ASP.NET Core Identity Setup — Users, Roles and Database

ASP.NET Core Identity is the built-in membership system for user authentication, password management, role-based access control, and claims-based identity. It integrates with Entity Framework Core to persist users, roles, and claims in a database, and with ASP.NET Core’s cookie authentication system for stateful browser sessions. Setting it up correctly — particularly the database schema, the IdentityDbContext, and the startup configuration — is the foundation for all authentication and authorisation throughout the application.

Setup and Configuration #

// dotnet add package Microsoft.AspNetCore.Identity.EntityFrameworkCore

// ── 1. ApplicationUser — extend IdentityUser with custom properties ────────
public class ApplicationUser : IdentityUser
{
    // Extra profile properties beyond the Identity defaults
    [StringLength(100)]
    public string? DisplayName  { get; set; }

    [StringLength(500)]
    public string? Bio          { get; set; }

    public DateTime CreatedAt   { get; set; } = DateTime.UtcNow;
    public bool     IsActive    { get; set; } = true;
}

// ── 2. AppDbContext — add Identity tables ─────────────────────────────────
public class AppDbContext : IdentityDbContext<ApplicationUser>
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }

    // Your application tables
    public DbSet<Post>    Posts    => Set<Post>();
    public DbSet<Comment> Comments => Set<Comment>();

    // Identity tables are added by IdentityDbContext automatically:
    // AspNetUsers, AspNetRoles, AspNetUserRoles, AspNetUserClaims,
    // AspNetRoleClaims, AspNetUserLogins, AspNetUserTokens
}

// ── 3. Register Identity in Program.cs ───────────────────────────────────
builder.Services
    .AddIdentity<ApplicationUser, IdentityRole>(options =>
    {
        // Password policy
        options.Password.RequireDigit           = true;
        options.Password.RequireLowercase        = true;
        options.Password.RequireUppercase        = true;
        options.Password.RequireNonAlphanumeric  = true;
        options.Password.MinimumLength           = 8;

        // Lockout policy — protect against brute force
        options.Lockout.DefaultLockoutTimeSpan   = TimeSpan.FromMinutes(5);
        options.Lockout.MaxFailedAccessAttempts  = 5;
        options.Lockout.AllowedForNewUsers       = true;

        // User policy
        options.User.RequireUniqueEmail          = true;
        options.SignIn.RequireConfirmedEmail     = false;  // true in production
    })
    .AddEntityFrameworkStores<AppDbContext>()
    .AddDefaultTokenProviders();   // for email confirmation, password reset tokens

// ── 4. Cookie authentication middleware ───────────────────────────────────
builder.Services.ConfigureApplicationCookie(options =>
{
    options.LoginPath         = "/account/login";
    options.LogoutPath        = "/account/logout";
    options.AccessDeniedPath  = "/account/access-denied";
    options.ExpireTimeSpan    = TimeSpan.FromDays(14);
    options.SlidingExpiration = true;
    options.Cookie.HttpOnly   = true;
    options.Cookie.SameSite   = SameSiteMode.Strict;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});

// ── 5. Middleware pipeline ────────────────────────────────────────────────
app.UseAuthentication();  // must be before UseAuthorization
app.UseAuthorization();

Identity Table Schema #

Common Mistakes #

Mistake 1 — Using IdentityDbContext without ApplicationUser (cannot extend user properties) #

❌ Wrong — using plain IdentityDbContext without a custom user class; cannot add profile properties.

✅ Correct — always create ApplicationUser : IdentityUser and use IdentityDbContext<ApplicationUser>.

Mistake 2 — Registering AddAuthentication before AddIdentity (cookie configuration ignored) #

❌ Wrong — calling AddAuthentication separately conflicts with Identity’s authentication setup.

✅ Correct — AddIdentity registers cookie authentication internally; use ConfigureApplicationCookie to customise it.