ASP.NET Core Identity — Complete Setup Guide

Introduction

ASP.NET Core Identity is the membership system for ShopNest — users, passwords, roles, lockout, and email confirmation out of the box. It replaces rolling your own auth tables and integrates with EF Core and cookie/JWT schemes.

After this article you will

• Install Identity packages and extend ApplicationUser
• Use UserManager and SignInManager
• Scaffold register/login/logout pages
• Configure password policies and lockout
• Add custom registration fields and email confirmation

Prerequisites

• Article 28 — Error Handling and Exception Management
• ShopNest.Web with EF Core and configuration from Module 3

Concept deep-dive

// Packages: Microsoft.AspNetCore.Identity.EntityFrameworkCore

public class ApplicationUser : IdentityUser
{
    public string FullName { get; set; } = "";
    public DateTime RegisteredAt { get; set; } = DateTime.UtcNow;
}

builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
    options.Password.RequiredLength = 8;
    options.Password.RequireDigit = true;
    options.Lockout.MaxFailedAccessAttempts = 5;
    options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
    options.User.RequireUniqueEmail = true;
})
.AddEntityFrameworkStores<ShopNestDbContext>()
.AddDefaultTokenProviders();

builder.Services.ConfigureApplicationCookie(options =>
{
    options.LoginPath = "/Account/Login";
    options.AccessDeniedPath = "/Account/AccessDenied";
    options.SlidingExpiration = true;
    options.ExpireTimeSpan = TimeSpan.FromHours(8);
});

app.UseAuthentication();
app.UseAuthorization();

UserManager — CreateAsync, FindByEmailAsync, AddToRoleAsync, GenerateEmailConfirmationTokenAsync.
SignInManager — PasswordSignInAsync, SignOutAsync, CheckPasswordSignInAsync.

Scaffold Identity UI: dotnet aspnet-codegenerator identity -dc ShopNestDbContext

Hands-on — ShopNest Multi-Role Web Application

1. Extend ApplicationUser with FullName; migration.
2. Seed roles: Admin, Customer, Vendor.
3. Register page with custom field; assign Customer role on signup.
4. Email confirmation stub (log token in Development).
5. Login/logout with [Authorize] on /Account/Orders.

var result = await _userManager.CreateAsync(user, model.Password);
if (result.Succeeded)
{
    await _userManager.AddToRoleAsync(user, "Customer");
    await _signInManager.SignInAsync(user, isPersistent: false);
    return RedirectToAction("Index", "Home");
}
foreach (var err in result.Errors) ModelState.AddModelError("", err.Description);

Common errors & best practices

• UseAuthentication after UseRouting but before UseAuthorization — wrong order breaks login.
• Storing passwords in plain text — Identity hashes with PBKDF2 automatically.
• Missing AddDefaultTokenProviders — password reset tokens fail.

Interview questions

Q: Identity vs custom auth?
A: Identity gives users, roles, lockout, 2FA hooks — don't rebuild unless special requirements.

Q: UserManager vs SignInManager?
A: UserManager manages user records; SignInManager creates auth cookies/sessions.

Q: Lockout purpose?
A: Brute-force protection — lock account after N failed attempts.

Summary

• Identity + EF Core stores users and roles in SQL Server
• UserManager/SignInManager drive register/login flows
• Password and lockout policies configured in Program.cs
• Multi-role ShopNest app starts here

Previous: Error Handling and Exception Management
Next: Authentication — Cookie and JWT

FAQ