User Roles and Authentication

This guide explains the authentication system, user registration, and role-based access control in the Tournament Management App.

Authentication Overview

The Tournament Management App uses ASP.NET Core Identity for authentication and authorization. This provides:

Secure user registration and login
Password-based authentication
Email confirmation
Account lockout protection
Future support for external authentication providers

User Access Levels

The application has two main access levels:

Public (Unauthenticated) Users

Can:

View teams, players, and matches
Use search and filter features
Access detail pages for all entities
Browse all public information

Cannot:

Create new teams, players, or matches
Edit existing records
Delete any entities

Authenticated Users

Can:

Everything public users can do, plus:
Create new teams, players, and matches
Edit existing records
Delete entities (subject to business rules)
Access all management features

Currently, the application uses a simple authenticated/unauthenticated model. All authenticated users have the same permissions. Role-based access control (admin, manager, viewer) can be added in future versions.

Creating an Account

Navigate to Register

Click Registrarse (Register) in the navigation menu or on the login page.

Fill in registration details

Enter the required information:

Email: Your email address (used as username)
Password: Choose a secure password
Confirm Password: Re-enter your password

Submit registration

Click Registrarse (Register) to create your account.

Confirm your email

Check your email inbox for a confirmation message and follow the link to confirm your account.

You must confirm your email address before you can log in. This is a security requirement.

Password Requirements

For security, passwords must meet the following criteria:

Minimum length: 6 characters
Require digit: At least one number (0-9)
Require lowercase: At least one lowercase letter (a-z)
Require uppercase: At least one uppercase letter (A-Z)
Require non-alphanumeric: At least one special character (!@#$%^&*, etc.)
Unique characters: At least 1 unique character

Password1!
MyP@ssw0rd
Secure#123

Password Best Practices:

Use a unique password for this application
Consider using a password manager
Mix different character types throughout the password
Avoid common words or personal information

Logging In

Navigate to Login

Click Iniciar sesión (Login) in the navigation menu.

Enter credentials

Provide your:

Email: Your registered email address
Password: Your account password

Optional: Remember me

Check Recordarme (Remember me) to stay logged in on this device.

Only use “Remember me” on personal devices. Don’t use it on shared or public computers.

Click Login

Click Iniciar sesión to access your account.

From the login page, you can also:

¿Olvidó su contraseña? (Forgot password): Reset your password
Registrarse como usuario nuevo (Register as new user): Create an account
Reenviar correo de confirmación (Resend confirmation email): Get a new confirmation link

Account Security Features

Account Lockout

To prevent brute-force attacks, the system includes account lockout:

Maximum failed attempts: 5 failed login attempts
Lockout duration: 5 minutes
Applies to: All users, including new accounts

If you enter the wrong password 5 times, your account will be locked for 5 minutes. Wait for the lockout period to expire before trying again.

Email Confirmation

Email confirmation is required for security:

Confirms you own the email address
Prevents automated account creation
Required before you can log in
Confirmation links can be resent if needed

Didn't receive confirmation email?

If you didn’t receive the confirmation email:

Check your spam/junk folder
Verify you entered the correct email address
Click “Reenviar correo de confirmación” on the login page
Wait a few minutes and check again
Contact support if issues persist

Protected Pages and Features

The following pages and features require authentication:

Team Management

Creating teams: /Equipos/Create
Editing teams: /Equipos/Edit
Deleting teams: Delete button on /Equipos/Index

Player Management

Creating players: /Jugadores/Create
Editing players: /Jugadores/Edit
Deleting players: Delete button on /Jugadores/Index

Match Management

Creating matches: /Partidos/Create
Editing matches: /Partidos/Edit
Deleting matches: Delete button on /Partidos/Index

Other Protected Areas

Creating municipalities: /Municipios/Create
Creating positions: /Posiciones/Create
Creating technical directors: /DTs/Create
All edit and delete operations

Protected pages are decorated with the [Authorize] attribute in the code. Attempting to access these without logging in will redirect you to the login page.

UI Changes Based on Authentication

The user interface adapts based on your login status:

When Not Logged In

Create buttons are hidden
Edit buttons appear disabled (outlined)
Delete buttons appear disabled (outlined)
You can only view and browse data

Create buttons are visible and active
Edit buttons are enabled and clickable
Delete buttons are enabled (subject to business rules)
Full CRUD (Create, Read, Update, Delete) operations available

Logging Out

To log out of your account:

Click Cerrar sesión (Logout) in the navigation menu
Confirm the logout action
You’ll be redirected to the home page

Always log out when using shared or public computers to protect your account.

