Third-party authentication

Allowing users to sign in using their existing credentials is often a great way to drive additional traffic to our applications, as demonstrated by a number of case studies by Google, Facebook, and Twitter.

As you might already know, ASP.NET Core Identity comes with a set of handy packages that will take care of that, saving ourselves from dealing with the relevant amount of complexity of the OAuth2 authentication flow that we saw back in Chapter 8, Authentication and Authorization. In this section, we'll demonstrate how we can use its built-in features to implement some external authentication mechanism using a widely known third-party provider such as Facebook.

OAuth2 authorization flow

Before we start, let's do a quick recap of how the OAuth2 authorization flow actually works for a standard web application:

1. The user asks the web application to login with the external provider X.
2. The web application prompts the user with a pop-up window containing a page directly...