.NetCore 2.0, AzureAD and OpenIdConnect
If you develop with .NetCore you probably already know that there are some significant changes from .NetCore 1.1 to .NetCore 2.0
- 2.0 — Most .Net Packages are now under a single Namespace — Microsoft.AspNetCore.All
- More significant changes are in how we setup our Startup.cs — Configure , ConfigureServices and TokenValidated.
- More, I'm just getting started with 2.0
I had to dig into the Class libraries to figure out how to get this to work in 2.0, the Microsoft docs have not caught up with .NetCore 2.0 just yet, the docs on Authentication still reference 1.1 for now, or maybe I just didn’t look hard enough.
I’m going to focus on using OpenIdConnect to connect to AzureAD for user authentication in this basic post.
Project setup:
I put all my Azure connect settings into the appsettings.json file for this post, you may want to put your settings in some other place depending on your security requirements.
app settings.js
“AzureAd” : {
“ClientId”: “Your ClientId”,
“Tennant”: “Your Tennant”,
“TennantId “: “Your TennantId”,
“AADInstance”: “Your AADInstance”,
“PostLogoutRediredtUri”:”Your PostLogoutRedirectUri”
}, “More settings here, removed for brevity”
“ClientId”: “Your ClientId”,
“Tennant”: “Your Tennant”,
“TennantId “: “Your TennantId”,
“AADInstance”: “Your AADInstance”,
“PostLogoutRediredtUri”:”Your PostLogoutRedirectUri”
}, “More settings here, removed for brevity”
You can find these settings on your Azure Portal:
Azure Active Directory -> App Registrations -> "Your App" -> Properties
The Code!
.NetCore 1.1
In .NetCore 1.1, I setup the Configure, ConfigureServices, TokenValidated methods of my startup.cs file like this:
ConfigureServices()
services.AddAuthentication( SharedOptions => SharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);
Configure()
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions {
ClientId = _config[“AzureAd:ClientId”],
Authority = String.Format(_config[“AzureAd:AADInstance”],
ClientId = _config[“AzureAd:ClientId”],
Authority = String.Format(_config[“AzureAd:AADInstance”],
_config[“AzureAd:Tenant”]),
ResponseType = OpenIdConnectResponseType.IdToken,
ResponseType = OpenIdConnectResponseType.IdToken,
PostLogoutRedirectUri = _config[“AzureAd:PostLogoutRedirectUri”],
Events = new OpenIdConnectEvents {
OnTokenValidated = TokenValidated,
OnRemoteFailure = OnAuthenticationFailed
} });
Events = new OpenIdConnectEvents {
OnTokenValidated = TokenValidated,
OnRemoteFailure = OnAuthenticationFailed
} });
TokenValidated()
private Task TokenValidated(TokenValidatedContext context)
{
string issuer = context.SecurityToken.Issuer;
string subject = context.SecurityToken.Subject;
DateTime validFrom = context.SecurityToken.ValidFrom;
DateTime validTo = context.SecurityToken.ValidTo;
string tenantID = context.Ticket.Principal.FindFirst(“http://schemas.microsoft.com/identity/claims/tenantid").Value;
IEnumerable<string> approvedTenantIds = new List<string>
{
_config[“AzureAd:TenantId”],
_config[“AzureAd:ClientId”]
};
if (!approvedTenantIds.Contains(tenantID))
throw new SecurityTokenValidationException();
return Task.FromResult(0);
}
.NetCore 2.0
Configure()
In 2.0, we no longer need to specify app.UseCookieAuthentication nor app.UseOpenIdConnectAuthentication,
instead all authentication is now available with
app.UseAuthentication();
ConfigureServices()
services.AddAuthentication(options=> {
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options => {
options.Authority = String.Format(Configuration[“AzureAd:AADInstance”], Configuration[“AzureAd:Tenant”]);
options.ClientId = Configuration[“AzureAd:ClientId”];
options.ResponseType = OpenIdConnectResponseType.IdToken;
options.Events = new OpenIdConnectEvents
{
OnTokenValidated = TokenValidated,
OnRemoteFailure = OnAuthenticationFailed
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options => {
options.Authority = String.Format(Configuration[“AzureAd:AADInstance”], Configuration[“AzureAd:Tenant”]);
options.ClientId = Configuration[“AzureAd:ClientId”];
options.ResponseType = OpenIdConnectResponseType.IdToken;
options.Events = new OpenIdConnectEvents
{
OnTokenValidated = TokenValidated,
OnRemoteFailure = OnAuthenticationFailed
};
TokenValidated()In .NetCore 1.1 TokenValidatedContext was located in the namespace
Microsoft.AspNetCore.Authentication.OpenIdConnect
In .NetCore 2.0 TokenValidatedContext is now under
Microsoft.AspNetCore.Authentication.RemoteAuthenticationContext<OpenIdConnectOptions>
So we need to change how we find the tenantId, everything else is the same as above.
From:
string tenantID = context.Ticket.Principal.FindFirst(“http://schemas.microsoft.com/identity/claims/tenantid").Value;
To:
string tenantID = context.Principal.FindFirst(“http://schemas.microsoft.com/identity/claims/tenantid").Value;
I did make an addition, I added this to the 2.0 version.
string audience = context.SecurityToken.Audiences.FirstOrDefault();
string upn = context.Principal.FindFirst(ClaimTypes.Upn)?.Value;
string upn = context.Principal.FindFirst(ClaimTypes.Upn)?.Value;
OnAuthenticationFailed is the same in both 1.1 and 2.0
private Task OnAuthenticationFailed(AuthenticationFailedContext context)
{
context.HandleResponse();
context.Response.Redirect(“/Home/Error/?message =” + context.Exception);
return Task.FromResult(0);
}
For more information on .NetCore 2.0 changes
https://docs.microsoft.com/en-us/aspnet/core/aspnetcore-2.0
Hope this helps.
