Search code examples
angularasp.net-coreidentityserver4identitymodel

How to authenticate user from an asp.net core 3.0 / angular app and authorize the app for api access with IdentityServer4


I have already implemented this task for a WinForms application using IdentityModel.OidcClient and IdentitityServer4. Next task is to do it for angular. The docu of ID4 says that that native apps and SPAs can be handled with the same flow, the "authorization code" flow as Interactive Clients. So is it possible to use the first implemented dll (.net standard 2.0) from Angular? It uses the OidcClient for login in a System Browser, receives the redirected uri with code and finally get the access token from code.
Or should I use the JavaScript implementation of OAuth2.0, see oidc-client.js


Solution

  • The docu of ID4 says that that native apps and SPAs can be handled with the same flow, the "authorization code" flow as Interactive Clients

    You should use authorization code + PKCE. Without the latter you will need to use a client secret which will be exposed with your client code, and thats not what you want.

    So is it possible to use the first implemented dll (.net standard 2.0) from Angular?

    It is not possible to load and consume an assembly with javascript. They are two independent technologies. (just to be clear there's a new thing called webassembly that is starting to ship with browsers and will allow you to run assembly code on the browser, but this is off-topic)

    Or should I use the JavaScript implementation of OAuth2.0, see oidc-client.js

    Yes, you should use the Javascript implementation of OpenID Connect (which extends OAuth2.0) js client, and yes oidc-client-js by Brock Allen is the library you need to achieve this.