The .NET 8 Auth Changes You Must Know About!

Use code DDD20 and get 20% off the brand new Domain-Driven Design course on Dometrain: dometrain.com/course/getting-...
Become a Patreon and get source code access: / nickchapsas
Hello, everybody, I'm Nick, and in this video, I will show you how Authentication and Identity have changed in .NET 8 in an effort to simplify it and make it more accessible.
Subscribe to Amichai: @amantinband
Workshops: bit.ly/nickworkshops
Don't forget to comment, like and subscribe :)
Social Media:
Follow me on GitHub: bit.ly/ChapsasGitHub
Follow me on Twitter: bit.ly/ChapsasTwitter
Connect on LinkedIn: bit.ly/ChapsasLinkedIn
Keep coding merch: keepcoding.shop
#csharp #dotnet

[@eg8568]

This is such a helpful addition. I recently had to build whole identity system and whilst a lot of the heavy lifting was taken care for me by identity, I had to build the endpoints for generating & refreshing tokens, resetting user passwords, etc. This would have saved SO much of my time.

[@jessecalato4677]

@@ApheliontI'm seriously thinking about this right now.

[@eg8568]

@Apheliont I'd always recommend against implementing your own solution (and said so to my company!), but they didn't want to pay the license fee for Duende. Anyways, deep diving into Identity/Open ID was a good learning experience for me so I can't complain

[@Velociapcior]

@@eg8568 Azure has 50 000 MAU for free on B2C

[@virtualdars]

You are not alone.

[@HarrishSelvarajah]

@eg8568 Why did you not have a look at dunde ?

[@keesdewit1982]

@nickchapsas Please note that the default implementation of IdentityUser (used in this video) uses a string as Id which turns into a NVARCHAR(450) as primary key. This is terrible as it will lead to fragmentation because they don't insert records in a sequentially increasing order. This can lead to increased page splits and fragmentation within the database, potentially degrading performance over time as the database grows. To solve this and turn it into (for example) a integer primary key, the MyUser should inherit IdentityUser and the DbContext should inherit IdentityDbContext This will turn all primary keys into incrementing integers which are inserted in the right order.

[@josephizang6187]

This is perfect! I think Microsoft should prescribe the right way of doing things and leave it to devs to customize it in anyway they want. Nice video Nick

[@Paul-uo9sv]

November 14, 2023 ASP .NET Core 8, with its much-anticipated features and enhancements, is scheduled to be officially released on November 14, 2023

[@__a8as]

Is this thing secure?

[@PippiTheLongSock]

I would love to see how well these endpoints could be customized. For example, what if you want to have some custom fields when registering a user (first name, last name, etc). How can you modify the request body? You also need to override the underlying implementation of the given endpoint. Suggestion for you Nick: When all of the new improvements to the way we deal with identity are finally released in dotnet 8, can you create a full course on what would be the modern/recommended approach of working with identity. Because over the years there have been so many ways and it really has become confusing (especially for a beginner). Also, Microsoft have been pushing the Identity UI MVC (or was it actually razor pages, idk) built-in capabilities, which for me was a mistake as the industry is really moving away from the MPAs. I promise I would be the first to buy this course :) Edit: You can even collaborate with Anton from RawCoding because as you know he is very passionate about auth

[@10Totti]

Exact!

[@jomama55ful]

I have to agree. My learning experience with auth was painful at best and has led to a lot of confusion as to best practices. In the end I found using third party solutions was less painful as a rule.

[@mateuszkaleta1495]

That's the point

[@yessenzhol8989]

yeah! it's like a marketing feature😅 this is for programmers who like to compare programming languages by writing helloworld application )) loook, in python enough "print('hello')" in c# it needs so many codes like (class program { static void Main(string[] args) { Console.WriteLine('hello'); }😂😂

[@elpe21]

I guess you have to scaffold the endpoints and do what's necessary. Additional fields most likely is just a matter of adding properties as those endpoints will work on T where IdentityUser

[@jeffbarnard348]

This is great for small projects, but it's not OAuth2.0 and OIDC standardized. We'll still need to integrate OpenIddict or IdentityServer for full compliance

[@Jared-150]

I've been using OrchardCore just for its out of the box OpenIddict.

[@TheProTip]

My other comment got deleted because I linked the repo.. There is code in the Asp Net Core project for handling OIDC flows (including I believe opaque tokens). If you don't need to be an IdP it's all buried in there and you can scaffold out the UI and see the stuff in action via the Razor pages right now.

