Use social sign-in provider authentication without ASP.NET Core Identity

By Kirk Larkin and Rick Anderson

Facebook and Google authentication in ASP.NET Core describes how to enable users to sign in using OAuth 2.0 with credentials from external authentication providers. The approach described in that article includes ASP.NET Core Identity as an authentication provider.

This sample demonstrates how to use an external authentication provider without ASP.NET Core Identity. This approach is useful for apps that don't require all of the features of ASP.NET Core Identity, but still require integration with a trusted external authentication provider.

This sample uses Google authentication for authenticating users. Using Google authentication shifts many of the complexities of managing the sign-in process to Google. To integrate with a different external authentication provider, see the following articles:

• Facebook authentication
• Microsoft authentication
• Twitter authentication
• Other providers

Configuration

In Program.cs, configure the app's authentication schemes with the AddAuthentication, AddCookie, and AddGoogle methods:

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.Google;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = GoogleDefaults.AuthenticationScheme;
    })
    .AddCookie()
    .AddGoogle(options =>
    {
        options.ClientId = builder.Configuration["Authentication:Google:ClientId"];
        options.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"];
    });

builder.Services.AddRazorPages();

The call to AddAuthentication sets the app's DefaultScheme. The DefaultScheme is the default scheme used by the following HttpContext authentication extension methods:

• AuthenticateAsync
• ChallengeAsync
• ForbidAsync
• SignInAsync
• SignOutAsync

Setting the app's DefaultScheme to CookieAuthenticationDefaults.AuthenticationScheme ("Cookies") configures the app to use Cookies as the default scheme for these extension methods. Setting the app's DefaultChallengeScheme to GoogleDefaults.AuthenticationScheme ("Google") configures the app to use Google as the default scheme for calls to ChallengeAsync. DefaultChallengeScheme overrides DefaultScheme. See AuthenticationOptions for more properties that override DefaultScheme when set.

In Program.cs, call UseAuthentication and UseAuthorization. This middleware combination sets the HttpContext.User property and runs the Authorization Middleware for requests:

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();

To learn more about authentication schemes, see Authentication Concepts. To learn more about cookie authentication, see Use cookie authentication without ASP.NET Core Identity.

Apply authorization

Test the app's authentication configuration by applying the [Authorize] attribute to a controller, action, or page. The following code limits access to the Privacy page to users that have been authenticated:

[Authorize]
public class PrivacyModel : PageModel
{

}

Save the access token

SaveTokens defines whether access and refresh tokens should be stored in the AuthenticationProperties after a successful authorization. SaveTokens is set to false by default to reduce the size of the final authentication cookie.

To save access and refresh tokens after a successful authorization, set SaveTokens to true in Program.cs:

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = GoogleDefaults.AuthenticationScheme;
    })
    .AddCookie()
    .AddGoogle(options =>
    {
        options.ClientId = builder.Configuration["Authentication:Google:ClientId"];
        options.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"];
        options.SaveTokens = true;
    });

To retrieve a saved token, use GetTokenAsync. The following example retrieves the token named access_token:

public async Task OnGetAsync()
{
    var accessToken = await HttpContext.GetTokenAsync(
        GoogleDefaults.AuthenticationScheme, "access_token");

    // ...
}

Sign out

To sign out the current user and delete their cookie, call SignOutAsync. The following code adds a Logout page handler to the Index page:

public class IndexModel : PageModel
{
    public async Task<IActionResult> OnPostLogoutAsync()
    {
        // using Microsoft.AspNetCore.Authentication;
        await HttpContext.SignOutAsync();
        return RedirectToPage();
    }
}

Notice that the call to SignOutAsync doesn't specify an authentication scheme. The app uses the DefaultScheme, CookieAuthenticationDefaults.AuthenticationScheme, as a fallback.

Additional resources

• Simple authorization in ASP.NET Core
• Persist additional claims and tokens from external providers in ASP.NET Core