IdentityServer4多个项目

Question

Our solution has 3 projects. Let's call them A, B and IdentityServer. Each project can work as separate service. Projects A and B are ASP.Net MVC Project IdentityServer is .Net Core (it using IdentityServer4)

Front-End is connected to project A. Database is connected to project B. Controllers from project A calls methods from controller of project B. And that is working fine.

We added authorization to project A, configure IdentityServer and that's working fine. When front end calls methode from project A controller like this:

[Authorize] public Task Methode(...) {}

it works OK. It redirects user to IdentityServer, ask for login and authorize him.

But we have to secure project B too. When I Add [Authorize] pragma to methode from project B it fails when controller from project A tries to call that methode.

[Authorize]
public Task<ActionResult> MethodefromServiceA()
{
//do something
//calling methode from service B and sending User as ClaimsPrincipal
}


[Authorize]
public Task<ActionResult> MethodefromServiceB()
{
//it fails here - don't enter to this line (it enter's here when I remove [Authorise] pragma
}

We don't know exactly how to configure IdentityServer4 and Project B that when project B controller get claims and token from project A it should somehow connect with IdentityServer and authorise a token (but not user, because he is already authorized and we have token).

In Configuration.cs in IdentityServer we have something like this:

             new Client {
                ClientId = "A",
                ClientName = "A",
                AllowedGrantTypes = GrantTypes.Implicit,
                AllowedScopes = new List<string>
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    IdentityServerConstants.StandardScopes.Email,
                    "role",
                    "customAPI.write",
                    "customAPI.read"
                },
                RedirectUris = new List<string> {"http://localhost:64898"},
                PostLogoutRedirectUris = new List<string> { "http://localhost:64898/home/welcome" }
            },
              new Client {
                ClientId = "B",
                ClientName = "B",
                AllowedGrantTypes = GrantTypes.Implicit,
                AllowedScopes = new List<string>
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    IdentityServerConstants.StandardScopes.Email,
                    "role",
                    "customAPI.write",
                    "customAPI.read"
                },
                RedirectUris = new List<string> {"http://localhost:57028"},
                PostLogoutRedirectUris = new List<string> { "http://localhost:57028" }
            },

and in Startup in project A:

        app.UseCookieAuthentication(new CookieAuthenticationOptions

        {
            AuthenticationType = "Cookies"
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            ClientId = "A",
            Authority = "https://localhost:44350/",
            RedirectUri = "http://localhost:64898",
            ResponseType = "id_token",
            Scope = "openid email",

            UseTokenLifetime = false,
            SignInAsAuthenticationType = "Cookies",
            PostLogoutRedirectUri = "http://localhost:64898/home/welcome",
        });

I tried add similar to project B, but it doesn't change anything.

I will be glad If I could find some example how to do multiproject authorization with IdentityServer4. How to authorize token in each project, etc... Does [Authorize] pragma solve situation like this or it has to be done in different way or manualy?

Thank you for help. Sorry for my english

Answer 1

My Idea is to add project B as resource and Project A as both Resource and Client to the Identity Server so that project A can access project B's resources using a separate token generated by the Identity Server. Just a suggestion.

Answer 2

You need to pass an access token with the request you make from Project A to Project B.

HttpClient client = new HttpClient();
client.SetBearerToken(bearerTokenString);
client.SendAsync("http://projectB/MehthodB");

Both back-ends of Project A & B should have a token validation block to validate the incoming token as you probably did for Project A.

Now you could re-use the same bearer token to call the next service, but if you want an specific token for that service, you will have to request one from IdentityServer.

You can request a new token from a service with client credential flow or certificate to identify Project A and to request an access token for Project B.