Overview
Lagoon relies on ASP.NET Core Identity to manage users, roles, hashed passwords, account recovery, account confirmation, and related mechanisms.
Forms and login
Forms authentication enables login with a username and password.
Email login
Lagoon can identify users solely by their email address.
Roles and policies
Lagoon recommends using policies to express authorizations, based on roles or custom claims (AuthenticationOptions.AccessTokenClaims).
Logout
Lagoon logout removes the access token from client browser storage and prevents its renewal from the refresh token.
SAML2
This page covers the SAML2 configuration of a Lagoon application and the associated ADFS settings.
OpenID Connect
Lagoon exposes an AddOidc extension method to register an OpenID Connect provider on the server side.
Windows
Windows authentication is enabled server-side and requires configuring the execution environment, notably in development with IIS Express or when publishing to IIS.
MFA
You can enable two-factor authentication for form-based logins, i.e. login / password.
Certificate
Two certificates are used to sign or encrypt data related to authentication.
External API OAuth 2
This page covers two distinct needs:
Stateless Users
With UserStorage = None, an SSO or Windows login neither writes user nor token to the database: the user's identity only lives in the cookie and tokens.
Secrets and placeholders
Store secrets outside the repository (dotnet user-secrets in development, environment variables or vault in production), share the UserSecretsId between the server, batch and dotnet ef via Directory.Build.props, and reference them in the configuration with ${Key} placeholders.