I have to develop a website (web app) using ASP.net core.
Background:
It preliminary uses Asp.Net core 3.1, but it may change to Asp.net core 6. (For backend & front end) I tried to use JwtBearer
There is an REST API for JWT authentication (owned by the others). I would like to adopt it for authenticating the user name & password
The webapp will receive the token from the REST API. The token will be stored in the session and refresh the token within a certain period.
I could retrieve some basic user's info in the token. But i want to add some extra info (e.g. role) for authorization
Issue: I found the most tutorials about the web api only.
So, i have no idea how could develop the part of authorization. How to build the customize claims after receiving the token.
For the above scenario, i have read some examples about using OpenIdConnect. Should i use OpenIdConnect instead of JwtBearer?
Thanks