Skip to content

Commit 7a0d980

Browse files
ismcagdasismcagdas
committed
Added openiddict integration documents
1 parent e26bab6 commit 7a0d980

6 files changed

+207
-202
lines changed

‎docs/en/Infrastructure-Core-Angular-OpenIddict-Integration.md

Lines changed: 78 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,117 +1,114 @@
11
# Identity Server 4 Integration
22

3-
**\*\*IMPORTANT NOTICE\*\***
4-
Identity Server 4 maintainance stopped on November 2022, see [official announcement](https://identityserver4.readthedocs.io/en/latest/). Because of that, it is removed from ASP.NET Zero. We suggest migrating to OpenIddict. Check out ASP.NET Zero's [OpenIddict integration document](Infrastructure-Core-Angular-OpenIddict-Integration.md).
5-
6-
[IdentityServer4](http://identityserver.io/) is an OpenID Connect and OAuth 2.0 framework for ASP.NET Core. ASP.NET Zero is integrated to IdentityServer4. It's **disabled by default**. Its located in `*.Web.Host` project.
3+
[OpenIddict](https://documentation.openiddict.com/) aims at providing a versatile solution to implement OpenID Connect client, server and token validation support in any ASP.NET Core 2.1 (and higher) application.
74

85
## Configuration
96

107
You can enable/disable or configure it from **appsettings.json** file
118

129
```json
13-
"IdentityServer": {
14-
"IsEnabled": "false",
15-
"Clients": [
16-
{
17-
"ClientId": "client",
18-
"AllowedGrantTypes": [ "password" ],
19-
"ClientSecrets": [
20-
{
21-
"Value": "def2edf7-5d42-4edc-a84a-30136c340e13"
22-
}
23-
],
24-
"AllowedScopes": [ "default-api" ]
25-
},
26-
{
27-
"ClientId": "demo",
28-
"ClientName": "MVC Client Demo",
29-
"AllowedGrantTypes": [ "hybrid", "client_credentials" ],
30-
"RequireConsent": "true",
31-
"ClientSecrets": [
32-
{
33-
"Value": "def2edf7-5d42-4edc-a84a-30136c340e13"
34-
}
35-
],
36-
"RedirectUris": [ "http://openidclientdemo.com:8001/signin-oidc" ],
37-
"PostLogoutRedirectUris": [ "http://openidclientdemo.com:8001/signout-callback-oidc" ],
38-
"AllowedScopes": [ "openid", "profile", "email", "phone", "default-api" ],
39-
"AllowOfflineAccess": "true"
40-
}
41-
]
10+
"OpenIddict": {
11+
"IsEnabled": "true",
12+
"Applications": [{
13+
"ClientId": "client",
14+
"ClientSecret": "def2edf7-5d42-4edc-a84a-30136c340e13",
15+
"DisplayName": "AbpZeroTemplate_App",
16+
"ConsentType": "Explicit",
17+
"RedirectUris": ["https://oauthdebugger.com/debug"],
18+
"PostLogoutRedirectUris": [],
19+
"Scopes": [
20+
"default-api",
21+
"profile"
22+
],
23+
"Permissions": [
24+
"ept:token",
25+
"ept:authorization",
26+
"gt:password",
27+
"gt:client_credentials",
28+
"gt:authorization_code",
29+
"rst:code",
30+
"rst:code id_token"
31+
]
32+
}]
4233
}
4334
```
4435

45-
## Testing with Client
36+
* **IsEnabled**: Indicates if OpenIddict integration is enabled or not.
37+
* **Applications**: List of OpenIddict applications.
38+
* **ClientId**: The client identifier associated with the current application.
39+
* **ClientSecret**: The client secret associated with the current application.
40+
* **DisplayName**: The display name associated with the current application.
41+
* **ConsentType**: The consent type associated with the current application (see [possible values](https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Abstractions/OpenIddictConstants.cs#L178)).
42+
* **RedirectUris**: The callback URLs associated with the current application, serialized as a JSON array.
43+
* **PostLogoutRedirectUris**: The logout callback URLs associated with the current application, serialized as a JSON array.
44+
* **Scopes**: The scopes associated with the current authorization, serialized as a JSON array (see [possible values](https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Abstractions/OpenIddictConstants.cs#L402). You can also use custom values).
45+
* **Permissions**: The permissions associated with the current application, serialized as a JSON array (see [possible values](https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Abstractions/OpenIddictConstants.cs#L360)).
4646

