We Keep Coding

Jwt token authentication in ASP.NET Core

I am building an ASP.NET Core web app and Angular and I want to secure it using token-based authentication. I am relatively new to the authentication mechanism, so have few clarifications.
I have decided to go about using jwt token based authentication using this tutorial link
https://medium.com/c-sharp-progarmming/asp-net-core-5-jwt-authentication-tutorial-with-example-api-aa59e80d02da
I also came across another tutorial which explains token based using authentication using owin
https://www.c-sharpcorner.com/UploadFile/ff2f08/token-based-authentication-using-Asp-Net-web-api-owin-and-i/
Now my question is which protocol does the link1 implement? Is it OWIN? Do we need a separate server for maintaining something called OAuth Authorization framework as explained in link2.
What's the difference between OWIN, OAuth and Identity and are all these concepts internally used if I follow link1 and secure the application using jwt token based authentication?

OWIN Is a Middleware and OAuth is the protocol. if you are using .NET core or .NET 5, try to use .NET core middleware for authentication/authorization. Follow First Link (Medium)
If you need a fully fledge Identity Server then you have to create a separate Identity server if you want only token things you can just implement them on your project, but recommended approach is to create a server for identity management.

Does ASP.NET Core feature a built-in OAuth2 token exchange?

I'm building an ASP.NET Core application and using FusionAuth as my authentication server. I'm trying to implement this authorization grant workflow, with an SPA using JWT bearer tokens. To summarize, once the user authenticates with FusionAuth, the frontend is supposed to redirect to the backend server with an authorization code. My backend server then needs to receive this code at a special endpoint. Inside this endpoint it will perform a call to FusionAuth again, but this time with the client secret which only the server will possess. In turn, FusionAuth will send back an authorization token in the form of a JWT and a refresh token, which my server then needs to return back to the frontend.
I've looked at the .AddOAuth method, and having read the code it seems capable of performing the token exchange. However, it also has a lot of logic involving challenges and login/logout. This makes me think it's supposed to be used for cookie-based server-side authentication, like you would find with Razor pages.
All I want to do is set up my server to be this authentication intermediary. It looks like .AddOAuth() might do this for me, but it may not be intended for this purpose. I can't find any examples of folks using .AddJwt(...) and .AddOAuth(...) in conjunction. Is there a mechanism in ASP.NET Core that performs the token exchange?

Have you tried using IdentityModel? It's not part of ASP.NET Core, but it is open source. I found it useful when implementing the authorization code grant in ASP.NET core.
Here is some documentation that may be helpful:
https://identitymodel.readthedocs.io/en/latest/aspnetcore/web.html

The short answer is yes - see Introduction to Identity on Asp.NET CORE. There are lots of flavors of OAuth 2, which means it can be configured in many ways. You will need to read the docs.

Authentication Between Web API, Web App and Mobile App

I have three application Web API, MVC Application(Web App), Java Native App(Mobile App). I need to authenticate my web app and mobile app from web api. So which authentication is best for this scenario?
Please help me, I have experience of developing on MVC Application but with Web API it is new for me and for same android which is also new to me?

I would suggest the following read: https://learn.microsoft.com/en-us/dotnet/architecture/microservices/secure-net-microservices-web-applications/
It will provide you with different authentication and authorization options. You might opt to use social identity server like Google or Facebook, or go with your own identity provider. In both cases the protocols you need to know about are:
Check out what openid connect is: https://openid.net/connect/
OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol. It allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server, as well as to obtain basic profile information about the End-User in an interoperable and REST-like manner.
Check out what oauth 2.0 is: https://oauth.net/2/
OAuth 2.0 is the industry-standard protocol for authorization. OAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices.
For web app SPA use the implicit grant
For native apps, great read here: https://www.oauth.com/oauth2-servers/oauth-native-apps/
The current industry best practice is to use the Authorization Flow while omitting the client secret, and to use an external user agent to complete the flow.
Last but not least, if you want to create your own identity provider you can use the open source identity server for both openid connect and oauth2: https://learn.microsoft.com/en-us/dotnet/architecture/cloud-native/identity-server

