How To Create ASP.NET Core Web API in Visual Studio 2015

CheapASPNETHostingReview.com | Best and cheap ASP.NET Core 1.0 hosting. This tutorial lets us create very basic ASP.NET Core Web API using Visual Studio 2015. We will be creating Contacts API which lets do popular CRUD operations.

ASP.NET Web API is a framework that makes it easy to build HTTP services that reach a broad range of clients, including browsers and mobile devices.

ASP.NET Web API is an ideal platform for building RESTful applications on the .NET Framework. Update 12/10 – Updated to ASP.NET Core 1.0 with EF Core

Step 1 : Contacts API Overview

The Contacts API is very simple, basic Web API which does CRUD operations. I have focused on writing web API rather than integrating it with databases. This table summaries Contacts API which we’ll create

Step 2: Create ASP.NET Core Web API project

Install ASP.NET Core 1.0

Open Visual Studio 2015 Update 3, create “New Project” with name “ContactsApi”

From ASP.NET Core templates select “Web API” as shown in image (I haven’t selected any Authentication, we will add them later)

Program.cs is newly added file, it’s entry point when application run, that’s right public static void main(). ASP.NET Core apps are considered as console apps.

Step 3: Packages included for ASP.NET Core Web API

The packages included are “MVC”, “EnvironmentalVariables”, “JSON”, “Logging”. (This is generated by default, do not copy this)

"dependencies": {
    "Microsoft.NETCore.App": {
      "version": "1.0.1",
      "type": "platform"
    },
    "Microsoft.AspNetCore.Mvc": "1.0.1",
    "Microsoft.AspNetCore.Routing": "1.0.1",
    "Microsoft.AspNetCore.Server.IISIntegration": "1.0.0",
    "Microsoft.AspNetCore.Server.Kestrel": "1.0.1",
    "Microsoft.Extensions.Configuration.EnvironmentVariables": "1.0.0",
    "Microsoft.Extensions.Configuration.FileExtensions": "1.0.0",
    "Microsoft.Extensions.Configuration.Json": "1.0.0",
    "Microsoft.Extensions.Logging": "1.0.0",
    "Microsoft.Extensions.Logging.Console": "1.0.0",
    "Microsoft.Extensions.Logging.Debug": "1.0.0",

"dependencies": {

"Microsoft.NETCore.App": {

"version": "1.0.1",

"type": "platform"

"Microsoft.AspNetCore.Mvc": "1.0.1",

"Microsoft.AspNetCore.Routing": "1.0.1",

"Microsoft.AspNetCore.Server.IISIntegration": "1.0.0",

"Microsoft.AspNetCore.Server.Kestrel": "1.0.1",

"Microsoft.Extensions.Configuration.EnvironmentVariables": "1.0.0",

"Microsoft.Extensions.Configuration.FileExtensions": "1.0.0",

"Microsoft.Extensions.Configuration.Json": "1.0.0",

"Microsoft.Extensions.Logging": "1.0.0",

"Microsoft.Extensions.Logging.Console": "1.0.0",

"Microsoft.Extensions.Logging.Debug": "1.0.0",

Step 4: Creating Contacts model

Contacts class is centre of this Web API project. Its POCO class containing some properties which are self explanatory.

Right click “ContactsApi” solution, create folder “Models“; under this “Models” folder create C# class “Contacts.cs” and copy this code

using System;
 
namespace ContactsApi.Models
{
    public class Contacts
    {        
        public string FirstName { get; set; }
        public string LastName { get; set; }
        public bool IsFamilyMember { get; set; }        
        public string Company { get; set; }
        public string JobTitle { get; set; }
        public string Email { get; set; }
        public string MobilePhone { get; set; }
        public DateTime DateOfBirth { get; set; }
        public DateTime AnniversaryDate { get; set; }
    }
}

using System;

namespace ContactsApi.Models

{

public class Contacts

{

public string FirstName { get; set; }

public string LastName { get; set; }

public bool IsFamilyMember { get; set; }

public string Company { get; set; }

public string JobTitle { get; set; }

public string Email { get; set; }

public string MobilePhone { get; set; }

public DateTime DateOfBirth { get; set; }

public DateTime AnniversaryDate { get; set; }

}

Step 5: Create and Register repository class for Contacts

The use of repository classes is really optional, but I have added it so that we can connect to any databases later.

