4

After a lot of reading and trial and error I got my target design working:

  1. IdentityServer4 (standalone with AspNetIdentity) with IdentityUser database
  2. MVC Client (standalone), this is the frontend to the users, no database link at the moment
  3. 1-n WebAPIs which serve the functionality to the MVC Client and have their own databases

At the moment I use an already existing IdentityUser database and point the IS4 to this database, added roles and claims manually for testing purpose.

My question is about best practice to register new users.

As the MVC Client is the frontend to the user, a link to the user registration should appear here.

But where is the registration technically done?

  1. Should I do it in the MVC Client (with the default IdentityUser Registration) and point the database to the IS4 database or
  2. should I add a register function in the IS4 app to keep the MVC Client free of any database dependencies and point the MVC Client "register" link to this IS4 register function?
4
  • If you mean everything related to user account and traditional AccountController, i.e. register, change password, lock/unlock/delete under Usermanagement, then the answer by @VidmantasBlazevicius is enough, Identityserver is the best place by consistency reasons. If however you mean access control, then look into the answer by @Ruard and put such stuff into a new app, not the one you already have for the business needs.
    – d_f
    Jun 18, 2019 at 17:33
  • Access control to controllers and the access of the client to the APIs is already implemented with IS4. It was really just about best practice where to put the user registration.
    – Igotcha
    Jun 19, 2019 at 13:31
  • so you marked the second answer as the best fitting your question and now you say your implementation is absolutely opposite to that's proven suggestions. strange of you, but that's all your choice : )
    – d_f
    Jun 19, 2019 at 13:51
  • I don't want to have a big discussion here. I wrote authentication and authorization is already implemented with IS4. This means that the [Authorize] attribute in the MVC client and in the WebAPIs works as intended - with IS4 functionality. My question was purely about where the user REGISTRATION should be implemented. And I got a suitable answer at the marked answer, to put the registration into the IS4 app.
    – Igotcha
    Jun 20, 2019 at 14:25

2 Answers 2

2

Basically IdentityServer has two responsibilities:

  1. Authenticate the user
  2. Authorize the client

The 'problem' with IdentityServer is that the user is not restricted to one application. While the MVC website may be your front, IdentityServer does not relate users to a particular application. Once authenticated, the user can access all applications that use IdentityServer as an authentication server.

So does it make sense to register the user on the MVC website? Probably not, because the user can access the (future) 'mvc2' website as well.

The creators of IdentityServer acknowledged this, so they created the PolicyServer:

We think that tightly coupling "Identity and Access Management" in a single solution is the wrong approach. These two concerns should be clearly separated.

In other words: authentication is part of IdentityServer, authorization (of the user) is not.

Getting back to the question, registration of the user should be managed by IdentityServer. Because that is the only application that has access to the Identity store. Besides, users can also register without being redirected by an application.

The key is how to manage the authorization (of the user). This isn't actually part of IdentityServer. I won't go into detail as this is outside the scope of the question.

But to answer your question, what I would do (including email verification, but without automatic login):

Add registration functionality to the IdentityServer and implement a ReturnUrl (like is already the case for login).

Add a link on your mvc website to the register function on IdentityServer. Let the user register in IdentityServer, send an email verification link which sends the user to the login page (persisting the return url), allowing the user to redirect back to the mvc website once registered and logged in.

How to add authorization to the registered user is a different question.

1
  • Thanks for your answer. As I said, I am able to do authentication and authorization within my design. This was really a question about where to do the user registration. And your answer seems plausible and that's the way I will go. Thanks!
    – Igotcha
    Jun 19, 2019 at 13:29
1

I would not use "User Management" and "User Registration" interchangeably. There is a lot more to user management than just registration. But to answer your question:

Should I do it in the MVC Client (with the default IdentityUser Registration) and point the database to the IS4 database or

You could, and there would not be anything terribly wrong with that. This will heavily depend on your business requirements, but most often I have seen "User Registration" built into the identity providers (your IdentityServer4 in this case).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.