[00:01] security as a .NET developer, you'll probably explore adding some sort of identity provider into your system. And in this video, I want to introduce you to Auth0, which is a very popular identity provider. I'm going to show you
[00:14] why it's interesting, how many users you can get on the free plan, and how to integrate it for authentication purposes into your .NET applications. As I said, Auth0 is a very popular identity provider. It's being used by many
[00:28] applications worldwide. It also has a .NET integration that we're going to discuss a bit later. And for B2C integrations, it comes with everything user management, multi-factor authentication, and it's also easy to
[00:43] integrate into our .NET applications, which is what we are concerned with. really going to range between what your needs are and how many users you have. But, what I think it's appealing to at least consider is because it has a very
[00:57] generous free plan that allows you up to 25,000 monthly active users. So, if you have less users than this or up to 25,000 users, then the free plan is It also comes with passwordless authentication. You can customize it to
[01:12] your brand. You can add a custom domain, and really manage everything you need for your authentication and authorization purposes. Now, let's head into the Auth0 portal. When you log in, you will be prompted to create your
[01:25] first tenant, and also choose the region where your data is going to be stored. I created a tenant with its data stored in the EU region, and this is the dashboard that you're going to see after you create your tenant. Now, from here, you
[01:38] have a couple of options. And obviously, the main call to action here is to that. And here, you have to decide your application type. Now, if you're familiar with other identity providers, this is very similar to the concept of a
[01:51] client, from my understanding. And our options here are having a native client, which is something like a mobile, a desktop app, or a CLI, a single page web application. This is suitable for JS applications or things like Angular or
[02:04] React, a regular web application, which is more akin to an API, and then you've got a machine-to-machine application, and these are more appropriate for your with each other and aren't exposed to the public. Now, what I'm going to do
[02:18] for this demo is integrate Auth0 with my Swagger UI client. So, I'm going to choose a single page web application. And the main difference here is how this flows that we have access to. So, I'm going to call this the Swagger Auth0
[02:33] So, from here, you're going to get an option to choose which technology you're going to give you a very quick integration guide. So, let's say I'm using just plain old JavaScript, and you even get an AI prompt that you can pass
[02:48] in to your agent to let it integrate Auth0 for you. Now, there's also a quick getting started guide that you can follow to see what's required to have everything up and running, and I want to actually show you the interesting parts.
[03:00] have access to a couple of important going to need to know your Auth0 domain. This is going to be your issuer and your auth 3 when we want to validate our access tokens later. Then we've got our
[03:13] client ID, and as I said, applications in Auth0 are essentially OAuth clients. And we also have a client secret that we will have to specify when sending an authorization request. Now, if we keep scrolling down, there are some other
[03:26] here. So, among other things, you can change the application type, and this is access to. Then we're going to have things like application URIs and important for implementing the authorization flows. And if I keep
[03:42] couple more settings. So, here we can see settings for token lifetime, refresh token lifetime, and if we go all the the down, I want to show you the advanced metadata, configure device settings. We can also configure our OAuth settings.
[03:57] And when it comes to grant types, this is actually which authorization flows you're allowed to use with this OAuth client. And considering this is a UI implicit authorization code and refresh token flows. Client credentials is more
[04:11] scenarios, and the password flow really isn't recommended today as the gold standard is using authorization code flow with proof key for code exchange or endpoints, and this is where you can find your OAuth endpoints. And it's what
[04:26] to have everything integrate nicely into the OAuth flow. So, here is the authorize endpoint and then the token endpoint, which are going to be the most getting the OpenID configuration, and our back end will know how to use it to
[04:40] extract the JSON keys automatically from this response. Just to show you, I'm going to copy this URL and I'm going to open it in another browser window. And authorization endpoint, your token endpoint, and these all integrate nicely
[04:54] into our JSON web token authorization flow on the back end. So, let me go back to our application, and here I want to configure a couple of things. So, we're going to configure the allowed callback URLs, and here I'm going to add a URL
[05:07] for our Swagger UI to allow a callback from the Auth0 login screen. And we're set it as one of the allowed web origins. Let's click save, and this gets persisted. And then we're going to click under applications and APIs, and we're
[05:22] going to create another API. So, I'm going to call this the Auth0 demo API, and I'm also going to use the same name as the identifier. And this is going to JSON web token that we're going to create. I'm going to leave all the other
[05:36] going to create this. And once we have our API configured, I'm going to go back to the applications, open up our Swagger OAuth client, and we're going to go into APIs, and we want to add access to the
[05:49] Auth0 demo API that we just created. Now, this API essentially represents our back-end application, and we want to allow our OAuth client to have access to the permissions, and I'm going to allow it user access, and then we're going to
[06:03] click save. So, now I can close this down, and it's time to move into our .NET application. So, right now, I don't have any authentication or authorization stopped out the required environment variables that we have to set. So, these
[06:16] the token URL, the metadata address, the valid issuer, and our audience. We already discussed some of these as I was introducing you to Auth0. So, we're going to set these values later, but first, let's add the required services,
[06:29] and I'm noting that I already installed the JSON Web Token library, which is going to allow us to validate JSON Web Tokens that Auth0 is going to issue for Microsoft.AspNetCore.Authentication.JwtBearer. So, I'm going to say builder.Services.
