Authentication and authorization affect the way that the ASP.NET Core request pipeline is defined. Your Web API needs to check each request to see if it is authenticated, and then see if the requested action is authorized for the authenticated user. If any of these steps fail, we want the API to respond with a meaningful response. To make the necessary modifications to the Web API pipeline, we need to enable the identity infrastructure in the application's startup class. Here are the steps we perform to enable identities in the GiveNTake application:

1. Add the following lines to the ConfigureService method:

    services.AddIdentity<User, IdentityRole>()
        .AddEntityFrameworkStores<GiveNTakeContext>()
        .AddDefaultTokenProviders();

These lines configure the application to recognize that User identities are defined by the User entity, roles are defined by the IdentityRole entity (part of the Microsoft.Extensions.Identity package), and that GiveNTakeContext is the DbContext class that holds all the identity data.

2. Add the following statement to the Configure method:

    app.UseAuthentication();

This code will add the authentication middleware to the pipeline and enable authentication capabilities.

At this point, you have an backend application that is aware of authentication, but we still need to configure the authentication technique we want to use. ASP.NET Core supports all of the standard and common ways of authentication, such as cookie-based authentication, token-based authentication, Windows Authentication, OAuth, and so on. In this book, we are using a token-based authentication system with JWT tokens, but you can later add other authentication types or providers. For more details, see the Microsoft identity authentication documentation, available at https://docs.microsoft.com/en-us/aspnet/core/security/authentication/social/.