Kimserey's blog

SignalR with ASP Net Core SignalR is a framework from ASP NET Core allowing us to establish a two way communication between client and server. This two way communication allows the client to send messages to the server but more importantly allows the server to push messages to the client. SignalR makes use of Websocket when available else it falls back to SSE or pulling. Today we will focus on how to setup SignalR to work with WSS, Websocket secure and how we can authenticate the user requesting to connect to our SignalR hub via Webscoket. Getting started with SignalR SSL encryption for Websocket Secure WSS Websocket Authentication with Identity Server 4 SignalR behind Nginx 1. Getting started with SignalR The Hubs are the main components of SignalR. It is an abstraction of a two way communication available for both client and server. Public functions from the hub can be called from the server code and can be called from the client. The frontend NPM package @aspnet/signalr ...

Self Signed Certificate for Identity Server 4 and SSL in Ubuntu 16.04 server To sign our JWT tokens, Identity Server 4 requires a signing credential. Today we will see how we can create our own key and provide it to Identity Server to be used as signing credential. Configure ASP NET Core Create key with openssl Selfsigned certificate for local SSL usage If you are new to Identity Server, you can have a look at my previous blog post on How to configure a Implicit authentication with Identity Server . 1. Configure ASP NET Core We start first by creating an extension on top of the IIdentityServerBuilder which when the key is available, will load our own key using the .AddSigningCredential() else will create a temporary key for development purposes, .AddDeveloperSigningCredential() . public static class IdentityServerBuilderExtensions { public static IIdentityServerBuilder LoadSigningCredentialFrom(this IIdentityServerBuilder builder, string path) { if (!string...

OAuth 2.0, OpenID Connect and Identity Server When it comes to authentication and authorization, the most used standard is OAuth 2.0 with OpenID Connect (OIDC). Few weeks ago I discussed Resource owner password and Implicit flows focusing mainly on implementations with Identity Server. There is a lot of confusion revolving around OAuth 2.0 and OIDC, what they are, how they differ and even what Identity Server is and what is it used for. Today I will give more insights on what is OAuth 2.0 and OIDC are and how Identity Server relates to them. 1. What is OAuth 2.0 2. What is OpenID Connect 3. What is Identity Server 4 1. What is OAuth 2.0 OAuth 2.0 is an authorization protocol enabling applications to have a limited access to protected resources. The authorization is handled in the Identity provider (Idp) who is in charge of delivering an access token to the client apppication after having authenticated the resource owner (usually the user). Why do we need it? Let’s take an exa...

Swagger for ASP NET Core API development Building a web API is not an easy task. In order to build one easy to use, we need to consider the routes, the HTTP methods, the return results from the endpoints, the parameter used for the body of the requests, etc… Swagger is a tool which compiles all our API endpoints into a friendly GUI and allows us to directly test them. It brings a lot of benefits as we can easily pinpoint mistakes in the endpoints route or parameters and of course in the implementation since we can straight away call the endpoints. Today we will see how we can integrate Swagger in 3 parts: 1. Add Swagger to ASP NET Core project 2. Handle authentication 3. Handle endpoints specificities with filters 1. Add Swagger to ASP NET Core project We start first by creating an empty ASP NET Core project with the following startup: public class Startup { public void ConfigureServices(IServiceCollection services) { services.AddMvc(); } public void Co...

Implicit flow with Identity Server and ASP NET Core Few months ago I talked about Resource owner password flow with Identity Server and ASP NET Core . But as mentioned in multi places, ROP is an anti pattern when it comes down to a correct implementation of Open ID Connect. A more appropriate flow for API <-> SPA authentication is the Implicit flow . Today we will see how we can implement it in 5 steps: 1. Configure Identity server 2. Configure Identity server Login 3. Protect our Api 4. Log in from the JS client 5. Configure Identity server Consent 1. Configure Identity server With the Implicit flow, all the authentication process happens through the browser. The user will be redirected to a login page delivered by the Identity server, then the redirect authentication will all taken place within the Identity server. For our example, we will be using the test users and will only be demonstrating login. We start first by creating a ASP NET Core 1.1 web application which will...

Resource owner password flow with Identity Server 4 Few week ago I described how to build a custom Jwt authentication . Today I will show how we can use Identity server together with Resource owner password flow to authenticate and authorise your client to access your api. This post will be composed by 3 parts: 1. Identity server 2. Protect an api 3. Configure a client The full source code is available on my GitHub https://github.com/Kimserey/identity-server-test . 1. Identity server Identity server is a framework which implements Open ID Connect and OAuth 2.0 protocols. The purpose of Identity server is to centralize the identity management and at the same time decouple your api(s) from authentication and authorization logic. Centralizing has many advantages: If you have multiple apis, you can hold your identities in a common place If you have multiple apis, it provides single sign on - user only sign in into one client and is automatically sign in in all apis. This works...