[06:46] Add authorization. Then, I'm going to say builder.Services.AddAuthentication, scheme. So, we're going to say JwtBearerDefaults and access the authentication scheme, and this just has a constant value of
[06:59] AddJwtBearer, and this allows us to configure how we're going to validate incoming JWT tokens. So, I'm going to say options.Audience, and we're going to set this to a value
[07:11] configuration section. So, we're going to first match our audience. Then, I want to set the metadata address, and let me update my setting value to target null-forgiving operator. And lastly, I just need to set a new value for the
[07:27] token validation parameters, and here, I want to configure the valid issuer. So, let me also copy this, and we're going to use the value of issuer. So, that's it as far as our authentication and authorization services are concerned. We
[07:40] middleware. So, we're going to say app.use authentication and then we're going to say app.use authorization. The order of these is important, so keep that in mind. We already have our protected
[07:53] endpoint that we're going to call to test out if all of this is working as expected. And then when setting up the Swagger UI, I'm going to configure the options here to say OAuth additional query string parameters. This is because
[08:06] we need to send an additional query parameter to set the audience value in our authorization request so that we get back the correct JSON web token. Now, this value has to match the API audience that we just created and this is going
[08:20] to be our Auth0 demo API. Of course, we can also pull this value from builder.configuration and then the respective values inside of our appsettings.json. So, we already know
[08:34] the audience and the value is Auth0 demo API. Our valid issuer is just going to be the base address of our tenant. And then we can just pull the values for the metadata address, the token URL, and the authorization URL from the endpoint
[08:46] section of our client. Now, one more thing I added behind the scenes is some code for my Swagger configuration to implement an OAuth flow, to be more specific, the authorization code flow. And here we have to specify our
[08:58] authorization URL, the token URL, and any scopes we may want to pass to this request. So, with this I'm going to start my application. Now, if we open up the Swagger UI and I try to call our single endpoint, we're going to get back
[09:10] a 401 unauthorized response. If I click authorize, you can see our OAuth flow is correctly set pointing to our two endpoints and we have to input our client ID and client secret. We can get both of these values from our Auth0
[09:24] client. So, here is the client ID. I'm going to copy it and paste it into the client ID field and I'm also going to drop in the client secret. I'll select both scopes and I'm also going to open up dev tools side by side and I will now
[09:36] click authorize. This is going to redirect us to Auth0, where we can give our client access to our APIs. I'm going to click accept, and this will now where we are going to send a token request with our custom audience, and we
[09:51] will get back an access token response. So, if we copy the contents of this access token, and we go over to jwt.io get rid of the quotes, we should see a valid access token and all of its
[10:04] claims. You can see our custom audience here, the issuer, and we can now use this to authenticate with our back end. So, if I close this and send a request to our endpoint, you'll see that we get a 200 OK response, and I'm just going to
[10:16] list out the claims available on this token in the response body. And this is all because of how OAuth works behind the scenes. If we take a look at our API request, you can see that other than calling our API inside of this
[10:28] additional requests. So, this one here is targeting our OpenID configuration on our Auth0 tenant, and it's going to pull back the configuration values, which it's going to use to access the JSON web keys, and this is how it knows to
[10:42] validate the JSON web token signature. Now, this is going to be cached, so it's requests, but I just wanted to give you a full picture of how we are able to validate the JSON web token. Now, if you're looking for a free and open
[10:55] source identity provider, then I think you should watch this video next to see how you can integrate Keycloak into your .NET applications. If you enjoyed this video, consider gently tapping the like button to let me know. Thanks a lot for
[11:07] watching, and until next time, stay awesome.