identityserver4 – Tarik Billa

Generate access token with IdentityServer4 without password

April 9, 2024 by Tarik

[HttpPost(“loginas/{id}”)] [Authorize(Roles = “admin”)] public async Task<IActionResult> LoginAs(int id, [FromServices] ITokenService TS, [FromServices] IUserClaimsPrincipalFactory<ApplicationUser> principalFactory, [FromServices] IdentityServerOptions options) { var Request = new TokenCreationRequest(); var User = await userManager.FindByIdAsync(id.ToString()); var IdentityPricipal = await principalFactory.CreateAsync(User); var IdServerPrincipal = IdentityServerPrincipal.Create(User.Id.ToString(), User.UserName, IdentityPricipal.Claims.ToArray()); Request.Subject = IdServerPrincipal; Request.IncludeAllIdentityClaims = true; Request.ValidatedRequest = new ValidatedRequest(); Request.ValidatedRequest.Subject = Request.Subject; Request.ValidatedRequest.SetClient(Config.GetClients().First()); Request.Resources … Read more

Identity Server 4 – IDX10630: PII is hidden

April 5, 2024 by Tarik

You can see more details in development by adding the following to Configure() in the Startup class: if (env.IsDevelopment()) { IdentityModelEventSource.ShowPII = true; }

User Registration Process with IdentityServer4

January 7, 2024 by Tarik

IdentityServer is for authenticating existing users, not really creating new users. In our use-case, we have 3 projects playing a part: The identity server A protected API An identity provider (aspnet core identity) project Users are created by a call to the API, which creates the appropriate structures in the identity provider. Our identity server … Read more

WindowsCryptographicException: Keyset does not exist

December 20, 2023 by Tarik

The problem was resolved by adding IIS_IUSR group. From this link Add group IIS_IUSR: The problem was that the Permissions for the Private Key of the Certificate in the Windows Certificate Store did not have the IIS_IUSRS group set to allow read access. Right click certificate -> All Tasks -> Manage Private Keys -> Add … Read more

The audience is invalid error

November 23, 2023 by Tarik

See here for what this claim is about: The aud (audience) claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in the aud claim … Read more

Role based authorization with IdentityServer4

September 23, 2023 by Tarik

Given that you have not provided config object for javascript client, I assume you have scope configured as follows. scope:”openid profile api1 role” I believe that the main reason for your issue is that role claim is not included in your access token. Add role claim to api1 scope as follows to include it in … Read more

Identityserver 4 and Azure AD

September 23, 2023 by Tarik

IdentityServer4 vs AspNet.Security.OpenIdConnect.Server vs OpenIddict

September 23, 2023 by Tarik

EDIT (01/28/2021): as part of the 3.0 update, AspNet.Security.OpenIdConnect.Server and OpenIddict were merged to form a single/unified codebase under the OpenIddict umbrella, which should offer the best of both worlds: you still have the same experience as before, but can now opt in for the degraded mode, giving advanced users the same lower-level approach as … Read more

What is the Signing Credential in IdentityServer4?

September 20, 2023 by Tarik

The Authorization Server will sign tokens with a key. Resource Server(s) should verify that the token’s integrity with a key. Together they form a (usually asymmetric, e.g. public/private) key (pair). By default IdentityServer will publish the public key for verifying tokens via the /.well-known/openid-configuration endpoint. For development scenarios, you typically want to skip the fuss … Read more

Why is ClaimTypes.NameIdentifier not mapping to ‘sub’?

September 20, 2023 by Tarik

To not let Microsoft Identity to override claim names you have to use JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); just before the app.UseAuthentication() in the API startup. Use direct “sub” claim instead of ClaimThypes.NameIdentifier e.g. var id = this.User.FindFirstValue(“sub”); For further reference please see detailed discussion on it: https://github.com/IdentityServer/IdentityServer4/issues/2968#issuecomment-510996164