How to use Auth0 for full signup-signin process

Question

I am currently having troubles using auth0.com to set up whole authentication process for my asp.net web api project (I didn't write any view part, cause I'm using it only to learn auth/authoriz). Their quickstart guides and docs are starting from obtaining a token for your application, I don't understand what is this token, does it grants an access to whole application or what? I wrote a default implementation with creating a user as an object, then generating a token and assigning it to user, then you pass user's email and password and log. I want to do the same using auth0.com Is there a COMPLETE step-by-step guide on using auth0.com, with the explanation on how to create a user, how to let user log in etc.? My default implementation:

private readonly UserManager<AppUser> _userManager;
    private readonly TokenService _tokenService;
    public AccountController(UserManager<AppUser> userManager, TokenService tokenService)
    {
        _tokenService = tokenService;
        _userManager = userManager;
    }

    [AllowAnonymous]
    [HttpPost("login")]
    public async Task<ActionResult<UserDTO>> Login(LoginDTO loginDTO)
    {
        var user = await _userManager.FindByEmailAsync(loginDTO.Email);

        if (user is null) return Unauthorized();

        var result = await _userManager.CheckPasswordAsync(user, loginDTO.Password);

        if (result)
        {
            return CreateUserObject(user);
        }

        return Unauthorized();
    }

    [AllowAnonymous]
    [HttpPost("register")]
    public async Task<ActionResult<UserDTO>> Register(RegisterDTO registerDTO)
    {
        if (await _userManager.Users.AnyAsync(x => x.UserName == registerDTO.Username))
        {
            ModelState.AddModelError("username", "Username taken");
            return ValidationProblem();
        }

        if (await _userManager.Users.AnyAsync(x => x.Email == registerDTO.Email))
        {
            ModelState.AddModelError("email", "Email taken");
            return ValidationProblem();
        }

        var user = new AppUser
        {
            DisplayName = registerDTO.DisplayName,
            Email = registerDTO.Email,
            UserName = registerDTO.Username
        };

        var result = await _userManager.CreateAsync(user, registerDTO.Password);

        if (result.Succeeded)
        {
            return CreateUserObject(user);
        }

        return BadRequest(result.Errors);
    }

    [Authorize]
    [HttpGet]
    public async Task<ActionResult<UserDTO>> GetCurrentUser()
    {
        var user = await _userManager.FindByEmailAsync(User.FindFirstValue(ClaimTypes.Email));

        return CreateUserObject(user);
    }

    private UserDTO CreateUserObject(AppUser user)
    {
        return new UserDTO
        {
            DisplayName = user.DisplayName,
            Image = null,
            Token = _tokenService.CreateToken(user),
            Username = user.UserName
        };
    }

Answer 1

In general, you don't need to set up a sign-in/sign-up infrastructure with Auth0. The platform provides you with theUniversal Login page where users can register or log in to your application.

The result of the authentication on the Auth0 side is one or two tokens that tell you some info about the user ( ID token ) and optionally what the user/application is allowed to do ( access token ). To learn more about these tokens and the difference between them, read this article .

In your case, since your application is an API, you don't have to deal with user authentication directly. Your API isn't meant for users but for client applications.

To manage users, you can do it through the Auth0 Dashboard . If you want to create your own dashboard to manage users, you can do it through the Auth0 Management API . This is the library to use for .NET .

You assume that a client will call your API endpoints with the proper authorization expressed by an access token. Take a look at this article for a basic authorization check for ASP.NET Core Web APIs , andthis one for a permission-based approach . The articles also show how to test your protected API.

I hope these directions may help.