使用Identity Server在.Net Core Web API中授权

Question

We have a.Net Core Web API hosted on Azure App Service and we have our own Identity Server to generate an access token. We have added our web API to Azure API Management so all the requests to web API have to go through API Management.

For securing API Operations, we will send access token generated by Identity Server in all the requests. So We wanted to validate the access token, we have added Authentication in API Management at API operation inbound processing as shown below, because we don't want unauthorized request to be stopped at API management without hitting back end API.

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
   <openid-config url="https://<our-identity-server-URL>/.well-known/openid-configuration" />
</validate-jwt>

It is working fine, all the request without access token are throwing 401 Unauthorized Response and all requests with a valid access token are hitting Web API.

Now we want to Authorize our requests by checking whether the required Scope is present in the Access token or not. BUT Since we already Authenticating in API Management we don't want to Authenticate again in the Web API code. So we wrote only Authorization code in StartUp.cs file as shown below,

public void ConfigureServices(IServiceCollection services)
{
       services.AddAuthentication("Bearer").AddJwtBearer("Bearer", config =>
       {
           config.Authority = "<our Identity Server URL>";
           config.TokenValidationParameters = new TokenValidationParameters()
           {
               ValidateAudience = false
           };
       });
       services.AddAuthorization(options =>
       {
           options.AddPolicy("ApiScope", policy =>
           {
              policy.RequireClaim("scope","Allow_BackEnd_Service");
           });
        });
       services.AddControllers();            
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    app.UseHttpsRedirection();
    app.UseRouting();
     //app.UseAuthentication(); (It is working only if I add this line)
    app.UseAuthorization();
    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllers();
    });
}

But this code is always returning 401 Unauthorized Result. If I add "app.UseAuthentication();" in the Configure Method in Startup.cs class, it is working. But we don't want to do add Authentication again in Web API.

Is it possible to do only Authorization in .net Core Web API? If not, If I have to add "app.UseAuthentication();", what will be latency? will it be a performance problem?

Answer 1

In this case, you can directly use the required-claims in the APIM policy to validate the scope in the token.

Sample:

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
   <openid-config url="https://<our-identity-server-URL>/.well-known/openid-configuration" />
   <required-claims>
    <claim name="scp" match="any" separator=" ">
    <value>Users.Read</value>
    </claim>
    </required-claims>
</validate-jwt>

Then if the scope in my decoded token is like below, the policy will check if the Users.Read is in the scope, if it is existing, the token is valid.