[@shanemonck3225]

second this, very correct

[@carson8417]

yeah they destroyed the authentication that we actually need

[@ExpensivePizza]

I literally just manually coded something like this a couple of weeks ago. This would have made things much easier. I would love to see more content around this topic on the different token types, how to integrate it with front end frameworks like React and Vue and different backend databases like MongoDB.

[@SnOrfus]

This is definitely great, and a move in the right direction. That said, in the enterprise, it’s extraordinarily rare to build authn as part of your API like this. You’re almost always integrating with a 3rd party IdP/oidc/saml, and that integration is equally annoying.

[@rzaip]

Yea, I was just thinking if this could replace IdentityServer and came to the same conclusion that this is mostly for single apps that doesn't require oidc or single sign on.

[@jerryjeremy4038]

I really like it. Thanks Nick. I hope you create a video about this in full details and features.

[@jeffjones9502]

This is awesome! After setting up auth so many times this will definitely help streamline and make the process easier.

[@saicharan1000]

I just needed this for what I am building. Thanks a lot.

[@alex.semeniuk]

Nick, you are doing a great job! Keep it up.

[@marijnfeijten]

For one of my projects I was looking into doing this myself and thought it would be a pain to setup. Then I saw that Microsoft was adding this and it looks really cool. Thanks for explaining yet another great topic!

[@luis1118]

Hope the new documentation will be clear about the addition of social login options 😬

[@todorkatsarski7487]

I loved that Doug reference. THIS is awesome content.

[@ZimTachyon]

You deliver excellent and relevant information which helped me a lot. Thank you.

[@fifty-plus]

Finally, I've been using this since it dropped instead of writing a ton of custom code. Very nice.

Looks great I just hope there is enough customization possible and (more important) that the documentation for customization is well written. Are there also razor pages/blazor templates for UI variants of the endpoints?

[@MaximilienNoal]

Finally ! It was such a headache.

[@thechrisgate]

True

[@sanampakuwal]

Yes

[@TheSpruut]

great video, thanks Nick

[@muzammilghani2492]

Great video Nick 👍🏻

[@jjeffh]

StartingAsync! I think that solves a problem (a dirty background service hack like you mentioned) for me. Thanks!!

[@tanglesites]

This is a game changer and such a time saver!

[@allenn9068]

Great intro to this new feature. Echoing questions about generating and customizing UI for AspNet, Blazor, or SPA frameworks. Wondering if there are templates to start with. Looks perfect for a simple personal web site that has auth for an admin area or customer/client features. Wondering if it can be used for a Generic Host as well as for a Web Host. Will have to try it. Looks good!

[@allothernameswherealreadytaken]

Fantastic! I wish they had implementet the passkey auth though.

[@atur94]

That is so freaking awesome. Finally

[@poojamahtha2780]

Wow ! Such a great video.

[@hemant-sathe]

It’s great to see the improvements and also encouraging to see David Fowler replying to questions. Loving it. Is it possible to set up an independent auth server with this to be shared across multiple services? Also does this work with other third party systems like social login and azure Active Directory? Can we map the user with any Active Directory attributes like email, name, groups etc?

[@Zenoc2]

+1 here wondering whether this can be used with an independent auth server for multiple services!

[@eg8568]

@marklnz why wouldn't you call the extension method to add the endpoints? Functionality such as resetting user passwords etc would likely still be needed

[@SlugiuesRex]

Also, are there any improvements in net8 that work more efficiently with Azure Functions ??

[@hemant-sathe]

@@marklnz I tend to favour Azure AD instead of local auth db. Azure B2B can be overkill at times but then you don't need to worry much about the authN functionality.

[@blackpaw29]

Really interesting, much more than I was expecting. Do you know how difficult it would be to link to an existing user database, rather than creating one from scratch?

[@virtualdars]

This is great! In this example the protected endpoint resides on the same Auth microservice (with RequireAuthorization()). Nick, can you please show us another sample of the separate API service that performs validation of the access tokens issued by this Auth service? Thank you!

[@drrd5145]

Would love to see that! I'm looking for an example in .NET8, where I have a service that is used for login/token authentication and other API (separated service) that will use the token to call the service. Looks like any example assumes that the services API are the SAME as the authentication API.

[@luigicfilho]

For my case, I'm going for another approach, because the token get exposed in the client, any script on the browser has access. This can be a great idea to do a new video about the "backend for frontend" :)

[@d0neall_]

What approach did you go for? Have a video?

