Using ASP.NET Core MVC cookie based authentication with custom user tables in database

Question

I have my own tables for Authentication:
Users
Roles
UserRoles

I am am trying to figure out what the best way to implement custom authentication with ASP.NET Core MVC would be. I do not want to use the built in UserManager, RoleManager, etc. I prefer creating my own. Can I somehow still tap into the cookie based authentication and use all of the ASP.NET Authorization helper tags without using asp.net identity?

Correct me if I am wrong, but I believe I want something like this: https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie

Answer 1

I have been trying to figure out ASP.NET Identity for years and I am sick of not understanding every single part of it. I would rather implement my own auth just like the good old days. It is most likely my problem for not being able to read the documentation and pick up on it, but I cant stand Entity Framework / ASP.NET Identity. I am aware that ASP.NET Identity can be used without EF but just seems like a pain.

Well, if you decided to go that route, you can use Cookie Authentication Middleware .

There are too many moving pieces, so I created a sample project in GitHub.

You can replace this LDAP Authentication with your own Authentication mechanism. Here is actual implementation.

The main reason I did not use ASP.NET Identity in some of my projects is we already have Active Directory in our organization.

Startup.cs

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
   Events = new CookieAuthenticationEvents
   {
      OnRedirectToAccessDenied = context =>
      {
         context.Response.StatusCode = (int) HttpStatusCode.Forbidden;
         return TaskCache.CompletedTask;
      }
   },
   ExpireTimeSpan = TimeSpan.FromMinutes(Int32.Parse(Configuration.GetSection(
       "AppSettings:CookieAuthentication:ExpireMinutes").Value)),
   AuthenticationScheme = Constants.AuthenticationScheme,
   LoginPath = new PathString("/Account/Login"),
   AccessDeniedPath = new PathString("/Common/AccessDenied"),
   AutomaticAuthenticate = true,
   AutomaticChallenge = true
});