The authentication patterns made available by ASP.NET Core are basically the same as supported by the previous versions of ASP.NET:

• No authentication, if we don't feel like implementing anything or if we want to use (or develop) a self-made auth interface without relying upon the ASP.NET Core Identity system
• Individual user accounts, when we set up an internal database to store user data using the standard ASP.NET Identity interface
• Azure Active Directory, which implies using a token-based set of API calls handled by the Azure AD Authentication Library (ADAL)
• Windows authentication, only viable for local-scope applications within Windows domains or Active Directory trees

All these approaches--excluding the first one--are handled by ASP.NET Core Identity, a membership system that allows us to add authentication and authorization functionalities to our application. With ASP.NET Core Identity, we can easily implement a login mechanism that will allow our users to create an account and login with a username and a password. On top of that, we can also give them the chance to use an external login provider--as long as it's supported by the framework; as of today, the list of available providers includes Facebook, Google, Microsoft Account, Twitter, and more.