I'm using code flow for a vuejs client with Identityserver4.
i added RequirePkce and i can get the access token and id token from oidc-client.
but access token aud claim is pointing back to Identityserver4 base address not my api resource.
can something be wrong ?
Client:
new Client
{
ClientId = "js.admin",
ClientName = "admin dashboard vuejs client.",
RequirePkce = true,
RequireClientSecret = false,
RequireConsent = false,
AllowedGrantTypes = GrantTypes.Code,
AllowAccessTokensViaBrowser = true,
RedirectUris = new List<string>
{
"http://localhost:8080",
"http://localhost:8080/logincb.html",
"http://localhost:8080/silent-renew.html"
},
PostLogoutRedirectUris = new List<string>
{
"http://localhost:8080/",
"http://localhost:8080"
},
AllowedCorsOrigins = new List<string>
{
"http://localhost:8080"
},
AllowedScopes = new List<string>
{
"openid",
"role",
"profile",
"api1.rw",
"email",
"phone"
}
}
oidc client setting:
const clientSettings = {
userStore: new WebStorageStateStore({ store: window.localStorage }),
authority: STS_DOMAIN,
client_id: "js.admin",
redirect_uri: "http://localhost:8080/logincb.html",
automaticSilentRenew: true,
silent_redirect_uri: "http://localhost:8080/silent-renew.html",
response_type: "code",
scope: "openid profile api1.rw role email phone",
post_logout_redirect_uri: "http://localhost:8080/",
filterProtocolClaims: true
};
Access token decoded:
"iss": "http://localhost:5001",
"aud": "http://localhost:5001/resources",
as you can see the both issuer and audience claims are the same with is wrong.
but even scopes are correct.
I really appreciate any help.
Bearer was not authenticated. Failure message: IDX10214: Audience validation failed. Audiences: 'http://localhost:5001/resources'. Did not match: validationParameters.ValidAudience: 'api1' or validationParameters.ValidAudiences: 'null'.
its is the last error i got.
The http://localhost:5001/resources is a generic resource that is added when you have not defined or associated any ApiResources with the requested ApiScope.
From the documentation here, it says:
When using the scope-only model, no aud (audience) claim will be added
to the token since this concept does not apply. If you need an aud
claim, you can enable the EmitStaticAudienceClaim setting on the
options. This will emit an aud claim in the issuer_name/resources
format. If you need more control of the aud claim, use API resources.
To get api1.rw as your audience, you need to add a ApiResource to your IdentityServer configuration. You can name the ApiResource and ApiScope api1.rw
To complement this answer, I write a blog post that goes into more detail about this topic:
IdentityServer – IdentityResource vs. ApiResource vs. ApiScope
Related
I have a application which is like Microsoft default templates of Asp.netCoreWebApplication->ASP.netCoreWithReact.js.
In this react client will be wrapped inside a.netcore project. All of the UI pages will be served from React. .Net core backend will be used only for APIs.
Now I have implemented IdentityServer4 and able to generate token at this end point,
http://localhost:60739/token
From react client, on login button click I could make API call to http://localhost:60739/token and could generate token using granttype password flow. but i could not validate authroize my api end points with that token
below is my client definition with in identity server solution,
new Client
{
ClientName = "Resource Owner Flow",
ClientId = "resource_owner_flow",
AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
ClientSecrets =
{
new Secret("resource_owner_flow_secret".Sha256())
},
AllowedScopes =
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.OfflineAccess
},
AllowOfflineAccess = true,
RefreshTokenUsage = TokenUsage.ReUse,
//AccessTokenLifetime = 60,
RefreshTokenExpiration = TokenExpiration.Absolute,
AbsoluteRefreshTokenLifetime = 300
}
below is piece of code i am using to refer identity server,
services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", options =>
{
options.Authority = "http://localhost:60739";
options.TokenValidationParameters.ValidateAudience = false;
options.TokenValidationParameters.ValidateIssuer = false;
options.TokenValidationParameters.ValidateIssuerSigningKey = false;
options.TokenValidationParameters.ValidateLifetime = false;
options.TokenValidationParameters.ValidateTokenReplay = false;
options.IncludeErrorDetails = true;
});
I could not successfully access protected api resources? Any idea ?
