I am in the unfortuate position that I have inherited applications using all of the authorisation ideas from Microsoft to date. So I have:
- Webforms (.NET 4.6) using ASP.NET Membership
- MVC 5 (.NET 4.6) using ASP.NET Identity
- MVC .Core (.NET Core 2.x) ASP.NET Core Identity
All of these are using the old roles based authorisation (not claims based). With a view towards .NET Core 3.x and .NET 5 I am looking for a way to consolidate and future proof things.
I know I am not alone and that I can migrate everything to identity.
In the short term none of the Webforms, MVC 5, MVC .Net Core applications are going away. Everything will move to .NET Core 3 / .NET 5 in the medium term. So my questions are:
- Do I bite the bullet and migrate everything to ASP.NET Core 2.0 Identity and then to ASP.NET Core 3.0 Identity when it arrives? Or can I use "some other solution" that is independent of this treadmill. I have looked at Identity Server but the complexity there scares me (and backward support for WebForms)
- Whatever the solution in 1. I need the end result to be single sign on so if I authenticate with any of the apps that the authentication token is passed around. (I have done this for ASP.NET Membership
- The webform applications make heavy use of SiteMapProvider so I need to be able to plug that into whatever is chosen above.
- What should concern me moving from roles based authentication to claims based authentication?
I am looking for any suggested solutions from anyone who has faced these issues and implemented a workable solution.