Create “Repository” folder under “ContactsApi” solution, we will add one C# interface file and C# class file implementing this interface.

Create “IContactsRepository.cs” interface file in “Repository” folder and copy below code

using ContactsApi.Models;
using System.Collections.Generic;
 
namespace ContactsApi.Repository
{
    public interface IContactsRepository
    {
        void Add(Contacts item);
        IEnumerable&lt;Contacts&gt; GetAll();
        Contacts Find(string key);
        void Remove(string Id);
        void Update(Contacts item);
    }
}

using ContactsApi.Models;

using System.Collections.Generic;

namespace ContactsApi.Repository

{

public interface IContactsRepository

{

void Add(Contacts item);

IEnumerable<Contacts> GetAll();

Contacts Find(string key);

void Remove(string Id);

void Update(Contacts item);

}

Create “ContactsRepository.cs” class file, implement “IContactsRepository” and copy below code

using System.Collections.Generic;
using System.Linq;
using ContactsApi.Models;
 
namespace ContactsApi.Repository
{
    public class ContactsRepository : IContactsRepository
    {
        static List&lt;Contacts&gt; ContactsList = new List&lt;Contacts&gt;();
 
        public void Add(Contacts item)
        {
            ContactsList.Add(item);
        }
 
        public Contacts Find(string key)
        {
            return ContactsList
                .Where(e =&gt; e.MobilePhone.Equals(key))
                .SingleOrDefault();
        }
 
        public IEnumerable&lt;Contacts&gt; GetAll()
        {
            return ContactsList;
        }
 
        public void Remove(string Id)
        {
            var itemToRemove = ContactsList.SingleOrDefault(r =&gt; r.MobilePhone == Id);
            if (itemToRemove != null)
                ContactsList.Remove(itemToRemove);            
        }
 
        public void Update(Contacts item)
        {
            var itemToUpdate = ContactsList.SingleOrDefault(r =&gt; r.MobilePhone == item.MobilePhone);
            if (itemToUpdate != null)
            {
                itemToUpdate.FirstName = item.FirstName;
                itemToUpdate.LastName = item.LastName;
                itemToUpdate.IsFamilyMember = item.IsFamilyMember;
                itemToUpdate.Company = item.Company;
                itemToUpdate.JobTitle = item.JobTitle;
                itemToUpdate.Email = item.Email;
                itemToUpdate.MobilePhone = item.MobilePhone;
                itemToUpdate.DateOfBirth = item.DateOfBirth;
                itemToUpdate.AnniversaryDate = item.AnniversaryDate;
            }
        }
    }
}

using System.Collections.Generic;

using System.Linq;

using ContactsApi.Models;

namespace ContactsApi.Repository

{

public class ContactsRepository : IContactsRepository

{

static List<Contacts> ContactsList = new List<Contacts>();

public void Add(Contacts item)

{

ContactsList.Add(item);

}

public Contacts Find(string key)

{

return ContactsList

.Where(e => e.MobilePhone.Equals(key))

.SingleOrDefault();

}

public IEnumerable<Contacts> GetAll()

{

return ContactsList;

}

public void Remove(string Id)

{

var itemToRemove = ContactsList.SingleOrDefault(r => r.MobilePhone == Id);

if (itemToRemove != null)

ContactsList.Remove(itemToRemove);

}

public void Update(Contacts item)

{

var itemToUpdate = ContactsList.SingleOrDefault(r => r.MobilePhone == item.MobilePhone);

if (itemToUpdate != null)

{

itemToUpdate.FirstName = item.FirstName;

itemToUpdate.LastName = item.LastName;

itemToUpdate.IsFamilyMember = item.IsFamilyMember;

itemToUpdate.Company = item.Company;

itemToUpdate.JobTitle = item.JobTitle;

itemToUpdate.Email = item.Email;

itemToUpdate.MobilePhone = item.MobilePhone;

itemToUpdate.DateOfBirth = item.DateOfBirth;

itemToUpdate.AnniversaryDate = item.AnniversaryDate;