If i Call http://localhost:57102/api/Home/GetSomeProtectedData using token in header i get 500 internal server error. If i remove authorize attribute on protected resource it's working fine.
below is postman screenshot,
for token creation below is the log,
IdentityServer4.Validation.TokenRequestValidator: Information: Token request validation success,
{
"ClientId": "resource_owner",
"ClientName": "Resource Owner",
"GrantType": "password",
"Scopes": "openid",
"AuthorizationCode": "********",
"RefreshToken": "********",
"UserName": "superadmin#gmail.com",
"Raw": {
"username": "superadmin#gmail.com",
"password": "***REDACTED***",
"grant_type": "password",
"scope": "openid",
"response_type": "token"
}
}
but when I request protected API resource with token in header i get 500 internal server error and logs got created.
If you are getting 500 error, the problem is not the authorization flow. Else it would be 401.
You need to check out what is the real error. It can be a parsing error. You simpyly cannot finish the process because of an server side error. Please share more info, may be logs so I update the answer.
I am new to Identity Server 4, and I am struggling to obtain the users identities. At the moment, I am displaying the Claims via an API that Identity Server is protecting as so:
namespace API01.Controllers
{
[Route("identity")]
[Authorize]
public class IdentityController : ControllerBase
{
// GET identity
[HttpGet]
public IActionResult Get()
{
return new JsonResult(from c in User.Claims select new { c.Type, c.Value });
}
}
}
The problem with this is that email resource is just showing up as the value email when I decode the jwt.
"scope": [
"email",
"openid",
"api1"
],
I have been experimenting with User.Identities but so far I cannot get the information I need from my AllowedScopes {"email", "openid", "api1"}.
Basically, I want to obtain the value which in my case is test#test.com. I am not worried about returning a JsonResult, just a string would suffice for now, if its going to be difficult.
If you want to include the email claim in your id token , you can add the IdentityResources.Email() in IdentityResource of IDS4 :
public static IEnumerable<IdentityResource> GetIdentityResources()
{
return new List<IdentityResource>
{
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
new IdentityResources.Email()
};
}
Also set AlwaysIncludeUserClaimsInIdToken to true in client config :
new Client
{
ClientId = "mvc",
ClientName = "MVC Client",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
....
....
AlwaysIncludeUserClaimsInIdToken = true,
AllowedScopes =
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
"api1",
IdentityServerConstants.StandardScopes.Email,
},
AllowOfflineAccess = true
},
You can start from Identity Server4 code samples .
If you want to find the scopes in jwt token , id token won't include the scopes claim , but access token includes since api should validate that .
Scope array indicates what is allowed to access.
You probably want to see email claim in the token.
For that you need to implement IProfilrService and add all the claims from Subject to IssuedClaims.
I'm trying to create react spa with authentication. I'm using identityserver4 for OIDC provider. Whenever I login, I am redirected to login page and after providing credentials, I'm redirected to SPA, but UserManger does not have access_token.
I've tried to play with Client on server side, but none of that worked.
For Frontend I'm using this example https://github.com/Franpastoragusti/oidc-react-app , but converted to typescript
And backend is slightly modified Identityserver quickstart.
This is my Client in Config.cs
public static IEnumerable<Client> GetClients()
{
return new List<Client>
{
new Client
{
ClientId = "primrose.web",
ClientName = "Primrose Web Application",
AllowedGrantTypes = GrantTypes.Implicit,
AllowAccessTokensViaBrowser = true,
AccessTokenType = AccessTokenType.Jwt,
RequireConsent = false,
AccessTokenLifetime = 120,
AlwaysIncludeUserClaimsInIdToken = true,
RedirectUris = {
"http://localhost:3000/callback",
"http://localhost:3000/silentRenew",
},
PostLogoutRedirectUris =
{
"http://localhost:5000/account/login"
},
AllowedCorsOrigins = { "http://localhost:3000" },
AllowedScopes =
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
"primrose.web"
},
}
};
}
This is my oidc configuration in client app:
export const IDENTITY_CONFIG: any = {
authority: "http://localhost:5000", //(string): The URL of the OIDC provider.
client_id: "primrose.web", //(string): Your client application's identifier as registered with the OIDC provider.
