.NET Aspire Blazor Identity Integration
Step 1 Project creation
Create Aspire Start App using Visual Studio 2026, for the Framework version select .NET 10.0
Step 2 Add libraries
Add nuget packages to the ApiService service backend project
<PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.0.3" />
<PackageReference Include="Microsoft.AspNetCore.Identity.UI" Version="10.0.3" />
<PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.3" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.3" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="10.0.3" />
<PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="10.0.2" />
Step 3 Setup database connection
Add connecting string to the appsettings.json in the backend project
"ConnectionStrings": {
"Dotnetl33t": "Data Source=.\\SQLEXPRESS;Database=Dotnetl33t;Trusted_Connection=True;MultipleActiveResultSets=true;Encrypt=False;"
}
Step 3 Create DbContext
Add Infrastracture folder to the ApiService backend project
Add DotnetLeetDbContext.cs file to the Infrastracture folder with following code:
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;
namespace DotnetLeetAspireBlazorIdentity.ApiService.Infrastracture
{
public class DotnetLeetDbContext : IdentityDbContext<IdentityUser>
{
public DotnetLeetDbContext(DbContextOptions<DotnetLeetDbContext> options)
: base(options)
{
}
}
}
Step 4 Add role and user seeder
Add EntitiesDbSeeder.cs to the Infrastracture folder in the ApiService backend project
Set following code in EntitiesDbSeeder.cs:
using Microsoft.AspNetCore.Identity;
using DotnetLeetAspireBlazorIdentity.Shared;
namespace DotnetLeetAspireBlazorIdentity.ApiService.Infrastracture.Seeders;
public static class EntitiesDbSeeder
{
public static async Task SeedRoles(IServiceProvider serviceProvider)
{
using var scope = serviceProvider.CreateScope();
var roleManager = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole>>();
var logger = scope.ServiceProvider.GetRequiredService<ILogger<DotnetLeetDbContext>>();
logger.LogInformation("Starting the role seed...");
// List of roles
var rolesToSeed = new List<string>
{
RolesEnum.Admin,
RolesEnum.Visitor
};
foreach (var roleName in rolesToSeed)
{
if (!await roleManager.RoleExistsAsync(roleName))
{
var result = await roleManager.CreateAsync(new IdentityRole { Name = roleName });
if (result.Succeeded)
{
logger.LogInformation($"Role '{roleName}' created ");
}
else
{
logger.LogError($"Error while creating the role '{roleName}': {string.Join(", ", result.Errors.Select(e => e.Description))}");
}
}
}
logger.LogInformation("Seeding roles completed");
}
public static async Task SeedUsers(IApplicationBuilder app, UserManager<IdentityUser> userManager)
{
var context = app.ApplicationServices
.CreateScope()
.ServiceProvider
.GetRequiredService<DotnetLeetDbContext>();
if (!context.Users.Any())
{
// Normal user
var normalUser = new IdentityUser
{
UserName = "normal@normal.com",
Email = "normal@normal.com",
EmailConfirmed = true
};
var normalUserResult = await userManager.CreateAsync(normalUser, "Pw12345!");
if (normalUserResult.Succeeded)
{
await userManager.AddToRoleAsync(normalUser, RolesEnum.Visitor);
}
// Admin user
var adminUser = new IdentityUser
{
UserName = "admin@admin.com",
Email = "admin@admin.com",
EmailConfirmed = true,
};
var adminUserResult = await userManager.CreateAsync(adminUser, "Pw12345!");
if (adminUserResult.Succeeded)
{
await userManager.AddToRoleAsync(adminUser, RolesEnum.Admin);
}
}
}
}
Step 5 Setup authentication, authorization, database seeder
Set following code in the backend Program.cs:
using DotnetLeetAspireBlazorIdentity.ApiService.Infrastracture;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using DotnetLeetAspireBlazorIdentity.ApiService.Infrastracture.Seeders;
var builder = WebApplication.CreateBuilder(args);
var keysPath = Path.Combine(builder.Environment.ContentRootPath, "..", "dpkeys");
builder.Services.AddDataProtection()
.PersistKeysToFileSystem(new DirectoryInfo(keysPath))
.SetApplicationName("DotnetLeetAspireBlazorIdentity");
// Add service defaults & Aspire client integrations
builder.AddServiceDefaults();
// Add services to the container
builder.Services.AddProblemDetails();
// Add the EF SQL database
builder.Services.AddDbContext<DotnetLeetDbContext>(options =>
options.UseSqlServer(builder.Configuration.GetConnectionString("Dotnetl33t")));
// ASP.NET Core Identity + embedded UI
builder.Services.AddDefaultIdentity<IdentityUser>(options =>
{
options.SignIn.RequireConfirmedAccount = false;
})
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<DotnetLeetDbContext>();
// Configuring the application cookie for authentication
builder.Services.ConfigureApplicationCookie(options =>