}

ASP.NET MVC 6 provides out of box support for Dependency Injection, we will include that in our “ConfigureServices” method of Startup.cs. We will see entire code in Step 7

Step 6: Add Contacts API Controller

Its time to add the controller API which acts as Web API. Create “Controllers” folder under “ContactsApi” project solution and add C# class file “ContactsController.cs“; copy below code

using ContactsApi.Models;
using ContactsApi.Repository;
using Microsoft.AspNetCore.Mvc;
 
using System.Collections.Generic;
 
namespace ContactsApi.Controllers
{
    [Route("api/[controller]")]
    public class ContactsController : Controller
    {
        public IContactsRepository ContactsRepo { get; set; }
 
        public ContactsController(IContactsRepository _repo)
        {
            ContactsRepo = _repo;
        }
        
        [HttpGet]
        public IEnumerable&lt;Contacts&gt; GetAll()
        {
            return ContactsRepo.GetAll();
        }
 
        [HttpGet("{id}", Name = "GetContacts")]
        public IActionResult GetById(string id)
        {
            var item = ContactsRepo.Find(id);
            if (item == null)
            {
                return NotFound();
            }
            return new ObjectResult(item);
        }
 
        [HttpPost]
        public IActionResult Create([FromBody] Contacts item)
        {
            if (item == null)
            {
                return BadRequest();
            }
            ContactsRepo.Add(item);
            return CreatedAtRoute("GetContacts", new { Controller = "Contacts", id = item.MobilePhone }, item);
        }
 
        [HttpPut("{id}")]
        public IActionResult Update(string id, [FromBody] Contacts item)
        {
            if (item == null)
            {
                return BadRequest();
            }
            var contactObj = ContactsRepo.Find(id);
            if (contactObj == null)
            {
                return NotFound();
            }
            ContactsRepo.Update(item);
            return new NoContentResult();
        }
 
        [HttpDelete("{id}")]
        public void Delete(string id)
        {
            ContactsRepo.Remove(id);
        }
    }
}

using ContactsApi.Models;

using ContactsApi.Repository;

using Microsoft.AspNetCore.Mvc;

using System.Collections.Generic;

namespace ContactsApi.Controllers

{

[Route("api/[controller]")]

public class ContactsController : Controller

{

public IContactsRepository ContactsRepo { get; set; }

public ContactsController(IContactsRepository _repo)

{

ContactsRepo = _repo;

}

[HttpGet]

public IEnumerable<Contacts> GetAll()

{

return ContactsRepo.GetAll();

}

[HttpGet("{id}", Name = "GetContacts")]

public IActionResult GetById(string id)

{

var item = ContactsRepo.Find(id);

if (item == null)

{

return NotFound();

}

return new ObjectResult(item);

}

[HttpPost]

public IActionResult Create([FromBody] Contacts item)

{

if (item == null)

{

return BadRequest();

}

ContactsRepo.Add(item);

return CreatedAtRoute("GetContacts", new { Controller = "Contacts", id = item.MobilePhone }, item);

}

[HttpPut("{id}")]

public IActionResult Update(string id, [FromBody] Contacts item)

{

if (item == null)

{

return BadRequest();

}

var contactObj = ContactsRepo.Find(id);

if (contactObj == null)

{

return NotFound();

}

ContactsRepo.Update(item);

return new NoContentResult();

}

[HttpDelete("{id}")]

public void Delete(string id)

{

ContactsRepo.Remove(id);

}

Some quick notes of this ContactsController

[Route(“api/[controller]”)] – this used attribute based routing to access the ASP.NET Core Web API.
ContactsRepo is instantiated using dependency injection which we configure in services.cs.
GetAll() is simple HttpGet method which gets all contacts
GetById fetches contact based on mobile phone. Its given HttpGet with Name attribute so that we can use that in Create method to be used for location header.
Create method after inserting contact, returns 201 response and provides location header.

Note: HTTP Status codes are now written as BadReqest(), NotFound(), Unauthorized() etc

Step 7: Enable CamelCasePropertyNamesContractResolver

Any Web Api (REST based) should return JSON response in form of Camel Case so that we can sure consume the API in any client. We need to enable CamelCasePropertyNamesContractResolver in Configure Services.

