ASP.NET Core Identity 9.0

Use these rules for ASP.NET Core Identity 9.0 after applying the included ASP.NET Core 9.0 baseline. The scope is local accounts, Identity stores and managers, password authentication, cookies, account tokens, external providers, MFA, and MapIdentityApi. Identity ships in the ASP.NET Core shared framework, so it takes the runtime's servicing updates, while Microsoft.AspNetCore.Identity.UI and Microsoft.AspNetCore.Identity.EntityFrameworkCore are separate packages that move only when you update them.

Identity setup and store invariants

• Register only the Identity feature set the product actually exposes. AddDefaultIdentity adds default UI and token providers, AddIdentity registers the configurable application/external/two-factor cookie stack, and AddIdentityApiEndpoints<TUser> activates both application cookies and proprietary bearer-token authentication.
• Apply IdentityOptions after the registration call and assert production values at startup. Confirmation checks default off, so enable SignIn.RequireConfirmedAccount or the exact email/phone requirement when an account must prove control before authentication.
• Use the stable Identity user ID for principals, audit records, ownership, and tenant joins. Email addresses, user names, external claims, and display names are mutable attributes and must not become authorization keys.
• Define a canonical login namespace and enforce it transactionally. RequireUniqueEmail is false by default; if email identifies an account, enable it and add an equivalent unique constraint over the normalized database