ASP.NET

Steve Naidamast wrote:

If it can't be figured out in 20 minutes it is not worth the effort.

Quote:

... if you encrypt your Config file, then your machine would store your keys and if you copy the Config file to a different system and try to decrypt it, then you might get an error.

services.AddAuthorization(auth =>
{
  auth.AddPolicy(AuthPolicies.Admin, AuthPolicies.AdminPolicy());
  auth.AddPolicy(AuthPolicies.Account, AuthPolicies.AccountPolicy());                            
});

// Add all authentication schemes at once
services.AddAuthentication(option =>
{
    option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

})
.AddIdentityServerJwt()
.AddCookie(option => option.SlidingExpiration = true)<br />
.AddGoogle(CertificateAuthenticationDefaults.AuthenticationScheme, option =>
{
    var googleAuthNSection = Config.GetSection("Authentication:Google");<br />
    option.ClientId = googleAuthNSection["ClientId"];
    option.ClientSecret = googleAuthNSection["ClientSecret"];
})
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
{
    var settings = Config.GetSection("Settings");
    var secretKey = settings.GetValue<string>("Auth0:Secret");
    var authority = settings.GetValue<string>("Auth0:Authority");
    var audience = settings.GetValue<string>("Auth0:Audience");
    var issuer = settings.GetValue<string>("Auth0:Issuer");
    var expiresDays = settings.GetValue<int>("Auth0:ExpireDays");
    var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));

    options.Audience = audience;
    options.Authority = authority;<br />
    options.SaveToken = false;
    options.RequireHttpsMetadata = false;
    options.Configuration = new OpenIdConnectConfiguration();<br />
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ClockSkew = TimeSpan.FromMinutes(0),
        ValidateIssuerSigningKey = false,
        ValidateIssuer = false,
        ValidateAudience = false,
        ValidateLifetime = false,
        ValidIssuer = issuer,
        ValidAudience = audience,<br />
        IssuerSigningKey = signingKey
    };

    options.Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
            {
                context.Response.Headers.Add("Token-Expired", "true");
            }
            return Task.CompletedTask;
        }                    
    };
    services.AddCors();
});

public class AuthPolicies
{
    public const string Admin = "Admin";
    public const string Account = "Account";

    public static AuthorizationPolicy AdminPolicy()
    {
        return new AuthorizationPolicyBuilder()
            .AddAuthenticationSchemes("Cookies", "Bearer")
            .RequireAuthenticatedUser()
            .RequireRole(Admin)
            .RequireClaim("jti", "sub", "unique_name", "role", "idpId")<br />
            .Build();
    }

    public static AuthorizationPolicy AccountPolicy()
    {
        return new AuthorizationPolicyBuilder()
            .AddAuthenticationSchemes("Cookies", "Bearer")
            .RequireAuthenticatedUser()
            .RequireRole(Account)
            .RequireClaim("jti", "sub", "unique_name", "role", "idpId")<br />
            .Build();
    }

}

public static AuthorizationPolicy AdminPolicy()
{
    return new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("Bearer")
        .RequireAuthenticatedUser()
        .RequireRole(Admin)                
        .RequireClaim("jti") 
        //.RequireClaim("bsonId")
        //.RequireClaim("role")
        //.RequireClaim("idpId")
        .Build();
}

public static AuthorizationPolicy AccountPolicy()
{
    return new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("Bearer")
        .RequireAuthenticatedUser()
        .RequireRole(Account)
        .RequireClaim("jti", "sub", "unique_name", "role", "bsonId", "idpId")
        .Build();
}

"Kestrel": {
  "Certificates": {
    "Default": {
      "Path": "localhost.pfx",
      "Password": ""
    }
  }
}