[@luigicfilho]

@@d0neall_ I use the backend for frontend approach, I don't think there is an video about it it's pretty new

[@souleymanembengue5989]

Good but It would be better to implement standards OAuth and OIDC but Microsoft does prefer to sell Azure Active Directory...

[@leoravilo2812]

Oh god... I waited for that for so long... Finally !

[@antonmartyniuk]

Wow, that so much code I was writing before. It's so great. I wonder if any endpoint can be overriden with custom behaviour? And does this out of the box support refresh tokens if the same user is logged-in with multiple devices?

[@rogeriobarretto]

Is a great step forward. But the must annoying thing for me is the dictatorship on how my Authentication Tables needs to be setup (migrate). It is very common to change a new project where there's already a Database Model in place, some simple scenarios where there's only a Users table with Email and Password. Would be great if we were able to setup the Authentication in that Stupid Simple Lean approach (where you could specify what is the table and how complex you want your authentication to be, (include refresh tokens, hashed passwords, etc)

[@davidfowl]

You would want the auth system to work with any database schema? Or would you augment the schema for the identity system? I think a better solution would be to provide more building block when the database schema is fixed. Another option is the use the identity schema as standalone and link it to your user table via foreign keys.

[@dave7038]

Yup. Most of the systems I work on are 20+ years old and we don't have a lot of flexibility to update user stores (they are accessed or managed by many other systems). I have yet to work on a project where the built-in auth schemas are used. The direction I took was to create a class implementing Microsoft.AspNetCore.Identity.IUserPasswordStore and IUserLoginStore and a class implementing IRoleStore that I register as singletons and that handle interfacing with our user and role store (which in some cases is just an INI file with some username=scrambledPassword pairs under either [admin] or [user] keys), and then services.AddIdentity() connects my custom user and role stores with the identity system (I could probably also use the .AddRoleStore(), .AddUserStore() extensions on .AddIdentity()). We don't usually need the other features due to the nature of the systems we're working with, but implementing the stores for tokens and claims is similarly straightforward. That seems to work well, is very flexible, and fairly painless to set up. It would be great to have some guidance on how (or when/whether it makes sense) to integrate some of these newer options with custom stores that have limited feature sets.

[@nilswierling5899]

Hey! What do you think about CQRS Pattern with EF ? Any experiences on that topic? And is there maybe a Video comming from you about CQRS?

[@victor1882]

I wish they had gone with OpenIddict, but I guess they don't want another IdentityServer situation and that it would be a competitor to Azure AD (or Entra, I don't know anymore)

[@Paul-uo9sv]

That's great video. Thanks. November 14, 2023 ASP .NET Core 8, with its much-anticipated features and enhancements, is scheduled to be officially released on November 14, 2023

[@kagishophahlamohlaka2306]

This is mind blowing!!!

[@AceSyntaxx]

I'd appreciate some explanation of how this integrates with other identity providers, Facebook, X etc. This looks like oidc/oauth, but you say it's not JWT, which bothers me. Could you enlighten me?

[@kawamustudio]

Oidc and oauth protocols does not require token to be in JWT format.

[@mrkjartanvalur]

Is it possible to override e.g. the login method for custom logic like logging or add custom claims

[@keithealanta7790]

That's really useful. I wonder if there's an easy way to get it to use JWTs by default (I'm sure it's possible to rewrite overall, I'd just love to be able to set a flag for that, as we use JWTs in the rest of our system, and it would be ideal to maintain compatibility/)

[@RebelliousCanadian]

Love this update. Wonder how good this works with Swagger/OpenApi and more clarification between this and a JWT bearer tokens?

[@kabal911]

Will be seamless with Swagger, they are just endpoints. I’m guess that the difference is that this token is not base64url encoded, and does not contain client readable info, unlike a jwt

[@sikor02]

@@kabal911I don't see these endpoints in swagger edit: I had to add builder.Services.AddEndpointsApiExplorer(); builder.Services.AddControllers(); I worked on blazor dotnet 8 app and it wasn't included by default.

[@OldShoolGames]

Hey Nick, could you please make a video on limiting the bandwidth per user for file downloads in ASP ?

[@arkadiyshuvaev]

I like the advice regarding EF Core 8 at 2:57. How can I reduce the cold start of EF Core in a serverless application? I have used the Debug mode and seen EF Core context initialization messages. The context initialization took 800 milliseconds per each cold start serverless invocation.

