Kimserey's blog

Self Signed Certificate for Identity Server 4 and SSL in Ubuntu 16.04 server To sign our JWT tokens, Identity Server 4 requires a signing credential. Today we will see how we can create our own key and provide it to Identity Server to be used as signing credential. Configure ASP NET Core Create key with openssl Selfsigned certificate for local SSL usage If you are new to Identity Server, you can have a look at my previous blog post on How to configure a Implicit authentication with Identity Server . 1. Configure ASP NET Core We start first by creating an extension on top of the IIdentityServerBuilder which when the key is available, will load our own key using the .AddSigningCredential() else will create a temporary key for development purposes, .AddDeveloperSigningCredential() . public static class IdentityServerBuilderExtensions { public static IIdentityServerBuilder LoadSigningCredentialFrom(this IIdentityServerBuilder builder, string path) { if (!string...

Swagger for ASP NET Core API development Building a web API is not an easy task. In order to build one easy to use, we need to consider the routes, the HTTP methods, the return results from the endpoints, the parameter used for the body of the requests, etc… Swagger is a tool which compiles all our API endpoints into a friendly GUI and allows us to directly test them. It brings a lot of benefits as we can easily pinpoint mistakes in the endpoints route or parameters and of course in the implementation since we can straight away call the endpoints. Today we will see how we can integrate Swagger in 3 parts: 1. Add Swagger to ASP NET Core project 2. Handle authentication 3. Handle endpoints specificities with filters 1. Add Swagger to ASP NET Core project We start first by creating an empty ASP NET Core project with the following startup: public class Startup { public void ConfigureServices(IServiceCollection services) { services.AddMvc(); } public void Co...

Implicit flow with Identity Server and ASP NET Core Few months ago I talked about Resource owner password flow with Identity Server and ASP NET Core . But as mentioned in multi places, ROP is an anti pattern when it comes down to a correct implementation of Open ID Connect. A more appropriate flow for API <-> SPA authentication is the Implicit flow . Today we will see how we can implement it in 5 steps: 1. Configure Identity server 2. Configure Identity server Login 3. Protect our Api 4. Log in from the JS client 5. Configure Identity server Consent 1. Configure Identity server With the Implicit flow, all the authentication process happens through the browser. The user will be redirected to a login page delivered by the Identity server, then the redirect authentication will all taken place within the Identity server. For our example, we will be using the test users and will only be demonstrating login. We start first by creating a ASP NET Core 1.1 web application which will...