i am trying to integrate Identity Server 4 with Ocelot and authenticate WebApp (asp.net core 3.1) then access the api if request is authenticated.
for this i have created a solution having
I have added [Authorize] attribute to one of action method in homecontroller in webapp.
all above are running in docker with docker compose.
What i am able to
What i am not able to
/connect/authorize/callback?client_id=MS.UI&redirect_uri=http%3A%2F%2Flocalhost%3A5003%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20sampleapi.read%20offline_access&response_mode=form_post&nonce=637311085925185701.MDBmN2IyNGYtYmJkNC00ODYxLWI4YTktZGZkNmUwOGNlOTI1ZTEzM2NjYjUtZjFmNC00OWFlLWJjODItNzdiZjI4MzU5OWYy&state=CfDJ8Lknm9JCWslNlbQ0xWa8fYKwi1rc-EosZtMFuCBrWuQouhK03IW5FLqKl2zjaMjUGbpl8INF4Ro2mtbe1ZODEBX8kKMi6IbHd1Dcfft9jeTCfSUBGigFm_f3vqHnGnc7TkAs_9BiFUlYNs0Cbc1xNNIXteRlLVo_aYqXzJMtnL_ZY8bk0AadRj8fx50rMDq68XVQ6tqYbx_MCAya5DGljux3UyDz8nAuS27dWoUI1hsUJ3SFC61iLqe7HHMDRyIOc3puZoDXnJOeR36xDuLiFQk8yXfmQ3L7SCNm63ZcJBGnMpZyLiUgZA-T2iBDzDriEw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.5.0.0
IdentityService Cofig.cs
// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
using IdentityServer4;
using IdentityServer4.Models;
using System.Collections.Generic;
namespace IdentityServer
{
public static class Config
{
private const string SampleAPI_Secret = "tT1CCYyY7P";
public static IEnumerable<IdentityResource> IdentityResources =>
new IdentityResource[]
{
new IdentityResources.OpenId()
};
public static IEnumerable<ApiScope> ApiScopes =>
new ApiScope[]
{
new ApiScope("sampleapi.read","Read your data"),
new ApiScope("sampleapi.write","Write your data"),
new ApiScope("sampleapi.delete","Delete your data")
};
public static IEnumerable<ApiResource> ApiResources =>
new List<ApiResource>
{
new ApiResource("sampleAPI", "Sample API"){
Scopes = { "sampleapi.read", "sampleapi.write", "sampleapi.delete" },
}
};
public static IEnumerable<Client> Clients =>
new Client[]
{
new Client(){
ClientId = "MS.UI",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
AllowOfflineAccess = true,
ClientSecrets = { new Secret("z71C0PyDjR".Sha256()) },
RedirectUris ={"http://localhost:5003/signin-oidc" },
PostLogoutRedirectUris = { "http://localhost:5003"},
FrontChannelLogoutUri = "http://localhost:5003/signout-oidc",
AllowedScopes = {
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
IdentityServerConstants.StandardScopes.Email,
"sampleapi.read",
"sampleapi"
},
AllowAccessTokensViaBrowser = true,
RequirePkce =false
},
};
}
}
StartUp.cs
// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
using IdentityServer4;
using IdentityServer4.Models;
using System.Collections.Generic;
namespace IdentityServer
{
public static class Config
{
private const string SampleAPI_Secret = "tT1CCYyY7P";
public static IEnumerable<IdentityResource> IdentityResources =>
new IdentityResource[]
{
new IdentityResources.OpenId()
};
public static IEnumerable<ApiScope> ApiScopes =>
new ApiScope[]
{
new ApiScope("sampleapi.read","Read your data"),
new ApiScope("sampleapi.write","Write your data"),
new ApiScope("sampleapi.delete","Delete your data")
};
public static IEnumerable<ApiResource> ApiResources =>
new List<ApiResource>
{
new ApiResource("sampleAPI", "Sample API"){
Scopes = { "sampleapi.read", "sampleapi.write", "sampleapi.delete" },
}
};
public static IEnumerable<Client> Clients =>
new Client[]
{
new Client(){
ClientId = "MS.UI",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
AllowOfflineAccess = true,
ClientSecrets = { new Secret("z71C0PyDjR".Sha256()) },
RedirectUris ={"http://localhost:5003/signin-oidc" },
PostLogoutRedirectUris = { "http://localhost:5003"},
FrontChannelLogoutUri = "http://localhost:5003/signout-oidc",
AllowedScopes = {
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
IdentityServerConstants.StandardScopes.Email,