{
options.Cookie.Name = "DotnetLeetAspireBlazorIdentity.Auth";
options.LoginPath = "/Identity/Account/Login";
options.LogoutPath = "/Identity/Account/Logout";
options.AccessDeniedPath = "/Identity/Account/AccessDenied";
options.SlidingExpiration = true;
});
// Razor Pages for Identity UI
builder.Services.AddRazorPages();
builder.Services.AddControllers();
// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
builder.Services.AddOpenApi();
var app = builder.Build();
// setting up auth and authorization middlewares
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseExceptionHandler();
if (app.Environment.IsDevelopment())
{
app.MapOpenApi();
var scopeFactory = app.Services.GetRequiredService<IServiceScopeFactory>();
using var scope = scopeFactory.CreateScope();
var userManager = scope.ServiceProvider.GetRequiredService<UserManager<IdentityUser>>();
await EntitiesDbSeeder.SeedRoles(app.Services);
await EntitiesDbSeeder.SeedUsers(app, userManager);
}
app.MapDefaultEndpoints();
app.MapControllers();
app.MapRazorPages();
app.Run();
Step 6 Create shared library
Add class library and name it DotnetLeetAspireBlazorIdentity.Shared to the project
Add the project reference in the DotnetLeetAspireBlazorIdentity.ApiService
Add the project reference in the DotnetLeetAspireBlazorIdentity.Web
Add RolesEnum class with following code:
public class RolesEnum
{
public const string Admin = "Admin";
public const string Visitor = "Visitor";
}
Step 7 Create database
Make sure you have dotnet tools installed
Execute EF tools commands in the DotnetLeetAspireBlazorIdentity.ApiService project
dotnet ef migrations add init_dotnet_leet_database
dotnet ef database update
Step 7 Scaffold identity
Add Identity to the backend project
Right click on the ApiService project
Select Add -> Select New Scaffholded Item..
In the open window on the left side select Identity, than click Add on right side
In the open window on the top left side select override all files
For DbContext class select previosuly added DotnetLeetDbContext from the infrastracture folder
Click Add and wait for some time for Scaffolding to be preformed
Step 8 Create AuthTestontroller
In the backend project create Presentation folder
Add AuthTestController.cs with following code:
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace DotnetLeetAspireBlazorIdentity.ApiService.Presentation;
[ApiController]
[Route("api/[controller]")]
public class AuthTestController : ControllerBase
{
// Public endpoint
[HttpGet("public-endpoint-check")]
public IActionResult GetLoggedoutCheck()
{
return Ok(new
{
Message = $"Hello, {User.Identity?.Name}, you can fetch from public endpoint.",
Time = DateTime.UtcNow
});
}
// All users that are logged
[HttpGet("protected-logged-in-users-endpoint-check")]
[Authorize]
public IActionResult GetLoggedInData()
{
return Ok(new
{
Message = $"Hello, {User.Identity?.Name}, you can fetch from auhtorized endpoint.",
Time = DateTime.UtcNow
});
}
// Only Admin role
[HttpGet("protected-admin-user-endpoint-check")]
[Authorize(Roles = "Admin")]
public IActionResult GetAdminData()
{
return Ok(new
{
Message = $"Hello, {User.Identity?.Name}, you can fetch from admin role protected endpoint.",
Time = DateTime.UtcNow
});
}
}
Step 9 Authentication handler in Blazor
Add Authentication folder in the Web project
Add AuthenticatedApiHandler.cs with following code:
namespace DotnetLeetAspireBlazorIdentity.Web.Authentication
{
public class AuthenticatedApiHandler : DelegatingHandler
{
private readonly IHttpContextAccessor _httpContextAccessor;
public AuthenticatedApiHandler(IHttpContextAccessor httpContextAccessor)
{
_httpContextAccessor = httpContextAccessor;
}
protected override Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
var context = _httpContextAccessor.HttpContext;
if (context != null && context.Request.Cookies.TryGetValue("DotnetLeetAspireBlazorIdentity.Auth", out var cookieValue))
{
request.Headers.Remove("Cookie");
request.Headers.Add("Cookie", $"DotnetLeetAspireBlazorIdentity.Auth={cookieValue}");
}
return base.SendAsync(request, cancellationToken);
}
}
}
Step 10 Authentication handler in Blazor
Add Authentication folder in the Web project
Add AuthenticatedApiHandler.cs with following code:
namespace DotnetLeetAspireBlazorIdentity.Web.Authentication
{
public class AuthenticatedApiHandler : DelegatingHandler
{
private readonly IHttpContextAccessor _httpContextAccessor;
public AuthenticatedApiHandler(IHttpContextAccessor httpContextAccessor)
{
_httpContextAccessor = httpContextAccessor;
}
protected override Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
var context = _httpContextAccessor.HttpContext;
