Step By Step ASP.NET Identity Implementation Guide

ASP.NET Identity is used in the Visual Studio 2013 project templates for ASP.NET MVC, Web Forms, Web API and SPA. In this walkthrough, we’ll illustrate how the project templates use ASP.NET Identity to add functionality to register, log in and log out a user.

ASP.NET Identity is implemented using the following procedure. The purpose of this article is to give you a high level overview of ASP.NET Identity; you can follow it step by step or just read the details. For more detailed instructions on creating apps using ASP.NET Identity, including using the new API to add users, roles and profile information, see the Next Steps section at the end of this article.

1. Create an ASP.NET MVC application with Individual Accounts. You can use ASP.NET Identity in ASP.NET MVC, Web Forms, Web API, SignalR etc. In this article we will start with an ASP.NET MVC application.
   
   
2. The created project contains the following three packages for ASP.NET Identity.
   • Microsoft.AspNet.Identity.EntityFramework
     This package has the Entity Framework implementation of ASP.NET Identity which will persist the ASP.NET Identity data and schema to SQL Server.
   • Microsoft.AspNet.Identity.Core 
     This package has the core interfaces for ASP.NET Identity. This package can be used to write an implementation for ASP.NET Identity that targets different persistence stores such as Azure Table Storage, NoSQL databases etc.
   • Microsoft.AspNet.Identity.OWIN
     This package contains functionality that is used to plug in OWIN authentication with ASP.NET Identity in ASP.NET applications. This is used when you add log in functionality to your application and call into OWIN Cookie Authentication middleware to generate a cookie.
3. Creating a user.
   Launch the application and then click on the Register link to create a user. The following image shows the Register page which collects the user name and password.
   
   
   
   When the user clicks the Register button, the  Register action of the Account controller creates the user by calling the ASP.NET Identity API, as highlighted below:

   [HttpPost]
   [AllowAnonymous]
   [ValidateAntiForgeryToken]
   public async Task<ActionResult> Register(RegisterViewModel model)
   {
       if (ModelState.IsValid)
       {
           var user = new ApplicationUser() { UserName = model.UserName };
           var result = await UserManager.CreateAsync(user, model.Password);
           if (result.Succeeded)
           {
               await SignInAsync(user, isPersistent: false);
               return RedirectToAction("Index", "Home");
           }
           else
           {
               AddErrors(result);
           }
       }
   
       // If we got this far, something failed, redisplay form
       return View(model);
   }

4. Log in.
   If the user was successfully created, she is logged in by the SignInAsync method.
   

   [HttpPost]
   [AllowAnonymous]
   [ValidateAntiForgeryToken]
   public async Task<ActionResult> Register(RegisterViewModel model)
   {
       if (ModelState.IsValid)
       {
           var user = new ApplicationUser() { UserName = model.UserName };
           var result = await UserManager.CreateAsync(user, model.Password);
           if (result.Succeeded)
           {
               await SignInAsync(user, isPersistent: false);
               return RedirectToAction("Index", "Home");
           }
           else
           {
               AddErrors(result);
           }
       }
   
       // If we got this far, something failed, redisplay form
       return View(model);
   } 

   private async Task SignInAsync(ApplicationUser user, bool isPersistent)
   {
       AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
   
       var identity = await UserManager.CreateIdentityAsync(
          user, DefaultAuthenticationTypes.ApplicationCookie);
   
       AuthenticationManager.SignIn(
          new AuthenticationProperties() { 
             IsPersistent = isPersistent 
          }, identity);
   }

   The highlighted code above in the SignInAsync method  generates a ClaimsIdentity. Since ASP.NET Identity and OWIN Cookie Authentication are claims-based system, the framework requires the app to generate a ClaimsIdentity for the user. ClaimsIdentity has information about all the claims for the user, such as what roles the user belongs to. You can also add more claims for the user at this stage.
   
   The highlighted code below in the SignInAsync method signs in the user by using the AuthenticationManager from OWIN and calling SignIn and passing in the ClaimsIdentity.
   

   private async Task SignInAsync(ApplicationUser user, bool isPersistent)
   {
       AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
   
       var identity = await UserManager.CreateIdentityAsync(
          user, DefaultAuthenticationTypes.ApplicationCookie);
   
       AuthenticationManager.SignIn(
          new AuthenticationProperties() { 
             IsPersistent = isPersistent 
          }, identity);
   }

5. Log off.
   Clicking the Log off link calls the LogOff action in the account controller.

   // POST: /Account/LogOff
   [HttpPost]
   [ValidateAntiForgeryToken]
   public ActionResult LogOff()
   {
       AuthenticationManager.SignOut();
       return RedirectToAction("Index", "Home");
   }

   The highlighted code above shows the OWIN AuthenticationManager.SignOut method. This is analogous to FormsAuthentication.SignOut method used by the FormsAuthentication module in Web Forms.

Components of ASP.NET Identity

The diagram below shows the components of the ASP.NET Identity system (click on this or on the diagram to enlarge it). The packages in green make up the ASP.NET Identity system. All the other packages are dependencies which are needed to use the ASP.NET Identity system in ASP.NET applications.