Quote of the Day

more Quotes

Categories

Buy me a coffee

All posts in ".NET core"

About integrated windows authentication and how to implement it in ASP.NET core running on IIS.

Published June 27, 2020 in .NET core , Angular , IIS , security - 4 Comments

In this post, I share what I have learned about integrated windows authentication and how to enable it in a web application which consists of an angular front-end and ASP.NET core 3 backend.

Continue reading

Why you need to register authentication middleware even if your ASP.NET core web API does not handle authentication.

Published February 1, 2020 in .NET core , ASP.NET core , OAuth2 , OpenID Connect , security - 0 Comments

Sometimes ago, I was confused about the role of the Authentication middleware in an ASP.NET core web API that does not authenticate an user. It makes sense to me that you need to use the Authentication middleware if your web application handles the authentication. Specifically, I did not understand why you need to use Authentication middleware if your app is a web API that does not handle authentication. For instance, my web API performs token validation but it does not authenticate a user. Authentication handling is part of the client application which implements OpenID implicit flow to authenticate the user and obtains authorization to access the web API. I believed I only needed the Authorization middleware so that I can annotate the endpoints I want to protect with the [Authorized] attribute. The document states

The UseAuthentication method adds a single authentication middleware component, which is responsible for automatic authentication and the handling of remote authentication requests. 

Authentication Middleware and services

So if my web API does not handle authentication, why do I still need to call UseAuthentication to add the middleware?

Continue reading

Access azure key vault from an ASP.NET core app on IIS using X.509 certificate

In this post, I go over in more details the steps of retrieving secrets from an azure key vault using client id and secret. This approach is one of the three ways to authenticate a Windows virtual machine against azure key vault. It is suitable if your app runs on a virtual machine which is not an azure resource and so cannot use azure managed identity.

At the high level, the process involves these steps:

  • Register the application in azure.
  • Generate and add a X.509 certificate into a certificate store.
  • Grant IIS_IUSRS user permission to access the private key of the certificate.
  • Upload the public key of the certificate to the app’s registration.
  • Grant the app access to the key vault.
  • Add codes to Startup file to authenticate against AD using the certificate.

You can find the sample project for this post here.

Continue reading

Hosting a background task in an ASP.NET core application running on IIS.

Published May 22, 2019 in .NET core , ASP.NET core - 3 Comments

In this post, I share how I used the Microsoft.Extensions.Hosting.IHostedService interface and System.Thread.Timer class available in ASP.NET core to run a background job at a specified interval. It is straightforward for the most part, and Microsoft provides good documentation on the libraries. One thing that was not clear from the documents was handling overlapping invocations that happens when an invocation starts but the previous one has not finished within the specified interval. If you host your ASP.NET core on IIS, check out my other post to see how you can have your application and thus your background task auto start and run continuously on IIS.

Continue reading

Three ways of authenticating a Windows virtual machine against Azure Key Vault.

Published April 13, 2019 in .NET core , ASP.NET core , Azure , security - 2 Comments

In this post, I share three ways of gaining a Windows virtual machine access to a key vault. The machine can be an azure virtual machine or a non-azure machine such as your personal computer or a on premise server.

Continue reading