Here is the Startup.cs file which has all code needed for running this Contacts ASP.NET Core Web API.

public void ConfigureServices(IServiceCollection services)
{
            // Add framework services.
            services.AddMvc()
                    .AddJsonOptions(a =&gt; a.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver()); ;
 
            //using Dependency Injection
            services.AddSingleton&lt;IContactsRepository, ContactsRepository&gt;();
}

public void ConfigureServices(IServiceCollection services)

{

// Add framework services.

services.AddMvc()

.AddJsonOptions(a => a.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver()); ;

//using Dependency Injection

services.AddSingleton<IContactsRepository, ContactsRepository>();

}

Claim Based Security on ASP.NET Core 1.0

CheapASPNETHostingReview.com | Best and cheap ASP.NET Core 1.0 hosting. Even though the ASP.NET Web platform and ASP.NET project scaffold have undergone some significant changes, ASP.NET MVC Views and Controllers have faced rather minor transformation in comparison with the shift in skeleton of the Application with the new platform. So here’s a brief outline of the latest news in ASP.NET development.

In this article, I’m going to describe the main concepts of building claim-based security on top of a brand-new platform: ASP.NET Core (with .NET Core). At the same time, I will create an application with similar functionality (as was done in my previous article), highlighting the differences.

Let’s get down to work. Create a “Hello World” ASP.NET Core Web application using the .NET Core framework

Figure 1: Creating a new ASP.NET Core Web application

Just like in the previous version of ASP.NET MVC, the main job is done. The default Visual Studio .NET Web Project template has already added all the namespaces and assemblies required for our test project. The only thing left is to implement simple functionality to add a new Claim during the user registration/creational process and then apply the authorization restriction to the user with the Claim specified.

Let’s quickly review the most important pieces of functionality responsible for security work this time:

Startup.cs is a class for the entire application bootstrap, including security:

    public class Startup
    {
       // Setting up the hosting environment
       // and configuration
       public Startup(IHostingEnvironment env)
       {
          var builder = new ConfigurationBuilder()
             .SetBasePath(env.ContentRootPath)
             .AddJsonFile("appsettings.json", optional: true,
                reloadOnChange: true)
             .AddJsonFile($"appsettings.{env.EnvironmentName}.json",
                optional: true);
     
          if (env.IsDevelopment())
          {
             // For more details on using the user secret store see
             // http://go.microsoft.com/fwlink/?LinkID=532709
             builder.AddUserSecrets();
          }
     
          builder.AddEnvironmentVariables();
          Configuration = builder.Build();
       }
     
       public IConfigurationRoot Configuration { get; }
     
       // This method gets called by the runtime. Use this method
       // to add services to the container.
       public void ConfigureServices(IServiceCollection services)
       {
          // Add framework services.
          services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
             options.UseSqlServer(Configuration.GetConnectionString
                ("DefaultConnection")));
     
          // Add Identity stuff to the application services
          services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
             .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;()
             .AddDefaultTokenProviders();
     
          services.AddMvc();
     
          // Add application services.
          services.AddTransient&lt;IEmailSender, AuthMessageSender&gt;();
          services.AddTransient&lt;ISmsSender, AuthMessageSender&gt;();
       }
     
       // This method gets called by the runtime. Use this method to
       // configure the HTTP request pipeline.
       public void Configure(IApplicationBuilder app,
          IHostingEnvironment env, ILoggerFactory loggerFactory)
       {
          loggerFactory.AddConsole(Configuration.GetSection
             ("Logging"));
          loggerFactory.AddDebug();
     
          if (env.IsDevelopment())
          {
             app.UseDeveloperExceptionPage();
             app.UseDatabaseErrorPage();
             app.UseBrowserLink();
          }
          else
          {
             app.UseExceptionHandler("/Home/Error");
          }
     
          app.UseStaticFiles();
     
          // Enable the application to use a cookie to store information
          // for the signed-in user and to use a cookie to temporarily
          // store information about a user logging in with a
          // third-party login provider
          app.UseIdentity();
     