47-
ASP.NET Zero solution has a sample console application (ConsoleApiClient) that can connects to the application, authenticates through IdentityServer4 and calls an API.
47+
## Testing with Client
4848

49+
ASP.NET Zero solution has a sample console application (ConsoleApiClient) that can connects to the application, authenticates through OpenIddict and calls an API.
4950

5051

51-
## Testing with MVC Client
52+
## Testing with Web Client
5253

53-
You can use [aspnet-zero-samples](https://github.com/aspnetzero/aspnet-zero-samples) -> `IdentityServerClient` project to test identity server with MVC client.
54+
You can use [https://oauthdebugger.com/](https://oauthdebugger.com/) website to test openIddict with a web client.
5455

55-
Add a new client to `*.Web.Host` appsettings.json
56+
Add a new Application to `*.Web.Host` appsettings.json
5657

5758
```json
5859
...
59-
{
60-
"ClientId": "mvcdemo",
61-
"ClientName": "MVC Client Demo 2",
62-
"AllowedGrantTypes": [ "implicit", "client_credentials" ],
63-
"RequireConsent": "true",
64-
"ClientSecrets": [
65-
{
66-
"Value": "mysecret"
67-
}
68-
],
69-
"RedirectUris": [ "http://localhost:62964/signin-oidc" ],
70-
"PostLogoutRedirectUris": [ "http://localhost:62964/signout-callback-oidc" ],
71-
"AllowedScopes": [ "openid", "profile", "email", "phone", "default-api" ],
72-
"AllowOfflineAccess": "true"
73-
}
74-
...
75-
```
76-
77-
Download the `IdentityServerClient` project and open it's `Startup.cs` and modify `AddOpenIdConnect` area as seen below
78-
79-
```csharp
80-
...
81-
.AddOpenIdConnect("oidc", options =>
8260
{
83-
options.SignInScheme = "Cookies";
84-
85-
options.Authority = "https://localhost:44301";//change with your project url
86-
options.RequireHttpsMetadata = false;
87-
88-
options.ClientId = "mvcdemo";
89-
options.ClientSecret = "mysecret";
90-
91-
options.SaveTokens = true;
92-
});
61+
"ClientId": "client",
62+
"ClientSecret": "def2edf7-5d42-4edc-a84a-30136c340e13",
63+
"DisplayName": "AbpZeroTemplate_App",
64+
"ConsentType": "Explicit",
65+
"RedirectUris": ["https://oauthdebugger.com/debug"],
66+
"PostLogoutRedirectUris": [],
67+
"Scopes": [
68+
"default-api",
69+
"profile"
70+
],
71+
"Permissions": [
72+
"ept:token",
73+
"ept:authorization",
74+
"gt:password",
75+
"gt:client_credentials",
76+
"gt:authorization_code",
77+
"rst:code",
78+
"rst:code id_token"
79+
]
80+
}
9381
...
9482
```
9583

84+
Then, go to [https://oauthdebugger.com/](https://oauthdebugger.com/) and create a URL for authorization code flow. A sample URL should be something like this;
85+
86+
```bash
87+
https://localhost:44301/connect/authorize
88+
?client_id=client
89+
&redirect_uri=https://oauthdebugger.com/debug
90+
&scope=default-api
91+
&response_type=code
92+
&response_mode=query
93+
&state=krd0ddufuw
94+
&nonce=fbhw5it86l6
95+
```
9696

97+
Visit this URL using a browser. If you are not logged into your ASP.NET Zero application, you will be redirected to Login page. If you are already logged in, you will be redirected back to [https://oauthdebugger.com/](https://oauthdebugger.com/). Here, you will see the result of the request as shown below;
9798

98-
That is all. Now you can test it.
99-
100-
Run both projects. Go to `IdentityServerClient` project's secure. <img src="images/identity-server-4-test-mvc-secure.png">
101-
102-
It will redirect you to the login page.
99+
![oauthdebugger code](images/openiddict_oauthdebugger_code.png)
103100

104-
<img src="images/identity-server-4-test-host-login.png">
101+
You can use this code to request an access token. You need to send a request to [https://localhost:44301/connect/token](https://localhost:44301/connect/token) endpoint. Here is a sample request using Postman.
105102