"sampleapi.read",
"sampleapi"
},
AllowAccessTokensViaBrowser = true,
RequirePkce =false
},
};
}
}
MS.UI - Web Application Client
StartUp.cs
using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.AspNetCore.Authentication;
using IdentityModel;
using Microsoft.AspNetCore.Http;
namespace MS.UI
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.Configure<CookiePolicyOptions>(options=> {
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
});
services.AddControllersWithViews();
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
services.AddAuthentication(options =>
{
Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
options.DefaultScheme = "Cookies";
options.DefaultChallengeScheme = "oidc";
}).AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
options.Authority = "http://localhost:5002";
options.MetadataAddress = "http://identityserver/.well-known/openid-configuration";
options.RequireHttpsMetadata = false;
options.Events.OnRedirectToIdentityProvider = context =>
{
// Intercept the redirection so the browser navigates to the right URL in your host
context.ProtocolMessage.IssuerAddress = "http://localhost:5002/connect/authorize";
return Task.CompletedTask;
};
options.SignInScheme = "Cookies";
options.ClientId = "MS.UI";
options.ClientSecret = "z71C0PyDjR";
options.ResponseType = "code id_token";
//options.UsePkce = true;
options.SaveTokens = true;
//options.GetClaimsFromUserInfoEndpoint = true;
options.Scope.Clear();
options.Scope.Add("profile");
options.Scope.Add("sampleapi.read");
options.Scope.Add("offline_access");
});
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.UseHsts();
}
//app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseCookiePolicy();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute(
name: "default",
pattern: "{controller=Home}/{action=Index}/{id?}");
});
}
}
}
Modified View
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>@ViewData["Title"] - MS.UI</title>
<link rel="stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.min.css" />
<link rel="stylesheet" href="~/css/site.css" />
</head>
<body>
<header>
<nav class="navbar navbar-expand-sm navbar-toggleable-sm navbar-light bg-white border-bottom box-shadow mb-3">
<div class="container">
<a class="navbar-brand" asp-area="" asp-controller="Home" asp-action="Index">MS.UI</a>
<button class="navbar-toggler" type="button" data-toggle="collapse" data-target=".navbar-collapse" aria-controls="navbarSupportedContent"
aria-expanded="false" aria-label="Toggle navigation">
<span class="navbar-toggler-icon"></span>
</button>
<div class="navbar-collapse collapse d-sm-inline-flex flex-sm-row-reverse">
<ul class="navbar-nav flex-grow-1">
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="Index">Home</a>
</li>
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="Privacy">Privacy</a>
</li>
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Secure" asp-action="Secure">Secure</a>
</li>
</ul>
</div>
</div>
</nav>
</header>
<div class="container">
<main role="main" class="pb-3">
@RenderBody()
</main>
</div>
<footer class="border-top footer text-muted">
<div class="container">
© 2020 - MS.UI - <a asp-area="" asp-controller="Home" asp-action="Privacy">Privacy</a>
</div>
</footer>
<script src="~/lib/jquery/dist/jquery.min.js"></script>
<script src="~/lib/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
<script src="~/js/site.js" asp-append-version="true"></script>
@RenderSection("Scripts", required: false)
</body>
</html>
In above file i just added
<li class="nav-item">
<a class="nav-link text-dark" asp-area="" asp-controller="Secure" asp-action="Secure">Secure</a>
</li>
HomeController.cs
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using MS.UI.Models;
namespace MS.UI.Controllers
{
public class HomeController : Controller
{
