Implement an OAuth 2.0 Server (Part 11)

Monday, June 18, 2018

Welcome to the eleventh part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Services Our methods thus far have been peppered with a reference to a service named ValidationService. This lightweight class is a service that queries our database. Nothing is preventing us from doing these checks inside the OAuthProvider class itself, but the abstraction lends itself to a cleaner batch of methods. …

Implement an OAuth 2.0 Server (Part 10)

Monday, June 18, 2018

Welcome to the tenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Authorization Provider - Token Methods We’re still implementing the Providers/OAuthProvider.cs class we made in the previous section. Here we’re going to deal with the three Token methods we left un-overridden from last time: ValidateTokenRequest, HandleTokenRequest, ApplyTokenResponse. Validate Token Request As a small warning, the validate token request endpoint is one of the longest methods we’ll be implementing. To make it easier to digest, each significant sub-part has been split into its own mini section. …

Implement an OAuth 2.0 Server (Part 09)

Monday, June 18, 2018

Welcome to the ninth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Authorization Provider - Authorize Methods It’s worth taking a moment to have an overview of how the OpenIdConnectServer library actually works. You are encouraged to read Kevin Chalet’s post here. An authorization provider is an implementation of the OpenIdConnectServerProvider type which overrides the virtual methods we want to implement. We’re going to leave most of these un-overridden, but if you ever need additional functionality, you can always override it and inspect/implement that stage of the pipeline. …

Implement an OAuth 2.0 Server (Part 08)

Monday, June 18, 2018

Welcome to the eighth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Adding Client Scopes Scopes are ways to limit a client’s ability to act on behalf of the user. The scopes are defined by the Resource Server, like Spotify or Google. The client requests the scopes they want to work with, and those scopes are presented to the Resource Owner for authorization - they can then choose to accept or reject the authorization request, meaning that just because an application requests certain, potentially high-value access, doesn’t mean it automatically gets it. …

Implement an OAuth 2.0 Server (Part 07)

Thursday, June 7, 2018

Welcome to the seventh part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. OAuth Client CRUD - Views This is the second part of adding our OAuth Client management pages. In the previous section we generated a controller, which automatically generated some views for us. In this section, we’ll make those views do what we need them to do. Details and Delete Views Delete the following two cshtml files - we don’t need them, because we’ll be rolling their functions into the Edit view. …

Why aren't you using WSL

Wednesday, June 6, 2018

A few years ago Microsoft shipped an experimental feature in their insider builds called the Windows Subsystem for Linux, which is a bizarrely named thing that runs Linux natively from within Windows. To nitpick a bit, it doesn’t strictly run Linux as in the kernel, but it does run the userspace applications. And it’s not really a Windows-like subsystem for Linux, it’s more of a Linux subsystem for Windows, but it’s difficult to pronounce “LSW”. …

Implement an OAuth 2.0 Server (Part 06)

Wednesday, June 6, 2018

Welcome to the sixth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. OAuth Client CRUD - Controller and ViewModels This is the first part of adding our OAuth Client management pages. We’ll set up the controller and the viewmodel here. In next part, we’ll add the html views. View Models ViewModels are, at least in the context of ASP.NET (as opposed to UWP where the MVVM pattern changes what it means slightly), is a way of firewalling our models from our views. Our models may have fields we don’t want to expose all the time. This may get in the way of automatically validating fields, it may lead to extra hidden form fields in our views, and it can generally be a pain to deal with. …

Implement an OAuth 2.0 Server (Part 05)

Wednesday, June 6, 2018

Welcome to the fifth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Adding Models We can’t do very much without creating some models of our domain objects, both in memory and in the database. At this point in time we only have two main things to worry about, and that’s what our OAuth Client Application looks like, and how are they owned by Users? …

Implement an OAuth 2.0 Server (Part 04)

Wednesday, June 6, 2018

Welcome to the fourth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Public API Barebones Setup We’re going to have a very small public API that will entertain a few GET and PUT methods. At first, these methods will be entirely unauthenticated, but as time goes on we’ll eventually put some of them behind OAuth authentication, then add Scope checks, and finally Rate Limiting. But for now, we’re just going to implement some stub methods. …

Implement an OAuth 2.0 Server (Part 03)

Wednesday, June 6, 2018

Welcome to the third part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. SQLite and Initial Migration If you tried to start the website we just initialized, you’d find that you won’t be able to login or register, receiving error messages instead of a welcome screen. Although an initial migration has been provided for us, it hasn’t been applied, and no database exists yet. And if we’re not careful and rush to apply the migration ourselves we’ll end up with a SQL Server dump file. We’re going to switch our database provider to SQLite, and we’re going to change our default connection string to reflect this. …