authentication

Implement JWT, Identity, and OIDC authentication with policy-based authorization for ASP.NET Core APIs.

4|Updated Apr 20, 2026

Search Tags:#identity #asp.net core #oidc #authorization policies #jwt bearer #resource authorization

Ready to run

npx skills add https://github.com/zdanovichnick/dotnet-pilot --skill authentication-zdanovichnick

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: authentication
Source: https://github.com/zdanovichnick/dotnet-pilot/tree/main/skills/authentication
Command: npx skills add https://github.com/zdanovichnick/dotnet-pilot --skill authentication-zdanovichnick

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents broken or inconsistent authentication and authorization in ASP.NET Core APIs, reducing the risk of exposing endpoints or implementing insecure access control.

Core Features & Use Cases

JWT bearer authentication patterns: Configure token validation (issuer/audience/lifetime/signing key) and handle non-standard claim mapping.
ASP.NET Identity integration: Use database-backed users and issue JWTs for authenticated access where appropriate.
OIDC (OpenID Connect) federation: Set up external login flows with proper scopes and claim actions.
Policy-based authorization: Enforce role/claim requirements with fine-grained policies and fallback protection.
Resource-based authorization: Authorize based on the specific resource owner using handlers and IAuthorizationService.

Quick Start

Add authentication and authorization middleware in the correct order, then apply policy requirements to your endpoints to enforce consistent access control.

Frequently Asked Questions about authentication

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure JWT bearer authentication in ASP.NET Core APIs?▼

Configure JWT bearer authentication by validating issuer, audience, lifetime, and signing keys, mapping non-standard claims, and ordering middleware so UseAuthentication runs before UseAuthorization.

When do I need resource-based authorization instead of policy-based authorization?▼

Use resource-based authorization when access depends on a specific resource owner, utilizing IAuthorizationService and handlers rather than applying broad role or claim policies to endpoints.

Does ASP.NET Core support OIDC federation for external login flows?▼

Yes, ASP.NET Core supports OIDC federation for external login flows by configuring proper authentication scopes and claim actions to establish secure identity provider integration.

What is the correct middleware ordering for ASP.NET Core authentication?▼

The correct ASP.NET Core middleware ordering requires placing UseAuthentication before UseAuthorization to ensure user identity is established before access control checks.

How do I enforce fine-grained authorization policies in ASP.NET Core?▼

Enforce fine-grained authorization policies by defining role and claim requirements, applying fallback protection, and using IAuthorizationHandler-based checks for resource-specific endpoint access.

Can I integrate ASP.NET Identity with JWT tokens for API authentication?▼

Yes, you can integrate ASP.NET Identity by using database-backed users and issuing JWTs for authenticated API access, combining persistent user stores with stateless token validation.