ASP.NET 核心 3+ JWT 认证

Question

Been spending a few days lately getting into how to protect a ASP.NET Core Web API/Web App with JWT authentication and/or OIDC.

I have so far been unable to find proper documentation to the two(?) different middleware extensions ( .AddOpenIdConnect and .AddJwtBearer ). From googling and experimenting I have arrived at the assumption that the former supports the full OIDC dance (validation, redirecting to authority etc., suitable for a web app) whereas the latter is used for JWT validation only (more suitable for an API).

What articles I have found are all recipes, focused on how to configure for a specific id provider, such as Azure or IdentityServer4, but I have found almost nothing that actually dives into how these component behaves and how each configurable option affects that behavior. My company uses its own id provider for authentication and issuing JWT tokens so most recipes I find only provides the occasional hint, not real understanding.

I realize documentation must exist but I haven't been able to find anything beyond the skeleton doc provided by Microsoft on docs.microsoft.com.

Would really appreciate more in-detail information for how to use these two middlewares; not specifically for a named id provider, but more generally:

• Is my assumption correct, that .AddOpenIdConnect performs both JWT validation and supports the OIDC dance, automatically redirecting to the authority, token issuer etc?
• Is the middleware dependent on cookie auth; ie can I omit the .AddCookie setup?
• Would it ever make sense to use both middleware components ( .AddOpenIdConnect and .AddJwtBearer )?
• Please describe the behavior of each component, and how the options affect that behavior.
• What are the required options that have to be specified and which ones are optional?
• Is there a need to interact with the OAuth2 "dance" (via events) or are those there for debugging and response/redirect customization only?

Answer 1

AddOpenIdConnect is as you say responsible for the oauth dance, to authenticate user and to create the user session. It handle everything internally, so you dont need to involve the events unless you need to customize it.

You typcically use AddOpenIdConnect with AddCookie, so that AddCookie is responsble for the user session cookie. AddOpenIdConnect is only used for the challenge part of the user login flow.

AddJwtBearer is only for for API/services that receives and authenticate tokens, it will only do valdidation of the token and create a ClaimsPrincipal user based on the token.

you can use both in the same service, but I recommend that you don't because it can get really complex to figure out what is going on. Keep it simple and follow the single responsibility principle and you are good to go. (ie, put them in different services)

A typical AddJwtBearer setup can look like this:

.AddJwtBearer(opt =>
{
    opt.Authority = "https://localhost:6001";
    opt.Audience = "paymentapi";

    opt.TokenValidationParameters.RoleClaimType = "roles";
    opt.TokenValidationParameters.NameClaimType = "name";
    opt.TokenValidationParameters.ClockSkew = TimeSpan.FromSeconds(0);


    // IdentityServer emits a typ header by default, recommended extra check
    opt.TokenValidationParameters.ValidTypes = new[] { "at+jwt" };
});

A typical AddOpenIdConnect setup can look like this:

    .AddOpenIdConnect(options =>
{
    options.AccessDeniedPath = "/User/AccessDenied";
    options.Authority = _configuration["openid:authority"];
    options.ClientId = _configuration["openid:clientid"];
    options.ClientSecret = "mysecret";
    options.ResponseType = "code";

    options.Scope.Clear();
    options.Scope.Add("openid");
    options.Scope.Add("profile");
    options.Scope.Add("email");
    options.Scope.Add("employee");
    options.Scope.Add("payment");
    options.Scope.Add("offline_access");

    options.GetClaimsFromUserInfoEndpoint = true;
    options.SaveTokens = true;
    options.Prompt = "consent";

    options.TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = JwtClaimTypes.Name,
    };


});