Security

Implement an OAuth 2.0 Server (Part 15)

Monday, June 18, 2018

Welcome to the fifteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Scope Authorization with Policies, Requirements and Handlers Just adding Authorization attributes is insufficient for our purposes - our tokens have scopes associated with them, and our endpoint authorization checks should reflect that. To do so, we will use policies, which you can read about on the Microsoft Docs. Policies are fragments you can add to an authorization attribute that confirm whether a given HttpContext meets the requirements of the attribute, beyond simply being authenticated or not. …

Implement an OAuth 2.0 Server (Part 14)

Monday, June 18, 2018

Welcome to the fourteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Adding OAuth Validation Our server successfully issues the three token types, but we don’t have a way to actually force a token check on our endpoints yet. One of the packages we downloaded initially was AspNet.Security.OAuth.Validation. We’re going to use that to add OAuth Validation to our server. In Startup.cs's ConfigureServices, add .AddOAuthValidation() to the Authentication chain: …

Implement an OAuth 2.0 Server (Part 13)

Monday, June 18, 2018

Welcome to the thirteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Identity, Claims, and Authorization Tickets We’ve been skirting talking about claims and authentication tickets by hiding all of it behind our TicketCounter class. You can get a in-depth overview of what those are over at the Microsoft Docs. Claims are how the ASP.NET team has approached identity and authorization details since about 2016. The short of it is that claims are a way of specifying permissions - certain things have claims, other things have claim requirements, and if your claim matches the claims requirement, then you can access the resource locked behind the claim. They’re a bit like roles, but more low level: roles are just a special claim on an IdentityUser. …

Implement an OAuth 2.0 Server (Part 12)

Monday, June 18, 2018

Welcome to the twelfth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Authorization Request Accept/Deny View Two of the the three flows we support, Implicit Grant and Authorization Code, are interactive flows - they require that the user be presented with a screen where they can accept or deny the authorization request. As a preview, this is what our auth page will look like: …

Implement an OAuth 2.0 Server (Part 11)

Monday, June 18, 2018

Welcome to the eleventh part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Services Our methods thus far have been peppered with a reference to a service named ValidationService. This lightweight class is a service that queries our database. Nothing is preventing us from doing these checks inside the OAuthProvider class itself, but the abstraction lends itself to a cleaner batch of methods. …

Implement an OAuth 2.0 Server (Part 10)

Monday, June 18, 2018

Welcome to the tenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Authorization Provider - Token Methods We’re still implementing the Providers/OAuthProvider.cs class we made in the previous section. Here we’re going to deal with the three Token methods we left un-overridden from last time: ValidateTokenRequest, HandleTokenRequest, ApplyTokenResponse. Validate Token Request As a small warning, the validate token request endpoint is one of the longest methods we’ll be implementing. To make it easier to digest, each significant sub-part has been split into its own mini section. …

Implement an OAuth 2.0 Server (Part 09)

Monday, June 18, 2018

Welcome to the ninth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Authorization Provider - Authorize Methods It’s worth taking a moment to have an overview of how the OpenIdConnectServer library actually works. You are encouraged to read Kevin Chalet’s post here. An authorization provider is an implementation of the OpenIdConnectServerProvider type which overrides the virtual methods we want to implement. We’re going to leave most of these un-overridden, but if you ever need additional functionality, you can always override it and inspect/implement that stage of the pipeline. …

Implement an OAuth 2.0 Server (Part 08)

Monday, June 18, 2018

Welcome to the eighth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Adding Client Scopes Scopes are ways to limit a client’s ability to act on behalf of the user. The scopes are defined by the Resource Server, like Spotify or Google. The client requests the scopes they want to work with, and those scopes are presented to the Resource Owner for authorization - they can then choose to accept or reject the authorization request, meaning that just because an application requests certain, potentially high-value access, doesn’t mean it automatically gets it. …

Implement an OAuth 2.0 Server (Part 07)

Thursday, June 7, 2018

Welcome to the seventh part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. OAuth Client CRUD - Views This is the second part of adding our OAuth Client management pages. In the previous section we generated a controller, which automatically generated some views for us. In this section, we’ll make those views do what we need them to do. Details and Delete Views Delete the following two cshtml files - we don’t need them, because we’ll be rolling their functions into the Edit view. …

Implement an OAuth 2.0 Server (Part 06)

Wednesday, June 6, 2018

Welcome to the sixth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. OAuth Client CRUD - Controller and ViewModels This is the first part of adding our OAuth Client management pages. We’ll set up the controller and the viewmodel here. In next part, we’ll add the html views. View Models ViewModels are, at least in the context of ASP.NET (as opposed to UWP where the MVVM pattern changes what it means slightly), is a way of firewalling our models from our views. Our models may have fields we don’t want to expose all the time. This may get in the way of automatically validating fields, it may lead to extra hidden form fields in our views, and it can generally be a pain to deal with. …