106-
After you successfully login, you will see the consent page. <img src="images/identity-server-4-test-host-consent.png">
103+
![openiddict token endpoint](images/openiddict_token_endpoint.png)
107104

108-
After you allow consents, you will redirect to the secure page and get user claims. <img src="images/identity-server-4-test-mvc-secure-after-login.png">
105+
Using this token, you can get details of the user using [https://localhost:44301/connect/userinfo](https://localhost:44301/connect/userinfo) endpoint or you can make a request to any ASP.NET Zero API service (for example [https://localhost:44301/api/services/app/User/GetUsers](https://localhost:44301/api/services/app/User/GetUsers)).
109106

110107
## OpenId Connect Integration
111108

112-
Once IdentityServer4 integration is enabled Web.Mvc application becomes an OpenId Connect server. That means another web application can use standard OpenId Connect protocol to authenticate users with your
109+
Once OpenIddict integration is enabled, Web.Host application becomes an OpenId Connect server. That means another web application can use standard OpenId Connect protocol to authenticate users with your
113110
application and get permission to share their information (a.k.a. consent screen).
114111

115112
## More
116113

117-
See [IdentityServer4's own documentation](http://docs.identityserver.io/en/latest/) to understand and configure IdentityServer4.
114+
See [OpenIddict's own documentation](https://documentation.openiddict.com/) to understand and configure OpenIddict.

