Migration guidance from ASP.NET Core Identity

[dan.woda]

Hi @rev23dev,

Thanks for reaching out and taking the time to write us such a detailed post. I am going to tackle everything I can here, but since there is plenty to unpack forgive me if I miss something.

Here we go!

@rev23dev

1. Let’s start with one of my bigger issues. I will obviously update the Winforms app to use the auth0 login flow. However, I have old users that are incapable of upgrading for various reasons so I need to keep this web service in place at least for a while. I planned to update my webservice to validate the username/password through the Auth0 API instead of my own database, but this seems like its been deprecated and no longer functional? Is that correct? This is problematic.

This is something that is going to require some research on my part, so we will revisit this. (This question may justify a new topic in and of itself.)

@rev23dev

2. New user wants to place an order from my ASP.NET Core website. They hit the auth0 login screen and register there. How do I instantly get them into my custom database? It looks like there are hooks and things, but I don’t really trust that in case something goes wrong. In the ASP.NET Core default templates, if you register or logon with a social connection, FB, Google, etc… after you authenticate it sends you to a “Great, you’ve authenticated, but now you need to create your account”. Is there such a sample for that? Is that the best way to go? Seems so… does anyone else have a similar implementation or another approach that works better?

• This can be done by redirecting users in a rule. It will require the user to enter information before continuing.

• You could also do as you say; redirect a user to a special login page after authentication and have them update information there.

@rev23dev

3. For existing users I’m thinking of just doing the bulk import from the import tool and forcing a password reset rather than the trickle migration? This isn’t really a question more of a thought. Has anyone done this and regretted it?

I have not performed a scaled bulk user import first hand, and I cannot speak from experience on that. This is precisely what the Community if for, and could require its own topic to poll experienced community members.

Outside of that, I can say there are several options for migrations. I would point you to this topic where I wrote on different strategies to accomplish a user migration. Generally, the route you take is going to be determined by your desired UX (to password reset or not to password reset, that is the question ).

@rev23dev

4. Password changes, profile updates, etc… do I just keep my existing ASP.NET Core pages in place for this and call to the Auth0 APIs to do this?

In short, yes. You can leverage the Management API and Authentication API to send a password change email, update profiles, and do this all from your application. You can also do it manually via the Auth0 Dashboard.The Management API can do virtually everything the dashboard can and more!

@rev23dev

5. For username/password logins (existing users), how do I let them add social connections so they can login with either/or? This is a current capability in ASP.NET Core Identity but don’t see a similar concept in Auth0.

Account Linking will allow your users to choose their preffered method. It uses email to link the accounts.

@rev23dev

6. Profile data. Where’s the “line” as far as what I should store in Auth0 vs my own db? First name, last name, etc… but I also have shipping addresses, billing addresses, gender, birthdate, “where’d you hear about us?”, obviously there will be some duplication in data such as name, but just curious where others have drawn the line as “this is what’s in Auth0, this is what’s in my CRM”

This is a blurred line, and it certainly gets crossed. According to our user_metadata/app_metadata docs, “We recommend against using these properties like a database. They should be used for identity related information.” If you think you would use something for authentication, in a rule hook etc., then it could be stored in user/app metadata. Take a look at the link for more information (although your judgment is going to be the final say).

@rev23dev

7. Importing users with social connections: It seems like you can’t import social. Is this something that can be added later? I have another app where there are users that only have social connections. I can pull this info cleanly to the bulk import tool but obviously need to import social connections. I’d like to move it to Auth0 as well but see a path unless this is possible.

If you were to import you users to a custom Auth0 DB, then turn on account linking, would this solve your problem? It does seem as if you cannot import social because of the ownership by an outside IDP.

Thanks for reading and please let me know if you have further questions.

Also one tip, if you break up your questions into individual topics they are typically easier and quicker for us to answer.

Thanks,
Dan