          // Add external authentication middleware below. To configure
          // them, please see http://go.microsoft.com/fwlink/?LinkID=532715
     
          app.UseMvc(routes =&gt;
          {
             routes.MapRoute(
                name: "default",
                template: "{controller=Home}/
                   {action=Index}/{id?}");
          });
       }
    }

public class Startup

{

// Setting up the hosting environment

// and configuration

public Startup(IHostingEnvironment env)

{

var builder = new ConfigurationBuilder()

.SetBasePath(env.ContentRootPath)

.AddJsonFile("appsettings.json", optional: true,

reloadOnChange: true)

.AddJsonFile($"appsettings.{env.EnvironmentName}.json",

optional: true);

if (env.IsDevelopment())

{

// For more details on using the user secret store see

// http://go.microsoft.com/fwlink/?LinkID=532709

builder.AddUserSecrets();

}

builder.AddEnvironmentVariables();

Configuration = builder.Build();

}

public IConfigurationRoot Configuration { get; }

// This method gets called by the runtime. Use this method

// to add services to the container.

public void ConfigureServices(IServiceCollection services)

{

// Add framework services.

services.AddDbContext<ApplicationDbContext>(options =>

options.UseSqlServer(Configuration.GetConnectionString

("DefaultConnection")));

// Add Identity stuff to the application services

services.AddIdentity<ApplicationUser, IdentityRole>()

.AddEntityFrameworkStores<ApplicationDbContext>()

.AddDefaultTokenProviders();

services.AddMvc();

// Add application services.

services.AddTransient<IEmailSender, AuthMessageSender>();

services.AddTransient<ISmsSender, AuthMessageSender>();

}

// This method gets called by the runtime. Use this method to

// configure the HTTP request pipeline.

public void Configure(IApplicationBuilder app,

IHostingEnvironment env, ILoggerFactory loggerFactory)

{

loggerFactory.AddConsole(Configuration.GetSection

("Logging"));

loggerFactory.AddDebug();

if (env.IsDevelopment())

{

app.UseDeveloperExceptionPage();

app.UseDatabaseErrorPage();

app.UseBrowserLink();

}

else

{

app.UseExceptionHandler("/Home/Error");

}

app.UseStaticFiles();

// Enable the application to use a cookie to store information

// for the signed-in user and to use a cookie to temporarily

// store information about a user logging in with a

// third-party login provider

app.UseIdentity();

// Add external authentication middleware below. To configure

// them, please see http://go.microsoft.com/fwlink/?LinkID=532715

app.UseMvc(routes =>

{

routes.MapRoute(

name: "default",

template: "{controller=Home}/

{action=Index}/{id?}");

});

}

Models\ApplicationUser.cs contains an ApplicationUser class that derives from Microsoft.AspNetCore.Identity.EntityFrameworkCore.IdentityUser:

// Add profile data for application users by
   // adding properties to the ApplicationUser class
   public class ApplicationUser : IdentityUser
   {
   }

// Add profile data for application users by

// adding properties to the ApplicationUser class

public class ApplicationUser : IdentityUser

{

}

Until now, it’s been empty, so this is where we should add our claims. Let’s start applying code changes to demonstrate Claim-based security in real life:

1. Enable Entity Framework Migrations

Enable Entity Framework Migrations if there are any iterative changes to Claims planned. Because ASP.NET Identity uses Code First, auto-migration would be useful to perform database schema updates

2. Add Relevant Properties

Add all relevant properties to the ApplicationUser class (in file Models\ApplicationUser.cs) to store the Claims. Let’s take “BirthDate” and add this property to ApplicationUser. Don’t forget to add the using System clause before class definition.

3. Add EF Migration

Add EF migration to the update database with the new field. In the Package Manager Console, perform the following steps:

Add-Migration “Age” <press Enter> to create an upgrade script for our modification.
Update-Database <press Enter> to run a database schema update.