Future Authentication Features

The application is prepared for future authentication enhancements:

External Authentication Providers (Planned)

The codebase includes commented-out configuration for:

Google authentication
Facebook authentication
Microsoft account authentication

These features can be enabled in future releases by:

Obtaining API credentials from the providers
Adding credentials to configuration
Uncommenting the code in Program.cs

External authentication code preview

// Future configuration in Program.cs:
builder.Services.AddAuthentication()
   .AddGoogle(options =>
   {
       options.ClientId = config["Authentication:Google:ClientId"];
       options.ClientSecret = config["Authentication:Google:ClientSecret"];
   })
   .AddFacebook(options =>
   {
       options.ClientId = config["Authentication:FB:ClientId"];
       options.ClientSecret = config["Authentication:FB:ClientSecret"];
   })
   .AddMicrosoftAccount(options =>
   {
       options.ClientId = config["Authentication:Microsoft:ClientId"];
       options.ClientSecret = config["Authentication:Microsoft:ClientSecret"];
   });

When enabled, you’ll be able to log in using your existing Google, Facebook, or Microsoft accounts.

Troubleshooting

Cannot access create/edit features

Solution: Log in to your account. These features require authentication.

Account locked after failed login attempts

Cannot log in - email not confirmed

Solution:

Check your email for the confirmation link
Click “Reenviar correo de confirmación” to get a new link
Confirm your email before logging in

Password doesn't meet requirements

Solution: Ensure your password has:

At least 6 characters
At least one uppercase letter
At least one lowercase letter
At least one number
At least one special character (!@#$%^&*, etc.)

Forgot password

Solution:

Click “¿Olvidó su contraseña?” on the login page
Enter your email address
Check your email for password reset instructions
Follow the link to set a new password

Logged out unexpectedly

Possible causes:

Session timeout due to inactivity
Browser cookies cleared
Application restarted

Solution: Simply log in again.

Technical Implementation Details

For developers and administrators:

Identity Configuration

The application uses ASP.NET Core Identity with:

Database: SQLite (via Entity Framework Core)
Context: IdentityDataContext
User type: IdentityUser (default implementation)
Connection string: Environment variable DATABASE_CONNECTION_STRING or default path

Data Protection

User data is protected using:

builder.Services.AddDataProtection()
    .PersistKeysToDbContext<IdentityDataContext>()
    .SetApplicationName("TorneoApp");

This ensures encryption keys are persisted to the database for consistent encryption across application restarts.

Middleware Pipeline

The authentication flow uses:

app.UseAuthentication();  // Identifies the user
app.UseAuthorization();   // Checks permissions

These must be called in this order after routing but before endpoint mapping.

Managing Teams - Learn about team management features
Managing Players - Player management guide
Scheduling Matches - Match scheduling guide

Get Started

Core Features

Deployment

Guides

Authentication Overview

User Access Levels

Public (Unauthenticated) Users

Authenticated Users

Creating an Account

Password Requirements

Logging In

Account Security Features

Account Lockout

Email Confirmation

Protected Pages and Features

Team Management

Player Management

Match Management

Other Protected Areas

UI Changes Based on Authentication

When Not Logged In

When Logged In

Logging Out

Future Authentication Features

External Authentication Providers (Planned)

Troubleshooting

Technical Implementation Details

Identity Configuration

Data Protection

Middleware Pipeline

Build docs developers (and LLMs) love

Get Started

Core Features

Deployment

Guides

​Authentication Overview

​User Access Levels

​Public (Unauthenticated) Users

​Authenticated Users

​Creating an Account

​Password Requirements

​Logging In

​Login Options

​Account Security Features

​Account Lockout

​Email Confirmation

​Protected Pages and Features

​Team Management

​Player Management

​Match Management

​Other Protected Areas

​UI Changes Based on Authentication

​When Not Logged In

​When Logged In

​Logging Out

​Future Authentication Features

​External Authentication Providers (Planned)

​Troubleshooting

​Technical Implementation Details

​Identity Configuration

​Data Protection

​Middleware Pipeline

​Related Guides

Build docs developers (and LLMs) love

Authentication Overview

User Access Levels

Public (Unauthenticated) Users

Authenticated Users

Creating an Account

Password Requirements

Logging In

Login Options

Account Security Features

Account Lockout

Email Confirmation

Protected Pages and Features

Team Management

Player Management

Match Management

Other Protected Areas

UI Changes Based on Authentication

When Not Logged In

When Logged In

Logging Out

Future Authentication Features

External Authentication Providers (Planned)

Troubleshooting

Technical Implementation Details

Identity Configuration

Data Protection

Middleware Pipeline

Related Guides