AspNetAuthorizationWorkshop | A workshop for moving through the various new pieces in ASPNET Core Authorization

In ASP.NET Core 2.1 the Microsoft.AspNetCore.App meta package contains all the authentication and authorization packages, so you don’t need to add any extra packages or references. Add app.UseAuthentication(); at the top of the Configure() method. Add Cookie middleware to the authentication service by adding the following to the top of the ConfigureServices() method. Edit the Home controller and add the [Authorize] attribute to the controller. Run the project and panic. You get a 404 error. you have no login page. Now create an Account controller, AccountController.cs in the Controllers folder. Create an Login() action and a Forbidden() action. Create an Account folder under the Views folder and create corresponding views for the actions, Login.cshtml and Forbidden.cshtml. Add some text to each view so you can tell which view is being displayed, and run your project. You will see you end up at the Login view. Return to the Account controller. Change the Login action to create a Principal and persist it using the code below. This will create user information and put it inside a cookie. This fakes what would normally happen in a forms based login system. Finally edit the Home\Index view to display the name claim for the identity. Replace the contents of that view with the following code. This code is a little over complicated on purpose, as a user principal can contain more than one authenticated identity. This rarely happens, and frankly you’ll know if you’ve written code to do this, but you should be aware of this edge case. Run the project and see what happens. You should see 'Hello barry'. The code claims.Add(new Claim(ClaimTypes.Name, "barry", ClaimValueTypes.String, Issuer)); inside the Login() method in the account controller is what is setting the name claim, and is what is being displayed by the view.
In ASP.NET Core 2.1 the Microsoft.AspNetCore.App meta package contains all the authentication and authorization packages, so you don’t need to add any extra packages or references.
Open startup.cs
Add app.UseAuthentication(); at the top of the Configure() method.
Add Cookie middleware to the authentication service by adding the following to the top of the ConfigureServices() method.
Edit the Home controller and add the [Authorize] attribute to the controller.
Run the project and panic. You get a 404 error. you have no login page.
Now create an Account controller, AccountController.cs in the Controllers folder. Create an Login() action and a Forbidden() action.
Create an Account folder under the Views folder and create corresponding views for the actions, Login.cshtml and Forbidden.cshtml.
Add some text to each view so you can tell which view is being displayed, and run your project. You will see you end up at the Login view.
Return to the Account controller. Change the Login action to create a Principal and persist it using the code below. This will create user information and put it inside a cookie. This fakes what would normally happen in a forms based login system.
Finally edit the Home\Index view to display the name claim for the identity. Replace the contents of that view with the following code. This code is a little over complicated on purpose, as a user principal can contain more than one authenticated identity. This rarely happens, and frankly you’ll know if you’ve written code to do this, but you should be aware of this edge case.
Run the project and see what happens. You should see 'Hello barry'. The code claims.Add(new Claim(ClaimTypes.Name, "barry", ClaimValueTypes.String, Issuer)); inside the Login() method in the account controller is what is setting the name claim, and is what is being displayed by the view.