Now, we need to implement the filling out of the Birthday value. To make it more obvious, add a Birthday parameter to the User Registration form in the Models\AccountViewModels\RegisterViewModel.cs RegisterViewModel class:

    public class RegisterViewModel
    {
       [Required]
       [EmailAddress]
       [Display(Name = "Email")]
       public string Email { get; set; }
     
       [Required]
       [StringLength(100, ErrorMessage = "The {0} must be
          at least {2} and at max {1} characters long.",
          MinimumLength = 6)]
       [DataType(DataType.Password)]
       [Display(Name = "Password")]
       public string Password { get; set; }
     
       [DataType(DataType.Password)]
       [Display(Name = "Confirm password")]
       [Compare("Password", ErrorMessage = "The password
          and confirmation password do not match.")]
       public string ConfirmPassword { get; set; }
     
       [Required]
       [Display(Name = "Date of Birth")]
       [DataType(DataType.Date)]
       public DateTime BirthDate { get; set; }
     
    }

public class RegisterViewModel

{

[Required]

[EmailAddress]

[Display(Name = "Email")]

public string Email { get; set; }

[Required]

[StringLength(100, ErrorMessage = "The {0} must be

at least {2} and at max {1} characters long.",

MinimumLength = 6)]

[DataType(DataType.Password)]

[Display(Name = "Password")]

public string Password { get; set; }

[DataType(DataType.Password)]

[Display(Name = "Confirm password")]

[Compare("Password", ErrorMessage = "The password

and confirmation password do not match.")]

public string ConfirmPassword { get; set; }

[Required]

[Display(Name = "Date of Birth")]

[DataType(DataType.Date)]

public DateTime BirthDate { get; set; }

}

4. Update the Views\Account\Register.cshtml File

Update the Views\Account\Register.cshtml file with the new field:

       ...
       &lt;div class="form-group"&gt;
          &lt;label asp-for="BirthDate"
             class="col-md-2 control-label"&gt;&lt;/label&gt;
          &lt;div class="col-md-10"&gt;
             &lt;input asp-for="BirthDate"
                class="form-control" /&gt;
             &lt;span asp-validation-for="BirthDate"
                class="text-danger"&gt;&lt;/span&gt;
          &lt;/div&gt;
       &lt;/div&gt;
       ...

...

<label asp-for="BirthDate"

class="col-md-2 control-label"></label>

<input asp-for="BirthDate"

class="form-control" />

<span asp-validation-for="BirthDate"

class="text-danger"></span>

</div>

...

5. Update the Controllers\AccountController.cs Register Method

Update the Controllers\AccountController.cs Register method to pass Birthday:

// POST: /Account/Register
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task&lt;IActionResult&gt; Register(RegisterViewModel model,
   string returnUrl = null)
{
   ViewData["ReturnUrl"] = returnUrl;
   if (ModelState.IsValid)
   {
      var user = new ApplicationUser { UserName = model.Email,
         Email = model.Email, BirthDate = model.BirthDate };
      var result = await _userManager.CreateAsync(user,
         model.Password);
      if (result.Succeeded)
      {
         // For more information on how to enable account confirmation
         // and password reset, please visit
         // http://go.microsoft.com/fwlink/?LinkID=532713
         // Send an email with this link
         // var code = await
         // _userManager.GenerateEmailConfirmationTokenAsync(user);
         // var callbackUrl = Url.Action("ConfirmEmail",
         // "Account", new { userId = user.Id, code = code },
         // protocol: HttpContext.Request.Scheme);
         // await _emailSender.SendEmailAsync(model.Email,
         //    "Confirm your account",
         //    $"Please confirm your account by clicking this link:
         //    &lt;a href='{callbackUrl}'&gt;link&lt;/a&gt;");
         await _signInManager.SignInAsync(user, isPersistent: false);
         _logger.LogInformation(3, "User created a new account
            with password.");
         return RedirectToLocal(returnUrl);
      }
      AddErrors(result);
   }
 
   // If we got this far, something failed, redisplay form
   return View(model);

// POST: /Account/Register

[HttpPost]

[AllowAnonymous]

[ValidateAntiForgeryToken]

public async Task<IActionResult> Register(RegisterViewModel model,

string returnUrl = null)

{

ViewData["ReturnUrl"] = returnUrl;

if (ModelState.IsValid)

{

var user = new ApplicationUser { UserName = model.Email,

Email = model.Email, BirthDate = model.BirthDate };

var result = await _userManager.CreateAsync(user,

model.Password);

if (result.Succeeded)