if (context != null && context.Request.Cookies.TryGetValue("DotnetLeetAspireBlazorIdentity.Auth", out var cookieValue))
{
request.Headers.Remove("Cookie");
request.Headers.Add("Cookie", $"DotnetLeetAspireBlazorIdentity.Auth={cookieValue}");
}
return base.SendAsync(request, cancellationToken);
}
}
}
Step 11 Create HTTP layer
To the Web project add Shared folder
To the Shared folder add Services folder
To the Services folder add Implementation and Interface folders
In the Interface folder add IApiClient.cs with following code:
using System.Net;
namespace DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Interface;
public interface IApiClient
{
Task<ApiResult<T>> GetAsync<T>(string url) where T : class;
}
// TODO move it shared, and reuse it on both layers backend and frontend
public class ApiResult<T>
{
public bool IsSuccess { get; set; }
public HttpStatusCode StatusCode { get; set; }
public T? Data { get; set; }
public string? Error { get; set; }
}
In the Service folder add ApiClient.cs with following code:
using DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Interface;
namespace DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Implementation;
using System.Net.Http.Json;
public class ApiClient : IApiClient
{
private readonly HttpClient _httpClient;
public ApiClient(HttpClient httpClient)
{
_httpClient = httpClient;
}
public async Task<ApiResult<T>> GetAsync<T>(string url) where T : class
{
var result = new ApiResult<T>();
try
{
var response = await _httpClient.GetAsync(url);
result.StatusCode = response.StatusCode;
result.IsSuccess = response.IsSuccessStatusCode;
if (response.IsSuccessStatusCode)
{
result.Data = await response.Content.ReadFromJsonAsync<T>();
}
else
{
result.Error = await response.Content.ReadAsStringAsync();
}
}
catch (Exception ex)
{
result.IsSuccess = false;
result.StatusCode = 0;
result.Error = ex.Message;
}
return result;
}
}
In the Service folder add ApiClient.cs with following code:
using DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Interface;
namespace DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Implementation;
using System.Net.Http.Json;
public class ApiClient : IApiClient
{
private readonly HttpClient _httpClient;
public ApiClient(HttpClient httpClient)
{
_httpClient = httpClient;
}
public async Task<ApiResult<T>> GetAsync<T>(string url) where T : class
{
var result = new ApiResult<T>();
try
{
var response = await _httpClient.GetAsync(url);
result.StatusCode = response.StatusCode;
result.IsSuccess = response.IsSuccessStatusCode;
if (response.IsSuccessStatusCode)
{
result.Data = await response.Content.ReadFromJsonAsync<T>();
}
else
{
result.Error = await response.Content.ReadAsStringAsync();
}
}
catch (Exception ex)
{
result.IsSuccess = false;
result.StatusCode = 0;
result.Error = ex.Message;
}
return result;
}
}
Step 12 Create AuthTests.razor
Add AuthTests.razor component to the Pages folder with following code:
@page "/auth-test"
@rendermode InteractiveServer
@using System.Net
@using System.Diagnostics
@using DotnetLeetAspireBlazorIdentity.Shared.AuthCheckDtos
@using DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Interface
@using Microsoft.AspNetCore.Components.Authorization
@inject IApiClient Api
@inject AuthenticationStateProvider AuthStateProvider
<h3>Authentication & Authorization Demo</h3>
@if (_pageLoading)
{
<p>Loading authentication state...</p>
}
else
{
<!-- USER STATE -->
<div class="card mb-3">
<div class="card-body">
<h5>Current User</h5>
<div><b>Authenticated:</b> @(_isAuthenticated ? "Yes" : "No")</div>
<div><b>User:</b> @(_userName ?? "-")</div>
<div><b>Roles:</b> @(_roles.Count == 0 ? "-" : string.Join(", ", _roles) )</div>
</div>
</div>
<div class="row g-3">
<!-- PUBLIC -->
<div class="col-md-4">
<div class="card p-3">
<h5>Public Endpoint</h5>
<button class="btn btn-primary mb-2"
@onclick="() => RunTest(_public)"
disabled="@_public.Loading">
@(_public.Loading ? "Calling..." : "Test")
</button>
@TestResultBlock(_public)
</div>
</div>
<!-- AUTHORIZED -->
<div class="col-md-4">
<div class="card p-3">
<h5>Authorized Endpoint</h5>
<button class="btn btn-primary mb-2"
@onclick="() => RunTest(_authorized)"
disabled="@_authorized.Loading">
@(_authorized.Loading ? "Calling..." : "Test")
</button>
@TestResultBlock(_authorized)
</div>
</div>
<!-- ADMIN -->
<div class="col-md-4">
<div class="card p-3">
<h5>Admin Endpoint</h5>
<button class="btn btn-primary mb-2"
@onclick="() => RunTest(_admin)"
disabled="@_admin.Loading">
@(_admin.Loading ? "Calling..." : "Test")
</button>
@TestResultBlock(_admin)
</div>
</div>
</div>
<div class="alert alert-info mt-4">
<b>401</b> = Not authenticated.<br />
<b>403</b> = Authenticated but missing required role.