I suggest for you to use web tokens and to implement it in your Web API project, i encourage you to see these series of videos to do that, It's describe how to implement JWT in Asp.net Core Web API project:
ASP.NET Core Authentication with JWT (JSON Web Token)
ASP.NET Core Authentication with Custom Handler
Role-based Authorization in ASP.Net Core (With Custom Authentication Handler)
Policy-based Authorization in ASP.Net Core (with Custom Authorization Handler)
JWT Refresh Token in ASP.Net Core (a deep dive)
That series will help you to build JWT in your Web API, And if you want to implement OAuth 2.0 and OpenID you can read the guideline for the protocol and you'll implement by your own, It's not default to implement.
[EDIT]
you can use Microsoft.AspNetCore.Authentication.OpenIdConnect for OpenID after seeing that series, and this Article will be helpful .NET Core 2.x native OpenID Connect example

.NET Core Web API Authentication and .NET Identity

I recently took over a .NET core MVC project and have to extend it with an API. For authentication .NET core Identity is used. Coming from swift iOS/Mac development i started a demo project getting into it and doing some basic authentication.
When reading up on the identity on Microsofts Docs they foucs on WebApps. So my questions are:
Should i use identity for API authentication or is it just for internal identity Management and WebApp stuff?
Does identity/.NET core already offer me jwt and e.g. basic auth to initially obtain the jwt or do i have to create a lot myself?
My Goal rn is to just create jwt-auth protected routes and to be able to get a jwt with a username and a password.

ASP.NET Core Identity isn't suitable for guarding APIs, usage of other identity providers is directed by the Docs:
ASP.NET Core Identity adds user interface (UI) login functionality to
ASP.NET Core web apps. To secure web APIs and SPAs, use one of the
following:
Azure Active Directory
Azure Active Directory B2C (Azure AD B2C)
IdentityServer4
and as per the previous link:
IdentityServer4 is an OpenID Connect and OAuth 2.0 framework for
ASP.NET Core. IdentityServer4 enables the following security features:
Authentication as a Service (AaaS)
Single sign-on/off (SSO) over multiple application types
Access control for APIs
Federation Gateway
So you will need to go with IdentityServer4

You should use identity server4 for this.
Refer a simple example of identity server 4 to protect client with token.
identity-server4 simple example
There are a lot more things you will have to understand refer identity server 4 official doc.
Moreover you can also follow step by step identity server setup video tutorial.

MVC + WebApi. Authorization and Authentication

I have an ASP.NET MVC project and a Web Api project (separate projects). Access to the database is fully realized through Web Api (including authorization and authentication). ASP.NET MVC is a client, Web Api is a server.
So, how to correctly implement authorization and authentication in the ASP.NET MVC project (on the client side)? I read a lot how this is implemented in Web Api (through a token), but I can not understand how to correctly use this token in ASP.NET MVC.
Realize wrap for each request? I also do not know how to define the user role in ASP.NET MVC. Maybe there is some way to rewrite standard methods of ASP.NET MVC authorization to work with the Web Api token? Will the Authorize attributes on the ASP.NET MVC client side work? Suggest please in an example of such an implementation if possible, or tell me how best to implement it.

First of all if you are not in production yet, it might be time to jump to .Net Core 2.x. It does not separate Web API and MVC underground and it's up to date technology.If, for some reason, you can't upgrade the framework, then yes, employ Microsoft.Owin, Microsoft.Owin.Security.OpenIdConnect and all the dependencies.OIdC defines two types of tokens: Identity token, describing a user and Authorization token, giving access to API. There should be some Identity Provider in the system, authenticating users and authorizing clients (such as your MVC APP). Such provider could be external (Google, Office 365 etc), or internal -- you can use free Identity Server 4.x implementation and adjust it to feet your needs. You could even build the IdP into your app.The flow for both .Net Core and Owin OIdC implementations should be identical:
You register all your apps (API and MVC in Identity provider)
User requests an MVC resource, OIdC middleware redirects him to IdP.
IdP authenticates the user issuing identity and access tokens.
MVC validates the Identity token and uses it to create a local Authentication cookie, so the user becomes authenticated in the app.
MVC controller calls some API and put into the request access token, requested from IdP.
API validates the token and responds with requested data.

I would recommend you to use OWIN interface to implement token based authentication for web api and MVC. You should provide authentication token in your web api and give ability to deserialize the token in MVC and Web Api. So, you can find an example open source project here which I developed it about how can you implement token based authentication with OWIN for Web api.
For MVC project, you should follow the same practice by using OWIN.

The best way is to use Azure active directory authentication if active directory is configured for using your application. You can get more info here