{

// For more information on how to enable account confirmation

// and password reset, please visit

// http://go.microsoft.com/fwlink/?LinkID=532713

// Send an email with this link

// var code = await

// _userManager.GenerateEmailConfirmationTokenAsync(user);

// var callbackUrl = Url.Action("ConfirmEmail",

// "Account", new { userId = user.Id, code = code },

// protocol: HttpContext.Request.Scheme);

// await _emailSender.SendEmailAsync(model.Email,

// "Confirm your account",

// $"Please confirm your account by clicking this link:

// <a href='{callbackUrl}'>link</a>");

await _signInManager.SignInAsync(user, isPersistent: false);

_logger.LogInformation(3, "User created a new account

with password.");

return RedirectToLocal(returnUrl);

}

AddErrors(result);

}

// If we got this far, something failed, redisplay form

return View(model);

6. Add the Claims

Now, we need to add the Claims. To be more precise, we need a mechanism to add the Claims in ASP.NET Core because Microsoft.AspNetCore.Identity.SignInManager<TUser>, by default, includes only username and user identifier claims. SignInManager<TUser> uses IUserClaimsPrincipalFactory<TUser> to generate ClaimsPrincipal from TUser (in our case, from ApplicationUser).

We need to create our own implementation of IUserClaimsPrincipalFactory<TUser> to add custom claims. To not generate the boilerplate code, simply derive it from the default UserClaimsPrincipalFactory<TUser> which is already implementing IUserClaimsPrincipalFactory<TUser>.

    public class CustomClaimsPrincipalFactory :
       UserClaimsPrincipalFactory&lt;ApplicationUser,
       IdentityRole&gt;
    {
       public CustomClaimsPrincipalFactory(
          UserManager&lt;ApplicationUser&gt; userManager,
          RoleManager&lt;IdentityRole&gt; roleManager,
          IOptions&lt;IdentityOptions&gt; optionsAccessor) :
             base(userManager, roleManager, optionsAccessor)
       {
       }
     
       public async override Task&lt;ClaimsPrincipal&gt;
          CreateAsync(ApplicationUser user)
       {
          var principal = await base.CreateAsync(user);
     
          // Add your claims here
          ((ClaimsIdentity)principal.Identity).
             AddClaims(new[] {
             new Claim(ClaimTypes.DateOfBirth,
                user.BirthDate.ToString())
          });
     
          return principal;
       }
    }

public class CustomClaimsPrincipalFactory :

UserClaimsPrincipalFactory<ApplicationUser,

IdentityRole>

{

public CustomClaimsPrincipalFactory(

UserManager<ApplicationUser> userManager,

RoleManager<IdentityRole> roleManager,

IOptions<IdentityOptions> optionsAccessor) :

base(userManager, roleManager, optionsAccessor)

{

}

public async override Task<ClaimsPrincipal>

CreateAsync(ApplicationUser user)

{

var principal = await base.CreateAsync(user);

// Add your claims here

((ClaimsIdentity)principal.Identity).

AddClaims(new[] {

new Claim(ClaimTypes.DateOfBirth,

user.BirthDate.ToString())

});

return principal;

}

7. Register CustomClaimsPrincipalFactory

We need to register our CustomClaimsPrincipalFactory in Startup.cs after the Identity setup has been added:

    // This method gets called by the runtime. Use this method
    // to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
       // Add framework services.
       services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
          options.UseSqlServer(Configuration.
             GetConnectionString("DefaultConnection")));
     
       // Add Identity stuff to the application services.
       services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
          .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;()
          .AddDefaultTokenProviders();
     
       // Add Custom Claims processor
       services.AddScoped&lt;IUserClaimsPrincipalFactory&lt;ApplicationUser&gt;,
          CustomClaimsPrincipalFactory&gt;();
     
       services.AddMvc();
     
       // Add application services.
       services.AddTransient&lt;IEmailSender, AuthMessageSender&gt;();
       services.AddTransient&lt;ISmsSender, AuthMessageSender&gt;();
    }

// This method gets called by the runtime. Use this method

// to add services to the container.

public void ConfigureServices(IServiceCollection services)

{

// Add framework services.

services.AddDbContext<ApplicationDbContext>(options =>

options.UseSqlServer(Configuration.

