This article shows how to create certificates for an IdentityServer4 application to use for signing and token validation. The certificates are created using the CertificateManager nuget package. Both RSA and ECDsa certificates can be used for signing in IdentityServer4.

Code:Certificates for IdentityServer4 signing using .NET Core

Creating the Certificates in .NET Core

A simple .NET Core console application is used to create the certificates. This type of application can run on most of the standard operating systems. Create a new console application and add the package CertificateManager. The package Microsoft.Extensions.DependencyInjection is also required to initialize the package.

Creating a RSA certificate

A self signed RSA certificate can be created using the CertificateManager NewRsaSelfSignedCertificate method. The key size must be at least 2048. The following example also adds TLS server and client authentication OID extensions, so that the certificate could also be used for client authentication.

Creating a…

tldr;

You can use Fallback Policies in ASP.NET Core 3.0+ to require an Authenticated User by default. Conceptually, you can think of this as adding an [Authorize] attribute by default to every single Controller and Razor Page ONLY WHEN no other attribute is specified on a Controller or Razor Page (like [AllowAnonymous] or [Authorize(PolicyName="PolicyName")]).  See lines 9-11 below.

This article shows how MFA could be forced on users to access sensitive pages within an ASP.NET Core Identity application. This could be useful for applications where different levels of access exist for the different identities. For example, users might be able to view the profile data using a password login, but an administrator would be required to use MFA to access the admin pages.

Code: https://github.com/damienbod/AspNetCoreHybridFlowWithApi

Blogs in this series

• Force ASP.NET Core OpenID Connect client to require MFA
• Send MFA signin requirement to OpenID Connect server using ASP.NET Core Identity and IdentityServer4
• Requiring MFA for Admin Pages in an ASP.NET Core Identity application

Extending the Login with a MFA claim

The application is setup using ASP.NET Core with Identity and Razor Pages. In this demo, the SQL Server was replaced with SQLite, and the nuget packages were updated. The AddIdentity method is used instead of AddDefaultIdentity one, so…

Note: Slides do not tell the whole story of the talk, so take the stand alone slides with a grain of salt. Things may be taken out of context.

Slides: PPTX or PDF