</div>
}
@code {
// ---------- PAGE STATE ----------
private bool _pageLoading = true;
private bool _isAuthenticated;
private string? _userName;
private List<string> _roles = new();
// ---------- ENDPOINT STATES ----------
private TestState _public = new("api/authtest/public-endpoint-check");
private TestState _authorized = new("api/authtest/protected-logged-in-users-endpoint-check");
private TestState _admin = new("api/authtest/protected-admin-user-endpoint-check");
protected override async Task OnInitializedAsync()
{
await LoadAuthState();
_pageLoading = false;
}
private async Task LoadAuthState()
{
var authState = await AuthStateProvider.GetAuthenticationStateAsync();
var user = authState.User;
_isAuthenticated = user.Identity?.IsAuthenticated == true;
_userName = user.Identity?.Name;
_roles = user.Claims
.Where(c => c.Type.Contains("role"))
.Select(c => c.Value)
.Distinct()
.ToList();
}
// ---------- CORE RUNNER ----------
private async Task RunTest(TestState state)
{
state.ResetForRun();
var sw = Stopwatch.StartNew();
var result = await Api.GetAsync<AuthCheckResponse>(state.Endpoint);
sw.Stop();
state.DurationMs = sw.ElapsedMilliseconds;
state.HasResult = true;
state.Loading = false;
state.StatusCode = result.StatusCode;
state.IsSuccess = result.IsSuccess;
if (result.IsSuccess)
{
state.Message = result.Data?.Message ?? "Success";
}
else
{
state.Message = result.Error ?? "Request failed.";
}
StateHasChanged();
}
// ---------- RESULT BLOCK ----------
private RenderFragment TestResultBlock(TestState state) =>
@<div>
@if (!state.HasResult)
{
<div class="text-muted">No result yet.</div>
}
else
{
<div class="mb-2">
<span class="badge @(state.IsSuccess ? "bg-success" : "bg-danger")">
@state.StatusLabel
</span>
<span class="ms-2 small text-muted">Duration: @state.DurationMs ms</span>
</div>
<div class="@(state.IsSuccess ? "text-success" : "text-danger")">
@state.Message
</div>
@if (state.StatusCode == HttpStatusCode.Unauthorized)
{
<div class="text-muted small mt-2">
401: You are not authenticated.
</div>
}
else if (state.StatusCode == HttpStatusCode.Forbidden)
{
<div class="text-muted small mt-2">
403: You are authenticated but missing required role.
