Authentication needs in ASP.NET Core going forward

[damienbod]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

https://twitter.com/davidfowl/status/1534756765597720578

Describe the solution you'd like

I see 4 authentication grouped needs in ASP.NET Core

1- Easy to implement standard client authn (OpenID Connect)
2- Standalone with cookies and ASP.NET Core Identity (IDP solutions as well)
3- Certificate auth
4- AzureAD and Azure B2C client authn

I believe Microsoft should provide templates for just the client authn and docs + links to products about how to use or implement the second and third type. The Azure AD and Azure B2C client templates are already good.

If you have simple authn templates for OIDC clients for an ASP.NET Core API, Razor page, MVC, Blazor (WASM, BFF ASP.NET Core hosted, Server) which are easy to adapt after, then we have a good solution. As part of the solution then, docs about using with different IDPs would help as all IDPs have small differences.

HTTPS should be used with all these templates per default.

Additional context

No response

Thanks for contacting us.

We're moving this issue to the .NET 7 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

[Lonli-Lokli]

My scenario is not about Auth but about Auth integration testing with Minimal api.

One of the cases of my project is to be sure that all routes, including minimal, are protected with either Authorize or AllowAnonymous attributes.

Previously it was possible to loaf all types and search for ControllerBase inheritors and checking their metadata

Isn't it better to convert it to discussion?