Remove IdentityServer from angular template

[halter73]

• Use default Identity UI with cookies instead

Contributes to dotnet/aspnetcore#47226

[mkArtakMSFT]

Thanks @halter73!
I'll let the experts review this.

[javiercn]

Overall looks good. There are some open questions and changes/regressions in the user experience that are worth talking about:

• Is there no way to know when you are authenticated or not? Isn't it confusing that you log in, come back to the app, and you see no visual change?
• What happens with all the state the app has before we redirect? Do we throw it all out?
• Why are we removing the authorize guard? That's meant to ensure you are authenticated when you access some areas of the page.
• How do you log out in the template?
• Where are we wiring up Antiforgery?

[halter73]

Is there no way to know when you are authenticated or not? Isn't it confusing that you log in, come back to the app, and you see no visual change?

Nope. Currently the best we can do with just cookie auth and the default Identity UI is detect the redirect. Later, MapIdentityApi will provide a way to detect this which we will provide samples for. Eventually it would be nice to update these project templates to use it and not use the default Identity UI razor pages at all, but it's not ready yet.

What happens with all the state the app has before we redirect? Do we throw it all out?

Yes.

Why are we removing the authorize guard? That's meant to ensure you are authenticated when you access some areas of the page.

Because we have no way to know if we're authenticated or not.

How do you log out in the template?

You click the "Account" link in the nav bar. And then click "Logout" on the /Identity/Account/Manage page.

Where are we wiring up Antiforgery?

It's not explicit. This is just the default Identity UI razor pages. I can confirm that the __RequestVerificationToken is rendered though.