never want to touch EF. Is this the only instance on which you would have EF installed into your app? Are there no other MVC type authentications which don't involve EF?
Pretty much this is the only place I use EF. As for authentication systems that don't use EF, not that I have found that aren't also very complicated.
@@IAmTimCorey Thanks Tim.
Hi Tim! Love your tuts. Will you ever do something about Auth, without Microsoft Identity Framework? I would love to build my auth without any pre-scaffolded code. Thanks!
It is on the suggestion list.
Hi, Tim. I created a blazor app with authentication and authorization. I wanted to know if there was a way to customize the login page, ie the equivalent to the IdentityConfig.cs
Also where is the cshtml page for the login located in blazor?
You would need to add a new Scaffolded Item (under the Add right-click menu when on the project in Solution Explorer). Add in Identity, then select the pages you want to override. Fill in the other options and you should be set.
How do you forward the user login information to an external SQL database?
Not sure I'm following. You can use any database for your authentication DB. Just change the connection string to point to a remote database and you are all set.
How would one use authorization in say, a wpf application? Is that possible?
Yes it is. With authorization, typically you get a token that you then put in the header of all future calls to indicate who you are. You would just store that token and send it on any API call you make from your WPF application (or JavaScript application or Console app, etc.) I'll be doing a video on that in the future.
Excellent video and very timely for me. I do have a question. You mention that the local database is not the preferred storage for account data. What is involved in moving to a MySQL database for the account storage information rather than the local SQL database?
It would be easier to just move your SQL database to a "full" SQL Server (or Azure SQL) but here are instructions on using MySQL: docs.microsoft.com/en-us/aspnet/identity/overview/getting-started/aspnet-identity-using-mysql-storage-with-an-entityframework-mysql-provider