Bot Framework Rest API Authentication

First of all, ASP.NET Core doesn't have support for Membership anymore, you would have to use Identity.

I recently came across such requirement myself as our applications were growing and, each time, we had to implement membership/identity for each of them.

The solution i came up with was to build a centralized authentication server which will accept user credentials, connect to database, authenticate the credentials and generate/return tokens (JWT). This token will serve the purpose of both authentication and authorization through claims. Only this application/server will implement identity.

On any client application with protected resources (Authorize), they would have to implement a middleware which will read the token and validate the claims. There is no requirement for the middleware to connect to the database again to validate the claims. This token will be appended to the Authorization header every time a request is made to a protected resource.

Every time you create a new application which will use the same authentication server, all you need to do is to implement/inject the validation middleware. There is no need to re-implement identity again.

Refer below resources for basics & implementation details.

References:

1. https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity
2. https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims
3. https://stormpath.com/blog/token-authentication-asp-net-core
4. https://jwt.io/

Additional Resources once you are through with the basics:

1. https://stackoverflow.com/questions/18223868/how-to-encrypt-jwt-security-token/44195678#comment75530351_44195678
2. https://stackoverflow.com/questions/44179525/asp-net-core-jwt-bearer-token-custom-validation/44320206#44320206