</div>
}
}
</div>;
// ---------- MODEL ----------
private class TestState
{
public TestState(string endpoint)
{
Endpoint = endpoint;
}
public string Endpoint { get; }
public bool Loading { get; set; }
public bool HasResult { get; set; }
public bool IsSuccess { get; set; }
public long DurationMs { get; set; }
public HttpStatusCode StatusCode { get; set; }
public string? Message { get; set; }
public string StatusLabel =>
$""{(int)StatusCode} {StatusCode}"";
public void ResetForRun()
{
Loading = true;
HasResult = false;
IsSuccess = false;
DurationMs = 0;
StatusCode = 0;
Message = null;
}
}
}
Step 13 Change NavMenu.razor in Web project
Set the following code for the NavMenu razor component:
@using Microsoft.AspNetCore.Components.Authorization
@inject NavigationManager Nav
<div class="top-row ps-3 navbar navbar-dark">
<div class="container-fluid">
<a class="navbar-brand" href="">DotnetLeetAspireBlazorIdentity</a>
</div>
</div>
<input type="checkbox" title="Navigation menu" class="navbar-toggler" />
<div class="nav-scrollable" onclick="document.querySelector('.navbar-toggler').click()">
<nav class="nav flex-column">
<div class="nav-item px-3">
<NavLink class="nav-link" href="" Match="NavLinkMatch.All">
<span class="bi bi-house-door-fill" aria-hidden="true"></span> Home
</NavLink>
</div>
<div class="nav-item px-3">
<NavLink class="nav-link" href="/auth-test">
<span class="bi bi-gear-fill" aria-hidden="true"></span> Auth test
</NavLink>
</div>
<AuthorizeView>
<NotAuthorized>
<div class="nav-item px-3">
<a class="nav-link" href="@GetLoginUrl()">
<span class="bi bi-box-arrow-in-right" aria-hidden="true"></span> Login
</a>
</div>
<div class="nav-item px-3">
<a class="nav-link" href="@GetRegisterUrl()">
<span class="bi bi-person-plus-fill" aria-hidden="true"></span> Register
</a>
</div>
</NotAuthorized>
<Authorized>
<div class="nav-item px-3">
<a class="nav-link" href="@GetLogoutUrl()">
<span class="bi bi-box-arrow-right" aria-hidden="true"></span> Logout
</a>
</div>
<div class="nav-item px-3">
<a class="nav-link" href="@GetProfileUrl()">
<span class="bi bi-person-circle" aria-hidden="true"></span> Profile
</a>
</div>
</Authorized>
</AuthorizeView>
</nav>
</div>
@code {
private string ApiBaseUrl => "https://localhost:7436";
private string GetReturnUrl()
=> Uri.EscapeDataString(Nav.Uri);
private string GetLoginUrl()
=> $""{ApiBaseUrl}/Identity/Account/Login?returnUrl={GetReturnUrl()}"";
private string GetRegisterUrl()
=> $""{ApiBaseUrl}/Identity/Account/Register?returnUrl={GetReturnUrl()}"";
private string GetProfileUrl()
=> $""{ApiBaseUrl}/Identity/Account/Manage/Index?returnUrl={GetReturnUrl()}"";
private string GetLogoutUrl()
=> $""{ApiBaseUrl}/Identity/Account/Logout?returnUrl={GetReturnUrl()}"";
}
Step 14 Change Program.cs in Web project
Set the following code for the Program class:
using DotnetLeetAspireBlazorIdentity.Web.Authentication;
using DotnetLeetAspireBlazorIdentity.Web.Components;
using DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Implementation;
using DotnetLeetAspireBlazorIdentity.Web.Shared.Services.Interface;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Identity;
var builder = WebApplication.CreateBuilder(args);
// Shared DataProtection
var keysPath = Path.Combine(builder.Environment.ContentRootPath, "..", "dpkeys");
builder.Services.AddDataProtection()
.PersistKeysToFileSystem(new DirectoryInfo(keysPath))
.SetApplicationName("DotnetLeetAspireBlazorIdentity");
// Add service defaults & Aspire client integrations.
builder.AddServiceDefaults();
builder.AddRedisOutputCache("cache");
// Auth + roles - Uses Identity.Application schema
builder.Services
.AddAuthentication(IdentityConstants.ApplicationScheme)
.AddCookie(IdentityConstants.ApplicationScheme, options =>
{
options.Cookie.Name = "DotnetLeetAspireBlazorIdentity.Auth"; // same as in ApiService
});
builder.Services.AddAuthorization();
// Add services to the container.
builder.Services.AddRazorComponents()
.AddInteractiveServerComponents();
builder.Services.AddCascadingAuthenticationState();
builder.Services.AddHttpContextAccessor();
builder.Services.AddTransient<AuthenticatedApiHandler>();
builder.Services.AddHttpClient<IApiClient, ApiClient>(client =>
{
client.BaseAddress = new Uri("https+http://apiservice");
}).AddHttpMessageHandler<AuthenticatedApiHandler>();
var app = builder.Build();
if (!app.Environment.IsDevelopment())
{
app.UseExceptionHandler("/Error", createScopeForErrors: true);
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseAntiforgery();
app.UseOutputCache();
app.UseAuthentication();
app.UseAuthorization();
app.MapStaticAssets();
app.MapRazorComponents<App>()
.AddInteractiveServerRenderMode();
app.MapDefaultEndpoints();
app.Run();
More posts
- Start With a Loosely Coupled Monolith
- When a DTO Is Worth Writing: Composition, Boundaries and CQRS with MediatR
- 5 Rules for Writing Better DTOs in .NET (and the Most Common Traps)
← All posts
·
RSS
© 2026 DotNET Leet