Cloud Concepts

Project Mgmt. Concepts

Architecture & Design Patterns - 1

Architecture & Design Patterns - 2

Security Practices

.NET Core Essentials-1

.NET Core Essentials-2

.NET Core Essentials-3

.NET Core Essentials-4

.NET Core Essentials-5

.NET Core Essentials-6

.NET Core Essentials-7

Previous Application-Scaling-and-modernization Cloud-Services Next

Authentication vs. Authorization

Authentication and authorization are two distinct security processes used to protect systems and data.

Authentication (AuthN)

Authentication verifies identity—ensuring that a user or system is who they claim to be.

Key Methods

  • Username & Password: Traditional login credentials.
  • Multi-Factor Authentication (MFA): Combines multiple factors (e.g., password + OTP).
  • Biometric Authentication: Uses fingerprints, facial recognition, or retina scans.
  • OAuth & OpenID Connect: Secure protocols for web authentication.

Authorization (AuthZ)

Authorization determines the actions a user can perform after authentication.

Key Methods

  • Role-Based Access Control (RBAC): Grants permissions based on user roles.
  • Attribute-Based Access Control (ABAC): Access based on attributes like location or device.
  • OAuth 2.0: Uses access tokens for secure API authorization.
  • JSON Web Tokens (JWT): Enables stateless authorization in web applications.

OAuth Architecture

  • Authorization Server: Authenticates users and issues access tokens.
  • Resource Server: Hosts protected resources.
  • Client: Requests access to protected resources.
  • Flows: Supports Authorization Code, Implicit, Client Credentials, and other flows.

JWT Architecture

  • Token Structure: Consists of a header, payload, and signature (Base64url encoded).
  • Header: Metadata including signing algorithm.
  • Payload: Contains claims (subject, issuer, audience).
  • Signature: Ensures token integrity and authenticity.
  • Verification: Performed using a public key (RSA) or secret key (HMAC).

API Keys Architecture

  • Key Distribution: Service providers issue API keys to clients.
  • Key Usage: Included in requests via headers or URL parameters.
  • Server-Side Validation: Keys are validated by the service provider.

Key Differences

  • Delegation: OAuth enables user access delegation to third-party apps.
  • Information Exchange: JWTs facilitate secure data transfer between parties.
  • Authentication: API keys authenticate clients simply.
  • Security: OAuth and JWTs offer stronger security than API keys.
  • Revocation: JWTs can be revoked for better access control.
  • User Context: OAuth and JWTs support user-specific permissions.

When to Use

  • OAuth: For third-party access without revealing credentials.
  • JWT: For secure info exchange and stateless authentication.
  • API Keys: For simple, internal applications needing basic authentication.

🔐 Types of Authentication in ASP.NET Core Web API

1. No Authentication

No authentication means the API is open to everyone. This is suitable for public endpoints like health checks or documentation, but not recommended for sensitive data.

2. Basic Authentication

The client sends a Base64-encoded username:password in the Authorization header. The server decodes and validates the credentials. 

Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l

Note: Not secure unless used over HTTPS.

3. JWT Authentication

JSON Web Tokens (JWT) are compact tokens containing claims. The server issues a token after login, and the client includes it in the Authorization header. 

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

JWTs are stateless and digitally signed, making them ideal for scalable APIs.

4. OAuth2 & OpenID Connect (OIDC)

OAuth2 is a protocol for delegated access. OIDC extends OAuth2 to include identity information. Commonly used with identity providers like Google, Azure AD, or IdentityServer.

  • Authorization Server: Issues tokens
  • Resource Server: Hosts protected APIs
  • Client: Requests access on behalf of user

Supports flows like Authorization Code, Client Credentials, and Implicit.

5. API Key Authentication

Clients include a unique API key in the request header or query string. The server validates the key to authenticate the client. 

GET /api/data?apikey=12345

Simple to implement, but less secure than token-based methods.

6. Certificate Authentication

Uses client-side SSL certificates to authenticate users or devices. The server verifies the certificate during the TLS handshake.

Common in enterprise environments and IoT scenarios.

7. Windows Authentication

Uses the operating system’s credentials (e.g., Active Directory) to authenticate users. Supported via IIS or Kestrel with NTLM or Kerberos.

Ideal for intranet applications where users are part of a Windows domain.

✅ Summary

  • No Authentication: Open access
  • Basic: Simple but insecure
  • JWT: Stateless and scalable
  • OAuth2/OIDC: Delegated and identity-aware
  • API Key: Lightweight client auth
  • Certificate: Secure device/user auth
  • Windows: Domain-based auth

Production grade Authentication Methods in ASP.NET Core Web API

In production-grade ASP.NET Core Web API applications, the most commonly used authentication methods are:

🔐 1. JWT (JSON Web Token) Authentication

Why it's popular:

  • Stateless and scalable
  • Works well with REST APIs and microservices
  • Easy to integrate with front-end frameworks (React, Angular, etc.)

Use case:

Mobile apps, SPAs, distributed systems

🌐 2. OAuth2 with OpenID Connect (OIDC)

Why it's popular:

  • Industry-standard for delegated access and identity federation
  • Supports third-party login (Google, Azure AD, etc.)
  • Secure and flexible

Use case:

Enterprise apps, multi-tenant SaaS platforms, external integrations

🔑 3. API Key Authentication

Why it's used:

  • Simple to implement
  • Good for internal services or server-to-server communication

Use case:

Internal APIs, microservices, IoT devices

🧾 Honorable Mentions

  • Windows Authentication: Common in intranet and enterprise environments using Active Directory.
  • Certificate Authentication: Used in high-security or device-level authentication scenarios.
  • Basic Authentication: Rarely used in production due to security limitations (unless over HTTPS and with additional safeguards).

✅ Summary

Authentication Type Common in Production Best For
JWT ✅ Yes REST APIs, SPAs
OAuth2 + OIDC ✅ Yes Enterprise, third-party login
API Key ✅ Yes Internal APIs, microservices
Windows Authentication ☑️ Sometimes Intranet, enterprise apps
Certificate ☑️ Niche Secure device-to-server comms
Basic Authentication ❌ Rare Legacy or simple internal tools
No Authentication ❌ Never Public endpoints only
Back to Index
Previous Application-Scaling-and-modernization Cloud-Services Next
*