Using an external identity provider while login to the application is a quite common case. This enables us to log in with our external accounts like Google, Facebook, etc. By using ASP.NET Core Identity, we are going to see that this is not a hard process at all.

So, in this article, we are going to learn how to configure an external identity provider in our ASP.NET Core application and how to use a Google account to login to our application. Of course, in a very similar way, you can configure any other external account.

One important thing to know here. Once an external user logs in into our system, they will always bring an identifier that is unique for that user in our system. That user could have different Ids for different sites but for our site, that Id will always be the same.

To download the source code for this project, you can visit the External Identity Provider with ASP.NET Core Identity repository.

To navigate through the entire series, visit the ASP.NET Core Identity series page.

Let’s look at the basic navigation for this article:

So, let’s get on it.

Google API Platform

The first thing we have to do is to navigate to the Integrate Google Sign-In page. In the middle of the screen, we can see a blue Credentials page button with an additional explanation below it.

After clicking that button, we are going to be directed to the page for creating our credentials. If we don’t have any project created, we have to click on the CREATE PROJECT button at the top-right corner of the screen, add a project name, and click the create button.

Then in the Credentials menu, we have to configure a consent screen:

Consent Google

Choose the External user type:

Consent user type

And finally, add the name of the application, and click the Save button at the bottom of the screen:

App name for external provider

After that, we can navigate back to the credentials page:

Configuring google external identity provider

There we can click the create credentials link menu and choose the OAuth client ID.

Now, we have to choose the Application Type, Name, and add a redirect URIs for our application:

external identity provider OAuth client configuration

Once we click the Create button, we will get the ClientID and ClientSecret values. For now, just save them in a notepad file for example.

And that’s it. We can move on to the project configuration.

External Identity Provider configuration

Now, we are going to register Google as our external identity provider. To do that, we have to install the Microsoft.AspNetCore.Authentication.Google package first:

Google package

After the installation, we have to modify the appsettings.json file:

So, we just store our ClientId and ClientSecret values in a separate file. Of course, the better practice would be to store these values as a secret or environment variable, but for this example, the appsetting file will do just fine.

Now let’s configure Google as an external provider by modifying the ConfigureServices method:

The AddIdentity method configures default scheme settings. But the AddAuthentication allows configuring different authentication options, like Google for example. That’s why this method must be placed below the AddIdentity method.

Now, let’s create the _ExternalAuthentication partial view, to support external authentication:

By using the SignInManager.GetExternalAuthenticationSchemesAsync method, we fetch all the registered providers in our application. And if we find any, we show it in the view. So, in order to see these changes, let’s just include this partial view in the Login view:

Now, if we navigate to the Login view:

This looks great. Now, we can implement actions in the Account controller.

External Identity Provider Implementation

The form the _ExternalAuthentication partial view alreadt targets the ExternalLogin action. So we have to create it and add the required logic:

This is the action that we target by clicking the google button. It has two parameters: provider and returnUrl. If you take a look at the submit button code, you are going to see the name attribute with the provider value. Therefore, MVC will pair the value from that button to the provider parameter in this action. The second parameter is populated through the URI.

Inside the action, we create two variables: redirectUrl and properties. We assign the redirect address to the first variable and use the ConfigureExternalAuthenticationProperties method to create an object of type AuthenticationProperties that contains our provider and redirectUrl:

Authentication properties

After that, we return a challenge. With it, we challenge a user to provide an identity supplied by the provider, in this case, Google.

Of course, we have to implement the ExternalLoginCallback action.

Additional Implementation

So, let’s create a new action and add the required logic:

With the GetExternalLoginInfoAsync method, we collect exactly that – external login info. So the information like provider, given name, last name, email, name identifier, etc, are going to be provided in the info variable. If it’s not null we try to sign in a user with an external provider by using the ExternalLoginSignInAsync method. If this succeeds, we redirect the user to the Home or some other view.

On the other hand, if the account is locked out, we currently just redirect to the ForgotPassword view, but you can implement a different logic that suits your needs. Finally, if nothing checks out, we extract an email and the provider from the info variable and redirect the user to the ExternalLogin view, where they need to associate an external account to the existing one.

If you want users to manually enter their email address, you have to remove the Email property initialization in the ExternalLoginModel.

As you can see, we are missing some parts of this action. So, let’s add those.

ExternalLogin and ExternalLoginConfirmation Implementation

The first thing, we are going to do is to add the ExternalLoginModel class:

Then, we have to create a view:

There is nothing new in this view. But, you can see that once the user clicks the Submit button, they will be directed to the ExternalLoginConfirmation action, to either associate the account or create a new one if it doesn’t exist. Well, to support that logic, we need that action:

So, we first check for the model validity and check the external login info as in the previous action. Then, we try to get a user from the database. If exists, we just associate this external account with the existing one by adding another entry in the AspNetUserLogins table and sign in the user. But if we can’t find a user, we create a new one in the AspNetUsers table, connect the external account with the AddLoginAsync method and sing in that user. Of course, we didn’t want to repeat the same code, but you can extract the code for sending a confirmation email and adding a role to the user in the separate method and call it in here.

Finally, if something fails, we collect errors and return a view.

Testing the Solution

We are going to start with the existing user. So, after starting our application, we are going to navigate to the Login page and click the Google button. Once we do that, our challenge appears:

Challenge - external identity provider

After we click on the Testing Mail option, we are going to be redirected to the ExternalLogin view:

External login view

Once we click the Submit button, we will be logged in.

Now if we inspect the database:

Table check for user and provider

We can see the Google provider assigned to the codemazetest user. If you log out and log in again with the external account, you will be logged in as soon as you choose your external account. You will skip the external provider registration. Of course, this will be the case only if you set the bypassTwoFactor parameter to true. If that parameter is set to false, you would have to add additional logic in the ExternalLoginConfirmation action because it opens some different use cases. If you want, you can play a bit with the bypassTwoFactore parameter.

Additionally, if we remove our user from the database and then repeat the login process again, a new user is going to be created in the database and an external provider will be assigned. Of course, don’t forget to implement an email confirmation functionality.


So, that’s all it takes to configure and integrate an external identity provider into our ASP.NET Core application.

To sum up. We have learned:

  • How to configure our project with the Google API
  • The way to configure External Identity Provider in our application
  • How to implement External Identity Provider with actions and views

We hope you have enjoyed this article and the complete series as well.

If you have enjoyed reading this article and if you would like to receive the notifications about the freshly published .NET Core content we encourage you to subscribe to our blog.