redirect_uri: "http://localhost:3000/callback", //The URI of your client application to receive a response from the OIDC provider.
login: "http://localhost:5000/account/login",
automaticSilentRenew: false, //(boolean, default: false): Flag to indicate if there should be an automatic attempt to renew the access token prior to its expiration.
loadUserInfo: true, //(boolean, default: true): Flag to control if additional identity data is loaded from the user info endpoint in order to populate the user's profile.
silent_redirect_uri: "http://localhost:3000/silentRenew", //(string): The URL for the page containing the code handling the silent renew.
post_logout_redirect_uri: "http://localhost:5000/account/login", // (string): The OIDC post-logout redirect URI.
audience: "primrose.web", //is there a way to specific the audience when making the jwt
responseType: "id_token token", //(string, default: 'id_token'): The type of response desired from the OIDC provider.
grantType: "password",
scope: "openid profile primrose.web", //(string, default: 'openid'): The scope being requested from the OIDC provider.
webAuthResponseType: "id_token token"
};
export const METADATA_OIDC: any = {
issuer: "http://localhost:5000",
jwks_uri: "http://localhost:5000/.well-known/openid-configuration/jwks",
authorization_endpoint: "http://localhost:5000/connect/authorize",
token_endpoint: "http://localhost:5000/connect/token",
userinfo_endpoint: "http://localhost:5000/connect/userinfo",
end_session_endpoint: "http://localhost:5000/connect/endsession",
check_session_iframe: "http://localhost:5000/connect/checksession",
revocation_endpoint: "http://localhost:5000/connect/revocation",
introspection_endpoint: "http://localhost:5000/connect/introspect"
};
this is what usermanager returns when addUserLoaded event is fired
access_token: undefined
expires_at: undefined
id_token: "eyJhbGciOiJSU...(I deleted rest of the token)"
profile:
amr: ["pwd"]
auth_time: 1564597858
email: "pipa#papa.pl"
idp: "local"
name: "pipa#papa.pl"
preferred_username: "pipa#papa.pl"
sid: "2044d39c30e316722516f6d376e24838"
sub: "c0ca848c-8d2d-48e6-829f-e1d29838ecef"
__proto__: Object
refresh_token: undefined
scope: "openid profile primrose.web"
session_state: "kmFYyCDxsql8D4-WD7J07OwW4zhMDdqLjDkHriNuwqg.852977a2a19ba24a7bb5a12d389bebfd"
state: undefined
token_type: undefined
expired: (...)
expires_in: (...)
scopes: (...)
__proto__: Object
I want to retrieve this access token from OIDC provider in my client app, but it comes undefined
I have a client on IdentityServer ,which allows openid,profile and email scopes :
return new[] {
new Client
{
ClientId = "TestWebApp",
ClientSecrets = new [] { new Secret("TestSecret".Sha256()) },
AllowedGrantTypes = GrantTypes.ResourceOwnerPasswordAndClientCredentials,
AllowedScopes = new List<string>{ StandardScopes.OpenId, StandardScopes.Profile,StandardScopes.Email },
}
};
I have defined following Identity resources as well,
public static IEnumerable<IdentityResource> IdentityResources()
{
return new IdentityResource[] {
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
new IdentityResources.Email()
};
}
In-case the claim is missing , I am adding email to user claims explicitly while creation:
await _userManager.AddClaimAsync(testUser, new Claim("email", user.Username));
Now from my login controller using ResourceOwnerPasswordAndClientCredentials I am sending authentication request :
var client = new OAuth2Client(new Uri("http://localhost:44322/connect/token"), "TestWebApp", "TestSecret");
var requestResponse = client.RequestAccessTokenUserName(model.Email, model.Password, "openid profile email");
This works fine and I am getting the scopes back, but all of them are blank.
If you want to include the user claims in the Id token you can set AlwaysIncludeUserClaimsInIdToken to true on your client config.
return new[] {
new Client
{
ClientId = "TestWebApp",
ClientSecrets = new [] { new Secret("TestSecret".Sha256()) },
AllowedGrantTypes = GrantTypes.ResourceOwnerPasswordAndClientCredentials,
AllowedScopes = new List<string>{ StandardScopes.OpenId,
StandardScopes.Profile,StandardScopes.Email },
AlwaysIncludeUserClaimsInIdToken = true
}
};
You can include user claims in accesstoken when you specify those claims on Scopes. For instance for Swagger we needed to include the name claim if availible, below I dumped out the contents of what the ApiResource class should contain.
