Can someone please give me a brief explanation on how I can utilize ASP.NET Core Identity with an ASP.NET Core Angular 4 app using the AspNetCore Angular Spa template.
I fully setup IdentityServer4 as its own project and it is using ASP.NET Identity. I used the IdentityServer4 UI to create a few users. I now see these users in the AspNet tables in the database.
I added the ASP.NET Core Angular 4 app as a client to IdentityServer4. This way it can talk to it. I added an [Authorize] attribute to the HomeController so the Angular 4 pages can't be accessed unless logged in. The user is automatically flicked over to the IdentityServer4 to login. After they login they are flicked back to the Angular UI.
Now I want to take it a step further and say this user can only access this (authorization). Lets say I add a bunch of claims to one of the users in the database. The Service in Angular 4 makes a call to the Api to fetch data. I added an attribute like this to one of the methods in my api:
[Authorize(Policy = "Employees")]
When the Angular 4 service calls this method with http.get I am unable to access it. I believe this is because Angular 4 knows absolutely nothing about what claims this user has at this point. Is there a way to merge all of this so it works or am I stuck doing all authentication/authorization on the front-end with oidc-client.
Should I be using Roles based authorization? Claims based authorization? What would work best with an Api and Angular front-end?