IdentityServer4项目架构

Question

First off sorry for my English.

I spent some time learning about IS4, .NET Core, Identity, Auth, Auth, Claims and so on. Today I'm starting to work on my own web project to get theese pieces to work together. My solution includes 3 clients (React, Admin-Razor, Mobile), IS4 server and WebAPI (React and Mobile will talk to the API).

1. Since React and Admin clients have two different login pages, should they both use IS4 for authorization and authentication?

2. The admin project will be an ASP.NET MVC project and won't call an API from different project, so what GrantTypes must I use and should use IS4 for it?

I'm not looking for code examples, just need help for the project architecture with IS4.

Thanks!

Answer 1

Identity server is the OpenID Connect identity provider . (openidConnect is built on top of OAuth2). That means, that identity server application will handle all the stuff, related to acces & identity tokens, different flows, federated identity and delegating authority, in other words, doing all the stuff related to authentication and authorization. OpenId connect & OAuth2 approach fit perfectly when dealing with distributed systems, which require centralized security. It means, that using IS4 guarantees that all your application, which trust your identity server will handle authentication and authorization in consolidated way.

For your very architecture, it seems IS4 to be a good starting point, but:

1. Since React and Admin clients have two different login pages, should they both use IS4 for authorization and authentication?

IS4 is separate application, which will issue, validated and manage ypu clients tokens and, eventually, tokens. So, likely, the authentication process would be done on the side of IS4. It's very similar to 3rd party identity providers (like facebook or google. Remember the buttins "sign in with google"?), but in your case you have your own identity service - IS4, hosted as application. So, the login page by itself should be on the side of IS4, but you are able to customize the layout.

2. The admin project will be an ASP.NET MVC project and won't call an API from different project, so what GrantTypes must I use and should use IS4 for it?

The answer is, as always, up to you. If you require some identity in your application (not an anonymous access), then the usage of IS is possible and, even, prefered. However if you admin part is server side application, the best suitable grant flow is "authorization code" (server-server communication on behalf of user).