[@brandonpearman9218]

I'm always worried about customization with black box magic because it looks simple until you use it in the real world. if I have to work on a system that implements this, how long will it take to figure out how to customize it. For example I may need to send an email on register, or maybe I need extra data on register to setup a relation to another entity.

[@benjamininkorea7016]

Well, i think the idea is that you can call the API from anywhere in your server-side logic.

[@WTHBrou]

How extendable is it? For instance, doing the classic step to use BCrypt or Argon instead of their default hash implementation? All it leaves is the authorization setup side to do? So far I find it pretty awesome. A huge facade made by Microsoft which certainly solves the complex setup it requires to properly create your own Identity Server. I don't remember how many times I have recalled to the documentation and guides when setting up one of these. Marvelous move done by Microsoft.

[@lukegordon4734]

Pretty easy to use bcrypt or argon2 with this. You just specify the password hashed singleton for the DI to use (I’ve done this for both already)

[@iSoldat]

Can the new auth changes accept the AD as a user store? if so, how about mapping membership groups or custom AD properties in claims?

[@microtech2448]

That's great that it is out of the box now. It would be nicer if it could be jwt format

[@TaiNguyen-gb1pr]

Great video! How to customize register endpoint, because maybe we need more field, ex: phone, avatar...?

[@nickchapsas]

Simply add the field on the user object

[@Daanik8]

I liked the humor! 😂 But hey Nick, it would be great if you show how to integrate this identity authentication and authorization with keycloak!

[@Ballebone]

Ha! I was going to beg for the same thing! All of our apps require KC use. Scopes and refresh are an added bonus!

[@GlebWritesCode]

Really helpful. Is there an option to get this working so that Identity endpoints are not in minimal API fashion?

[@mightypirate100]

Thanks for the video. Question: How to customise the register and login endpoints to accept user id instead of email? Thank you

[@cjt9150]

Good work. Can you please create a video for custom authentication with cookie/local storage/session storage & without identity

[@ethanford9678]

Love the Doug DeMuro reference :D

[@dyakobaram]

i wish they also made seeding admin accounts easier with roles and claims. can you make a video about it?

[@arjix8738]

If by seeding you are talking about creating the default admins, then you can do that before you run the app. You can manually create a scope and get the db context.

[@andrewcolleen1698]

@@arjix8738that’s problematic if your app is distributed

[@z_prospective160]

this is usually done via a post deployment script. if using ef core migrations you can do this in your db context class.. you can do this in your "OnModelCreating" method via the "HasData" method.

[@hevymetldude]

Love the Doug DeMuro cameo.

[@uflidd]

That was just a ton of tables and magic 😮

[@btogkas1]

What would be nice to have would be 1. Invalidating the token (one login, locking the user) 2. Ability to see online users. 3. Dynamic ACL based on user rights - role rights

[@parlor3115]

Does it support storing the user session in the database in case the token needs to be invalidated?

[@iron_spark]

Love it!

[@jiM3op]

yo nick... this is great! How would this work with Windows Authentication for like Intranet Web Applications?

[@EzequielRegaldo]

Where is the secret or cert? Can we change endpoints names? Can we choose features instead get all or nothing? Can i do an authentication server with this out of the box or integrate this ?

[@viniciusmelquiades]

C# has changed a lot since I last used it. If I ever go back to backend, I'll probably use C#

[@Spirch]

so i guess i will spend time at work to see if this can do what is missing in azure B2C, OBO / web api chain api

[@sergeitishkov2385]

Do they also allow devs to specify custom routes or at least a custom prefix for all the routes? Would be nice to have this as well.

[@AntiPolarity]

Hoping that they will integrate it into blazor

[@sokoo1978]

There will be a new scaffold for Blazor in .NET8 RC1.

[@sokoo1978]

@@marklnzIt will be obviously server rendered.

[@felipepassion]

thanks u.u @@sokoo1978

[@felipepassion]

you can try with webassembly. i was working with .ney7 with duende, ait it was a nightmare. then i can think now to replace the replacement that i used to replace duende 1 year ago in my server side. It's all about the server side. it's obvious.@@marklnz

[@sokoo1978]

@@marklnzI think you misunderstand.. RC1 will be able to create you the client template like MVC did before. It will have the basic functionality and pages/components to register, login, have the basic header with the auth and user info. In many applications this is actually good enough, like intranet apps where Windows user is not applicable. The logic is all server side (like hosted WASM in current version).

