How to Implement .Net Framework Web API Token Based Authentication .

Question

How to Implement .Net Framework Web API Token Based Authentication & Authorization Without Entity Framework

DhanuOP · Answer

Sir i am having Trouble to understanding like what is IUserStore and IRoleStore and register those with DI services3. i am beginner and i want to implement token and all stuff can u give me some more detail for better understanding start to end Thanku For Your Reply .

Naimish Makwana · Answer

Sure, here’s a high-level overview of how you can implement token-based authentication and authorization in .NET Framework Web API without using Entity Framework: Create and Configure a Web API Project : Create an empty solution for the project template “ASP.NET Web Application” and add a core reference of the Web API1. Add References : Add NuGet References like Microsoft.Owin.Host.SystemWeb, Microsoft.Owin.Security.OAuth, and Microsoft.Owin.Cors2. Implement UserStore and RoleStore : To not use Entity Framework, you must implement IUserStore and IRoleStore and register those with DI services3. Create APIAuthorizationServerProvider Class : This class will provide credentials to access data depending on username, password, and roles2. Implement Token-Based Authentication : The client application first sends a request to the Authentication server with valid credentials. The Authentication server sends an Access token to the client as a response. This token contains enough data to identify a particular user and it has an expiry time2. Here’s a sample code for the ApiAuthorizationServerProvider class: public class ApiAuthorizationServerProvider : OAuthAuthorizationServerProvider { public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) { context.Validated(); } public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context) { var identity = new ClaimsIdentity(context.Options.AuthenticationType); if (context.UserName == "admin" && context.Password == "admin") { identity.AddClaim(new Claim(ClaimTypes.Role, "admin")); identity.AddClaim(new Claim("username", "admin")); identity.AddClaim(new Claim(ClaimTypes.Name, "Hi Admin")); context.Validated(identity); } else if (context.UserName == "user" && context.Password == "user") { identity.AddClaim(new Claim(ClaimTypes.Role, "user")); identity.AddClaim(new Claim("username", "user")); identity.AddClaim(new Claim(ClaimTypes.Name, "Hi User")); context.Validated(identity); } else { context.SetError("invalid_grant", "Provided username and password are incorrect"); return; } } } 2 Please note that this is a simplified example and you might need to adjust it according to your specific requirements. For a more detailed guide, you can refer to the resources provided425. You can refer below sites. https://dotnettutorials.net/lesson/token-based-authentication-web-api/ https://medium.com/@craftingcode/how-to-implement-custom-authentication-and-authorization-mechanisms-in-asp-net-fd15ed516a9e https://www.c-sharpcorner.com/article/web-ap/ Thanks