‎docs/en/Infrastructure-Core-Mvc-OpenIddict-Integration.md

Lines changed: 54 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -33,82 +33,82 @@ You can enable/disable or configure it from **appsettings.json** file
3333
}
3434
```
3535

36-
## Testing with Client
36+
* **IsEnabled**: Indicates if OpenIddict integration is enabled or not.
37+
* **Applications**: List of OpenIddict applications.
38+
* **ClientId**: The client identifier associated with the current application.
39+
* **ClientSecret**: The client secret associated with the current application.
40+
* **DisplayName**: The display name associated with the current application.
41+
* **ConsentType**: The consent type associated with the current application (see [possible values](https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Abstractions/OpenIddictConstants.cs#L178)).
42+
* **RedirectUris**: The callback URLs associated with the current application, serialized as a JSON array.
43+
* **PostLogoutRedirectUris**: The logout callback URLs associated with the current application, serialized as a JSON array.
44+
* **Scopes**: The scopes associated with the current authorization, serialized as a JSON array (see [possible values](https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Abstractions/OpenIddictConstants.cs#L402). You can also use custom values).
45+
* **Permissions**: The permissions associated with the current application, serialized as a JSON array (see [possible values](https://github.com/openiddict/openiddict-core/blob/dev/src/OpenIddict.Abstractions/OpenIddictConstants.cs#L360)).
3746

38-
ASP.NET Zero solution has a sample console application (ConsoleApiClient) that can connects to the application, authenticates through IdentityServer4 and calls an API.
47+
## Testing with Client
3948

49+
ASP.NET Zero solution has a sample console application (ConsoleApiClient) that can connects to the application, authenticates through OpenIddict and calls an API.
4050

4151

42-
## Testing with MVC Client
52+
## Testing with Web Client
4353

44-
You can use [aspnet-zero-samples](https://github.com/aspnetzero/aspnet-zero-samples) -> `IdentityServerClient` project to test identity server with mvc client.
54+
You can use [https://oauthdebugger.com/](https://oauthdebugger.com/) website to test openIddict with a web client.
4555

46-
Add a new client to `*.Web.Mvc` appsettings.json
56+
Add a new Application to `*.Web.Mvc` appsettings.json
4757

4858
```json
4959
...
50-
{
51-
"ClientId": "mvcdemo",
52-
"ClientName": "MVC Client Demo 2",
53-
"AllowedGrantTypes": [ "implicit", "client_credentials" ],
54-
"RequireConsent": "true",
55-
"ClientSecrets": [
56-
{
57-
"Value": "mysecret"
58-
}
59-
],
60-
"RedirectUris": [ "http://localhost:62964/signin-oidc" ],
61-
"PostLogoutRedirectUris": [ "http://localhost:62964/signout-callback-oidc" ],
62-
"AllowedScopes": [ "openid", "profile", "email", "phone", "default-api" ],
63-
"AllowOfflineAccess": "true"
64-
}
65-
...
66-
```
67-
68-
Download the `IdentityServerClient` project and open it's `Startup.cs` and modify `AddOpenIdConnect` area as seen below
69-
70-
```csharp
71-
...
72-
.AddOpenIdConnect("oidc", options =>
7360
{
74-
options.SignInScheme = "Cookies";
75-
76-
options.Authority = "https://localhost:44302";//change with your project url
77-
options.RequireHttpsMetadata = false;
78-
79-
options.ClientId = "mvcdemo";
80-
options.ClientSecret = "mysecret";
81-
82-
options.SaveTokens = true;
83-
});
61+
"ClientId": "client",
62+
"ClientSecret": "def2edf7-5d42-4edc-a84a-30136c340e13",
63+
"DisplayName": "AbpZeroTemplate_App",
64+
"ConsentType": "Explicit",
65+
"RedirectUris": ["https://oauthdebugger.com/debug"],
66+
"PostLogoutRedirectUris": [],
67+
"Scopes": [
68+
"default-api",
69+
"profile"
70+
],
71+
"Permissions": [
72+
"ept:token",
73+
"ept:authorization",
74+
"gt:password",
75+
"gt:client_credentials",
76+
"gt:authorization_code",
77+
"rst:code",
78+
"rst:code id_token"
79+
]
80+
}
8481
...
8582
```
8683

84+
Then, go to [https://oauthdebugger.com/](https://oauthdebugger.com/) and create a URL for authorization code flow. A sample URL should be something like this;
85+
86+
```bash
87+
https://localhost:44302/connect/authorize
88+
?client_id=client
89+
&redirect_uri=https://oauthdebugger.com/debug
90+
&scope=default-api
91+
&response_type=code
92+
&response_mode=query
93+
&state=krd0ddufuw
94+
&nonce=fbhw5it86l6
95+
```
8796

97+
Visit this URL using a browser. If you are not logged into your ASP.NET Zero application, you will be redirected to Login page. If you are already logged in, you will be redirected back to [https://oauthdebugger.com/](https://oauthdebugger.com/). Here, you will see the result of the request as shown below;
8898

89-
That is all. Now you can test it.
90-
91-
Run both projects. Go to `IdentityServerClient `project's secure .
92-
93-
<img src="images/identity-server-4-test-mvc-secure.png">
94-
95-
It will redirect you to the login page.
96-
97-
<img src="images/identity-server-4-test-mvc-login.png">
98-
99-
After you successfully, login you will see the consent page.
99+
![oauthdebugger code](images/openiddict_oauthdebugger_code.png)
100100

101-
<img src="images/identity-server-4-test-mvc-consent.png">
101+
You can use this code to request an access token. You need to send a request to [https://localhost:44302/connect/token](https://localhost:44302/connect/token) endpoint. Here is a sample request using Postman.
102102

103-
After you allow consents, you will redirect to secure page and get user claims.
103+
![openiddict token endpoint](images/openiddict_token_endpoint.png)
104104

105-
<img src="images/identity-server-4-test-mvc-secure-after-login.png">
105+
Using this token, you can get details of the user using [https://localhost:44302/connect/userinfo](https://localhost:44302/connect/userinfo) endpoint or you can make a request to any ASP.NET Zero API service (for example [https://localhost:44302/api/services/app/User/GetUsers](https://localhost:44302/api/services/app/User/GetUsers)).
106106

107107
## OpenId Connect Integration
108108

109-
Once IdentityServer4 integration is enabled Web.Mvc application becomes an OpenId Connect server. That means another web application can use standard OpenId Connect protocol to authenticate users with your
109+
Once OpenIddict integration is enabled, Web.Mvc application becomes an OpenId Connect server. That means another web application can use standard OpenId Connect protocol to authenticate users with your
110110
application and get permission to share their information (a.k.a. consent screen).
111111

112112
## More
113113

114-
See [IdentityServer4's own documentation](http://docs.identityserver.io/en/latest/) to understand and configure IdentityServer4.
114+
See [OpenIddict's own documentation](https://documentation.openiddict.com/) to understand and configure OpenIddict.

‎docs/en/images/openiddict_oauthdebugger_code.png

55.7 KB
Loading

‎docs/en/images/openiddict_token_endpoint.png

100 KB
Loading

0 commit comments

Comments
 (0)