[@JKhalaf]

Can you please do a video on how to setup .NET 8 with AWS Cognito with the Blazor auth scaffolding pages?

[@user-ko7zs4gy3z]

This is a great iintro, thank you, but where is the signout URL? I can't find it in the source or the documentatioin

[@RasulAbuMuhammadAmin]

Looks great. Wonder can I do the same using JWT token.

[@SvdSinner]

How it will work with an enterprise identity server like Auth0?

[@LifeWithSeb99]

What's really helpful! What should I do if I don't need some of the endpoints? For example my API won't use 2 factor authentication

[@ryanobray1]

I think this is great simplification. I do have some questions though. First, is it safe to assume that .net 8 is using data protection under the hood for managing the certs used to mint the JWT? If so, is the only out-of-the-box way to implement this in such a way that it's cluster safe, to enable sticky sessions on the load balancer? I could see that becoming problematic with long living tokens though. I'm curious to know the best practice for implementing this in a cluster because unless Microsoft has added more options since I dug into it deeply, data protection isn't all that easy/reliable to implement in a cluster without just using sticky sessions. I once wrote my own SQL server solution for hosting dp keys, but it was difficult to avoid timing issues. I had to use locking techniques to prevent failures when all nodes in the cluster were spinning up at the same time. I had to role my own because the MS sql server dp provider didn't properly handle that very concern.

[@davidfowl]

1. It is using data protection yes. 2. The token is not a JWT, it's a different format. 3. If there are still timing issues with data protection providers, we'll need to fix them, these tokens are on top of that subsystem.

[@ryanobray1]

@@davidfowl Thanks for the response. I did catch in Nick's video that he said they aren't JWTs, but then the tokens in the login response looked a lot like what you get back in the OAuth OIDC client flow, so my brain went to JWTs. If I remember correctly, the easiest way to recreate the SQL Server DP provider timing issue was to stop all the nodes in the cluster, delete the DP keys from the database and then start the cluster. In my case, I was using Cloud Foundry with an app that I scaled up to something like 10 nodes. Even though I know the DP subsystem has some level of control around how nodes handle key rotation, I wanted to see what would happen if multiple nodes in the cluster were trying to create new keys at nearly the same time. The result in my test was that some nodes ended up with different DP keys than others because the SQL Server DP provider doesn't do any locking, which I believe could be necessary. The DP subsystem tries to get a key from the provider and if it doesn't exist, it tries having the provider write/save the one and then calls the get method again. If multiple nodes fail to get a key (because a write/save hasn't yet completed), each of those node's write/save key method will be hit, which can result in some nodes having different keys. It's pretty fringe case but was still concerning enough for me to write my own SQL provider for DP.

[@aslanamca8225]

Why not JWT?

[@ARumGremlin]

I would love to see a video on how to lock down an API with Azure AD authentication. I just went through the horror of doing it myself and the documentation for it is woefully confusing.

[@SaltySquirrel12]

+1. Would like to see this in action with Azure AD

[@hemant-sathe]

Normally you would have to create an app registration and provide the client id, tenant id & secret. Then you set it up for a 302 response instead of 401 and you are mostly done. Postman documentation is also decent to explain how to set it up and how to add the postman return url in the app registration. The set up for an app like angular can be messy though. I find having our own UI for login more complex to set up in a typical SPA + API scenario.

[@aremes]

it seems to me like this system is entirely designed for when you want to provide your own user-management/authentication solution. With AzureAD (or MS Entra, now, because i think Microsoft has a renaming-things fetish) you dont have to do any of that, You use good old OAuth2 with maybe a little OpenID sprinkled on top. And that stuff will *always* be confusing. I've implemented it, I've taught it, I've written documentation for it and trust me: "Simple" and "Authentication" just dont go together. You just cant secure an API using *any* identity provider without some serious requirements introspection (i.e. what clients do you want to support, what level of security, where does your config live, etc.

[@fabiolune]

Totally agree. In my (could be limited) experience, it's rarely a good idea to create a custom authentication system. On top of security, there's also a huge amount of regulation compliance that can easily become a nightmare. So, while I appreciate the effort, I don't think I will ever use it in this way: better to rely on some authentication provider using a robust standard.

[@eg8568]

I recently did this for a client and automated it via IaC / Bicep files. The documentation for both was dreadful and made it doubly confusing, I feel your pain.