{
"ApiSecrets": [],
"Scopes": [
{
"Name": "SwaggerApi",
"DisplayName": "SwaggerApi",
"Description": null,
"Required": true,
"Emphasize": false,
"ShowInDiscoveryDocument": true,
"UserClaims": ["name","email"]
}
],
"Enabled": true,
"Name": "SwaggerApi",
"DisplayName": "SwaggerApi",
"Description": null,
"UserClaims": ["name","email"]
}
Add this scope to the allowed scopes of your client registration.
Request an access token.
If the User has a name claim or email claim -> it should get added to the access token.
Result contents access token
"idp": "oidc",
"name": "MyUserName",
"scope": [
"openid",
"profile",
"SwaggerApi"
],
When you use the resource owner password flow you’re requesting an access token, not an id token. Because of this, the claims associated with the scopes defined as identity resources are not passed in to your registered profile service implementation when the access token is created. If you really want to include the email in the access token then I’d advise you to make an api resource scope with “email” defined as a claim type.
That being said, if the email is being used for authentication purposes I’d suggest using another login flow that allows identity tokens if possible or using the user info endpoint.
Short: My client retrieves an access token from IdentityServer sample server, and then passes it to my WebApi. In my controller, this.HttpContext.User.GetUserId() returns null (User has other claims though). I suspect access token does not have nameidentity claim in it. How do I make IdentityServer include it?
What I've tried so far:
switched from hybrid to implicit flow (random attempt)
in IdSvrHost scope definition I've added
Claims = { new ScopeClaim(ClaimTypes.NameIdentifier, alwaysInclude: true) }
in IdSvrHost client definition I've added
Claims = { new Claim(ClaimTypes.NameIdentifier, "42") }
(also a random attempt)
I've also tried other scopes in scope definition, and neither of them appeared. It seems, that nameidentity is usually included in identity token, but for most public APIs I am aware of, you don't provide identity token to the server.
More details:
IdSrvHost and Api are on different hosts.
Controller has [Authorize]. In fact, I can see other claims coming.
Api is configured with
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
app.UseIdentityServerAuthentication(options => {
options.Authority = "http://localhost:22530/";
// TODO: how to use multiple optional scopes?
options.ScopeName = "borrow.slave";
options.AdditionalScopes = new[] { "borrow.receiver", "borrow.manager" };
options.AutomaticAuthenticate = true;
options.AutomaticChallenge = true;
});
Scope:
public static Scope Slave { get; } = new Scope {
Name = "borrow.slave",
DisplayName = "List assigned tasks",
Type = ScopeType.Resource,
Claims = {
new ScopeClaim(ClaimTypes.NameIdentifier, alwaysInclude: true),
},
};
And client:
new Client {
ClientId = "borrow_node",
ClientName = "Borrow Node",
Flow = Flows.Implicit,
RedirectUris = new List<string>
{
"borrow_node:redirect-target",
},
Claims = { new Claim(ClaimTypes.NameIdentifier, "42") },
AllowedScopes = {
StandardScopes.OpenId.Name,
//StandardScopes.OfflineAccess.Name,
BorrowScopes.Slave.Name,
},
}
Auth URI:
request.CreateAuthorizeUrl(
clientId: "borrow_node",
responseType: "token",
scope: "borrow.slave",
redirectUri: "borrow_node:redirect-target",
state: state,
nonce: nonce);
and I also tried
request.CreateAuthorizeUrl(
clientId: "borrow_node",
responseType: "id_token token",
scope: "openid borrow.slave",
redirectUri: "borrow_node:redirect-target",
state: state,
nonce: nonce);
Hooray, I found an answer, when I stumbled upon this page: https://github.com/IdentityServer/IdentityServer3.Samples/issues/173
Apparently, user identity is passed in "sub" claim in the access token. Because I blindly copied API sample, its configuration included
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
which essentially prevented my API from mapping "sub" claim to nameidentifier. After removing this line, HttpContext.User.GetUserId() of authenticated controller returns user ID correctly.