private readonly ILogger<HomeController> _logger;
public HomeController(ILogger<HomeController> logger)
{
_logger = logger;
}
public IActionResult Index()
{
return View();
}
[Authorize]
public IActionResult Privacy()
{
return View();
}
[ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
public IActionResult Error()
{
return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
}
[Authorize]
public IActionResult Secure()
{
ViewData["Message"] = "Secure page.";
return View();
}
}
}
in above file i have added
[Authorize]
public IActionResult Privacy()
{
return View();
}
Gateway StartUp.cs
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using IdentityServer4.AccessTokenValidation;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using Ocelot.DependencyInjection;
using Ocelot.Middleware;
namespace MS.Gateway
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
var authenticationProviderKey = "TestKey";
Action<IdentityServerAuthenticationOptions> options = o =>
{
o.RequireHttpsMetadata = false;
o.Authority = "http://identityserver";
o.ApiName = "sampleAPI";
o.SupportedTokens = SupportedTokens.Both;
o.ApiSecret = "secret";
};
services.AddAuthentication()
.AddIdentityServerAuthentication(authenticationProviderKey, options);
services.AddOcelot();
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
//app.UseHttpsRedirection();
app.UseRouting();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
app.UseOcelot().Wait();
}
}
}
ocelot.json
{
"Routes": [
{
"DownstreamPathTemplate": "/{everything}",
"DownstreamScheme": "http",
"DownstreamHostAndPorts": [
{
"Host": "MS.api",
"Port": 80
}
],
"UpstreamPathTemplate": "/api/{everything}",
"UpstreamHttpMethod": [
"GET",
"POST",
"PUT",
"DELETE"
],
"RouteIsCaseSensitive": false,
"AuthenticationOptions": {
"AuthenticationProviderKey": "TestKey",
"AllowedScopes": [ "sampleAPI" ]
}
}
],
"GlobalConfiguration": {
"BaseUrl": "http://localhost:5001"
}
}
Docker Compose
version: '3.7'
services:
ms.api:
image: msapi
build:
context: .
dockerfile: MS.API/Dockerfile
ms.gateway:
image: ms.gateway
build:
context: .
dockerfile: MS.Gateway/Dockerfile
identityserver:
image: identityserver
build:
context: .
dockerfile: IdentityServer/Dockerfile
ms.ui:
image: ms.ui
build:
context: .
dockerfile: MS.UI/Dockerfile
Docker Compose Override
version: '3.7'
services:
ms.api:
environment:
- ASPNETCORE_ENVIRONMENT=Development
- ASPNETCORE_URLS=http://+:80
ports:
- "5000:80"
volumes:
- ${APPDATA}/Microsoft/UserSecrets:/root/.microsoft/usersecrets:ro
- C:/Users/dheer/.aspnet/https:/https:ro
networks:
- msnetwork
ms.gateway:
environment:
- ASPNETCORE_ENVIRONMENT=Development
- ASPNETCORE_URLS=http://+:80
ports:
- "5001:80"
networks:
- msnetwork
identityserver:
environment:
- ASPNETCORE_ENVIRONMENT=Development
- ASPNETCORE_URLS=http://+:80
ports:
- "5002:80"
networks:
- msnetwork
ms.ui:
environment:
- ASPNETCORE_ENVIRONMENT=Development
- ASPNETCORE_URLS=http://+:80
ports:
- "5003:80"
networks:
- msnetwork
networks:
msnetwork:
volumes:
gateway_voludme:
Please help me . this complete source code is also available @ https://github.com/Dheerajmentor/Microservice.git Branch - Add-IDS4
If you get the Code_challenge required error, then that's because the client didn't sent the following two PKCE headers:
&code_challenge=XXXXXXXXX...
&code_challenge_method=S256
Do verify this in Fiddler.
Also, do uncomment this line is a good start:
//options.UsePkce = true;
Also looking at the IdentityServer log is a good place to diagnose this further.
Also, PKCE is only available for the Authorization code flow. You are using
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
When you should use this instead:
AllowedGrantTypes = GrantTypes.Code,
If you still want to use the current Hybrid flow, you need to disable PKCE using the following in the client definition:
RequirePkce = false