[@HeyWhoTheFuckAreYou]

What about OpenIddict? Can they be used together or does this update fully cover OpenIddict functionality?

[@tedchirvasiu]

This does not look like OpenID

[@KonradGaska]

Just wondering how often would you really use it? In majority of current applications identity comes from external identity providers and you don't have to bother with stuff like user registration, etc. It is still cool that this was simplified though.

[@AhmedAymanM]

7:39 I love how you roasted microsoft, which created this auto refresh token generation, in 2 seconds 😂😂😂😂

[@xanhxanh5097]

Nick could you make a dometrain video on this how to set this up with react/angular and signing in with a social media account.

[@danku1013]

Is it possible to use JWT with that approach?

[@JoeLizFamily4]

Can this be connected to an outside service like Octa?

[@shahzshafie]

very helpful.. would like to know how .net8 can be integrated with a 3rd party IAM provider like Auth0...

[@_curtman]

Can't wait for .Net 8 to be released.

[@CryptoWulf_app]

This scenario is only intended for when your service also functions as an auth-service and not when you use an auth-provider like Azure AD/Azure AD B2C, right?

[@lucaciandrei]

Do you have info / video on how to set this up properly as a JWT? Is this also out of the box (configuration only)? Or should we add extra code for that?

[@jesperkped]

Can you show how to do it from a blazer wasm client calling the API?

[@dukefleed9525]

...a step in a right direction! Previous "web" authentication/authorization from Microsoft was very wrong. This is something better, but there is still a lot to improve. See, authentication/authorization can be done in a lot of different ways, the lack of usage of interfaces and also the fact that appears to be "all or nothing" is still quite wrong. A problem like authorization/authentication should be treated as much as orthogonal problems as possible. This requires a very profound redesign, and even if the proposed solution is very handy in simple scenario, i dubt it can be adopted for advanced things (imagine a system where the grants are added to the user and the UI have to respond in near real time using a gRPC channel with JWT bearer and an event sourced database as storage.... i dubt this thing could do it)

[@kamildobkowski2554]

hey, can you change default route of the actions? like for example instead of /login to login id like to use /api/login. Is it possible?

[@ModBay]

Game changer I think. 🎉

[@bitmanagent67]

This shit is still complicated. We would have never figured this out on our own. MSFT consistently convolutes approaches because they have this spaghetti against the wall mentality of refining features. Back in the day we used to have property panes and dialogs to configure options. The changes were made in the background for you. Now they basically said fk you to powerful tools and followed the rest of the open source community down the "type all your setup and config into a file" rabbit hole.

[@jason3898]

6:10 What plugin allows you to explore the sqlite db file like that?

[@mariomandzukic8676]

Hello do i need 2 set of bases for doing this? Or i can put all other domain models in that data base? I used to have models in one base for example blogs walks etc and other one was identitydb can i store it all in one? "identitydb" ? or does it comes only with user model

[@tibba69]

I really wish we could use EF Core but as far as I know, it does not support the database my company is stuck using - IBM for i or DB2 iSeries (or whatever it’s called these days). To make it worse we are stuck on version v5r4! 😢 Does anybody know if EF Core can be used for this as I haven’t been able to find anything for years.

[@sikor02]

adding few social login providers and merging that with local account would be nice. But I guess the 3rd party integration requires redirection at some point so no single API call will handle this, right?

[@kabal911]

This already is supported. If your identity username is the same as your social username (usually email address) then you can login with either. If they have different usernames, then you would need to do something to allow an authed user to then link a social account - which I haven’t tried, but should be simple enough

[@systemslave510]

Now how to make it work with dapper?

[@Silentsouls]

What about B2C integration ?

[@vasilisplavos]

Thank you so much Nick for your informative video. I was wondering, what options do we have if we want to sign in users with phone number or anonymously? Google is providing these options out of the box with a PaaS solution! Do we have something similar here?

[@user-ef8tm4es8m]

If you want to add custom business rules to the Identity API, how do you do that here? Where can the API be modified?

[@Pvyron]

Haven't tried it on a production app but wouldn't it cause breaking changes to existing custom auth setup?

[@mctechcraft7]

Can I use Dapper for this or do I have to use EF core

[@NikolaiKononov]

Will .Net 8 provide support for JsonDocumentPatch in System.Text.Json? How do you make the HttpPatch method in an API? Actually don`t wanna use newtonsoftjson