GetConnectionString("DefaultConnection")));

// Add Identity stuff to the application services.

services.AddIdentity<ApplicationUser, IdentityRole>()

.AddEntityFrameworkStores<ApplicationDbContext>()

.AddDefaultTokenProviders();

// Add Custom Claims processor

services.AddScoped<IUserClaimsPrincipalFactory<ApplicationUser>,

CustomClaimsPrincipalFactory>();

services.AddMvc();

// Add application services.

services.AddTransient<IEmailSender, AuthMessageSender>();

services.AddTransient<ISmsSender, AuthMessageSender>();

}

8. Verify the Claim

We have implemented the Claims setup. The only thing left is to verify the Claim. It is a common practice to write custom Authorize filters to verify the availability and particular value of the Claim pair, and then put that filter on the controllers’ actions.

Claim BirthDay requires more checks, so I will implement verification of the Claim just for demonstration purposes in the Controllers\HomeController.cs About method:

    public IActionResult About()
    {
       ViewData["Message"] = "Your application description page.";
     
       var user = HttpContext.User;
       if (!user.HasClaim(c =&gt; c.Type ==
          System.Security.Claims.ClaimTypes.DateOfBirth))
       {
          ViewBag.Message = "Cannot detect the Age -
             Claim is absent.";
          return View();
       }
     
       int minAge = 16;
       var dateOfBirth = Convert.ToDateTime(user.FindFirst(c =&gt;
          c.Type == System.Security.Claims.ClaimTypes.DateOfBirth).Value);
     
       if (calculateAge(dateOfBirth) &gt;= minAge)
       {
          ViewBag.Message = "Your can view this page.";
       }
       else
       {
          ViewBag.Message = "Your cannot view this page -
             your age is bellow permitted one.";
       }
     
     
       return View();
    }
     
    private int calculateAge(DateTime dateOfBirth)
    {
       int calculatedAge = DateTime.Today.Year - dateOfBirth.Year;
       if (dateOfBirth &gt; DateTime.Today.AddYears(-calculatedAge))
       {
          calculatedAge--;
       }
       return calculatedAge;
    }

public IActionResult About()

{

ViewData["Message"] = "Your application description page.";

var user = HttpContext.User;

if (!user.HasClaim(c => c.Type ==

System.Security.Claims.ClaimTypes.DateOfBirth))

{

ViewBag.Message = "Cannot detect the Age -

Claim is absent.";

return View();

}

int minAge = 16;

var dateOfBirth = Convert.ToDateTime(user.FindFirst(c =>

c.Type == System.Security.Claims.ClaimTypes.DateOfBirth).Value);

if (calculateAge(dateOfBirth) >= minAge)

{

ViewBag.Message = "Your can view this page.";

}

else

{

ViewBag.Message = "Your cannot view this page -

your age is bellow permitted one.";

}

return View();

}

private int calculateAge(DateTime dateOfBirth)

{

int calculatedAge = DateTime.Today.Year - dateOfBirth.Year;

if (dateOfBirth > DateTime.Today.AddYears(-calculatedAge))

{

calculatedAge--;

}

return calculatedAge;

}

Any Claim may be extracted easily from the HttpContext.User at any point of the project.

Traditionally, let’s try to verify if the code works.

Reviewing all the Claims (in debug window):

Figure 4: Viewing the Claims in the debug window

Conclusion

That was a step-by-step guideline to set up Claim-based security in ASP.NET Core with the help of ASP.NET Core Identity.

Compared to the previous-generation ASP.NET MVC, at first glance implementation of the Claim-based security looks more complicated in ASP.NET Core. Previously, it was possible to add the Claims directly in the ApplicationUser implementation via overriding the GenerateUserIdentityAsync() method. In ASP.NET Core, we need to implement IUserClaimsPrincipalFactory<TUser> that is internally used by SignInManager<TUser>. On the other hand, we’ve got more structured classes and interfaces implementation in ASP.NET Core, as logically SignInManager should indeed control sign-in processes (including claims) and ApplicationUser should be just an IdentityUser.

One more useful thing that was introduced in ASP.NET Core is Claim-Based Authorization on top of Policies. It simplifies the verification of Claims on Controllers and Methods, thereby providing an ability to group the Claims.