Merge pull request #970 from DuendeSoftware/mb/pipeline

Clarify hosting guidance around UseAuthN/Z and update code snippets

Author: maartenba

src/content/docs/identityserver/fundamentals/hosting.md

@@ -13,16 +13,16 @@ You add the Duende IdentityServer engine to any ASP.NET Core application by addi
 dependency injection (DI) system and adding the middleware to the processing pipeline.
 
 :::note
-While technically you could share the ASP.NET Core host between Duende IdentityServer, clients or APIs. We recommend
+While technically you could share the ASP.NET Core host between Duende IdentityServer, clients or APIs, we recommend
 putting your IdentityServer into a separate application.
 :::
 
 ## Dependency Injection System
 
 You add the necessary services to the ASP.NET Core service provider by calling `AddIdentityServer` at application startup:
 
-```cs
-//Program.cs
+```csharp
+// Program.cs
 var idsvrBuilder = builder.Services.AddIdentityServer(options =>
 { 
     // ...
@@ -36,7 +36,7 @@ The builder object has a number of extension methods to add additional services
 You can see the full list in the [reference](/identityserver/reference/di.md) section, but very commonly you start by
 adding the configuration stores for clients and resources, e.g.:
 
-```cs
+```csharp
 //Program.cs
 var idsvrBuilder = builder.Services.AddIdentityServer()
     .AddInMemoryClients(Config.Clients)
@@ -47,11 +47,18 @@ var idsvrBuilder = builder.Services.AddIdentityServer()
 The above is using the in-memory stores, but we also support EntityFramework-based implementations and custom stores.
 See [here](/identityserver/data) for more information.
 
-## Request Pipeline
-
 :::note
-`UseIdentityServer` includes a call to `UseAuthentication`, so it’s not necessary to have both.
-:::
+The `AddIdentityServer` extensions method also adds the required authentication services (it calls `AddAuthentication` internally).
+If you want to configure the authentication options, or be explicit about which services are registered, you can use the
+`AddAuthentication` (and `AddAuthorization`) extension method directly:
+
+```csharp
+// Program.cs
+builder.Services.AddAuthentication();
+builder.Services.AddAuthorization();
+```
+
+## Request Pipeline
 
 You need to add the Duende IdentityServer middleware to the pipeline by calling `UseIdentityServer`.
 
@@ -60,8 +67,9 @@ files, but before the UI framework like MVC.
 
 This would be a very typical minimal pipeline:
 
-```cs
+```csharp
 //Program.cs
+var app = builder.Build();
 app.UseStaticFiles();
 
 app.UseRouting();
@@ -71,4 +79,11 @@ app.UseAuthorization();
 app.MapDefaultControllerRoute();
 ```
 
+:::note
+`UseIdentityServer` includes a call to `UseAuthentication`, so it’s not necessary to have both.
+
+
+However, IdentityServer does not include a call to `UseAuthorization`. You will need to add `UseAuthorization` (after `UseIdentityServer`/`UseAuthentication`) to include the authorization middleware into your pipeline. This will enable you to use various authorization features in your application.
 
+If you use the Duende UI template and its various pages, the use of `UseAuthorization` is required.
+:::