DB-First authentication confusion with ASP.NET Web API 2 + EF6

You say:

I want to implement a login/registration system (so that I can implement roles and permissions in the future, and restrict certain API requests).

How do I setup authentication in a Web API 2 application, having an existing user entity?

It definitely means that you DO NOT need ASP.NET Identity. ASP.NET Identity is a technology to handle all users stuffs. It actually does not "make" the authentication mechanism. ASP.NET Identity uses OWIN Authentication mechanism, which is another thing.

What you are looking for is not "how to use ASP.NET Identity with my existing Users table", but "How to configure OWIN Authentication using my existing Users table"

To use OWIN Auth follow these steps:

Install the packages:

OwinMicrosoft.AspNet.CorsMicrosoft.AspNet.WebApi.ClientMicrosoft.AspNet.WebApi.CoreMicrosoft.AspNet.WebApi.OwinMicrosoft.AspNet.WebApi.WebHostMicrosoft.OwinMicrosoft.Owin.CorsMicrosoft.Owin.Host.SystemWebMicrosoft.Owin.SecurityMicrosoft.Owin.Security.OAuth

Create Startup.cs file inside the root folder (example):

make sure that [assembly: OwinStartup] is correctly configured

[assembly: OwinStartup(typeof(YourProject.Startup))]namespace YourProject{    public class Startup    {        public void Configuration(IAppBuilder app)        {            var config = new HttpConfiguration();            //other configurations            ConfigureOAuth(app);            app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);            app.UseWebApi(config);        }        public void ConfigureOAuth(IAppBuilder app)        {            var oAuthServerOptions = new OAuthAuthorizationServerOptions()            {                AllowInsecureHttp = true,                TokenEndpointPath = new PathString("/api/security/token"),                AccessTokenExpireTimeSpan = TimeSpan.FromHours(2),                Provider = new AuthorizationServerProvider()            };            app.UseOAuthAuthorizationServer(oAuthServerOptions);            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());        }    }    public class AuthorizationServerProvider : OAuthAuthorizationServerProvider    {        public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)        {            context.Validated();        }        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)        {            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });            try            {                //retrieve your user from database. ex:                var user = await userService.Authenticate(context.UserName, context.Password);                var identity = new ClaimsIdentity(context.Options.AuthenticationType);                identity.AddClaim(new Claim(ClaimTypes.Name, user.Name));                identity.AddClaim(new Claim(ClaimTypes.Email, user.Email));                //roles example                var rolesTechnicalNamesUser = new List<string>();                if (user.Roles != null)                {                    rolesTechnicalNamesUser = user.Roles.Select(x => x.TechnicalName).ToList();                    foreach (var role in user.Roles)                        identity.AddClaim(new Claim(ClaimTypes.Role, role.TechnicalName));                }                var principal = new GenericPrincipal(identity, rolesTechnicalNamesUser.ToArray());                Thread.CurrentPrincipal = principal;                context.Validated(identity);            }            catch (Exception ex)            {                context.SetError("invalid_grant", "message");            }        }    }}

Use the [Authorize] attribute to authorize the actions.

Call api/security/token with GrantType, UserName, and Password to get the bearer token. Like this:

"grant_type=password&username=" + username + "&password=" password;

Send the token within the HttpHeader Authorization as Bearer "YOURTOKENHERE". Like this:

headers: { 'Authorization': 'Bearer ' + token }

Hope it helps!

Since your DB schema are not compatible with default UserStore You must implement your own UserStore and UserPasswordStore classes then inject them to UserManager. Consider this simple example:

First write your custom user class and implement IUser interface:

class User:IUser<int>{    public int ID {get;set;}    public string Username{get;set;}    public string Password_hash {get;set;}    // some other properties }

Now author your custom UserStore and IUserPasswordStore class like this:

public class MyUserStore : IUserStore<User>, IUserPasswordStore<User>{    private readonly MyDbContext _context;    public MyUserStore(MyDbContext context)    {        _context=context;    }    public Task CreateAsync(AppUser user)    {        // implement your desired logic such as        // _context.Users.Add(user);    }    public Task DeleteAsync(AppUser user)    {        // implement your desired logic    }    public Task<AppUser> FindByIdAsync(string userId)    {        // implement your desired logic    }    public Task<AppUser> FindByNameAsync(string userName)    {        // implement your desired logic    }    public Task UpdateAsync(AppUser user)    {        // implement your desired logic    }    public void Dispose()    {        // implement your desired logic    }    // Following 3 methods are needed for IUserPasswordStore    public Task<string> GetPasswordHashAsync(AppUser user)    {        // something like this:        return Task.FromResult(user.Password_hash);    }    public Task<bool> HasPasswordAsync(AppUser user)    {        return Task.FromResult(user.Password_hash != null);    }    public Task SetPasswordHashAsync(AppUser user, string passwordHash)    {        user.Password_hash = passwordHash;        return Task.FromResult(0);    }}

Now you have very own user store simply inject it to the user manager:

public class ApplicationUserManager: UserManager<User, int>{    public static ApplicationUserManager Create(IdentityFactoryOptions<ApplicationUserManager> options, IOwinContext context)    {         var manager = new ApplicationUserManager(new MyUserStore(context.Get<MyDbContext>()));         // rest of code    }}

Also please note you must directly inherit your DB Context class from DbContext not IdentityDbContext since you have implemented own user store.