Build a CRM on ASP.NET Core Web API

This walkthrough builds a multi-tenant CRM on ASP.NET Core Web API, secured end to end with B5 Secure. By the end you’ll have credential authentication, email verification, and contact management authorized by activity-based, data-aware authorization (ADA).

Step 1 — Install & register

Add the B5 Secure packages for ASP.NET Core Web API and register the framework. Registration wires the security pipeline into the request lifecycle so every request is verified by default.

// Program.cs
services.AddB5SecurityKit(o => o.UseEntityFramework<AppDb>());
app.UseB5SecurityKit();

Step 2 — Credential-based authentication

Authenticate a user with their credentials and issue an identity token. B5 Secure validates the identity, applies IP-firewall and origin checks, and establishes the security context for the request.

Step 3 — Email verification

Mark accounts unverified until they confirm their email. The pipeline blocks protected actions for unverified identities automatically; use VerificationNotRequired to exempt the verification endpoints themselves.

Step 4 — Contact management with ADA

Protect your CRUD operations. With ADA, the authenticated identity must possess an explicit permit for this action and be permitted on this record — with almost no application code.

[Protect]
[Permission("contact.update")]
[AuthEntity(typeof(Contact))]
[HttpPut]
public OpResult Update(UpdateContact req) { ... }

Step 5 — Interaction recording

Add a child entity (interactions logged against a contact) and extend ADA to it. This reinforces least privilege: a user who can read a contact may not be permitted to record interactions unless granted that permit.