aklaus / transparent-auth-gateway

Implementations of a "transparent" Auth Gateway that links a third-party Identity Provider with own authorisation rules (scopes, roles, etc.)

Code samples for a series of articles about implementing Transparent Auth Gateway:

1. Needs and means. Requirements for enterprise apps and available off-the-shelf solutions.
2. Auth Flows. Relevant authentication/authorisation flows (OAuth2, OIDC) with sequence diagrams.
3. Writing the code in C#. Comments to the code in this repo – a Transparent Auth Gateway in .NET.
4. Deploying to Azure. App Registrations and Firewall settings (Azure WAF / Front Door).

Transparent Auth Gateway for Enterprise apps

A trusted authority for our enterprise application(s) that

• transparently (without additional user interaction) confirms the identity with the linked Identity Provider (an Azure AD tenant in this case), supporting SSO;
• conducts extra authentication checks (with a potential for own user management);
• issues an access token with app-specific attributes (user’s roles/groups/etc.);
• is self-hosted without reliance on third-party services.

The code uses Azure AD as the linked Identity Provider (for the identity checks) and its own bespoke authorisation server.

The implemented protocols:

• OAuth 2 Authorisation Code Flow (RFC 6749) with Proof Key for Code Exchange (RFC 7636)
• OpenID Connect (OIDC).

Code structure

There are 3 projects:

• AzureADAuthClient – a quick way to ensure that Azure AD authentication is configured. Uses Swagger UI to acquire a token and the standard Microsoft.Identity way to validate the token on WebAPI.
• OpenIdDict.Server – a bespoke Transparent Auth Gateway to confirm the user's identity from the linked provider and authorise the user (issue own access token) according to the bespoke rules:
  • implements OAuth 2 Authorization Code Flow with PKCE to serve other client apps as the trusted authority;
  • perform authentication from the linked Identity Provider (a specified tenant of Azure AD).
• OpenIdDict.Client.Api – A Web API app that validates the access token issued by the Auth Gateway (OpenIdDict.Server). Contains:
  • Swagger front-end to request the token and run HTTP requests;
  • test API end-points.

How's it different?

The key differences:

• Issues its own access token based on internal rules and confirmed user's identity from an Azure AD tenant.
• Requires no database.
• Has minimum code and "magical" behaviour from the packages.

transparent-auth-gateway's Issues

Update NuGet packages

Use the latest versions of referenced NuGet packages

Shorting the returned code in the Authorisation Code with PKCE implementation

CONTEXT: the Authorisation Code with PKCE (RFC 7636) implementation with no authorization storage (e.g. for the Degraded mode) and hence no reference tokens in use.

PROBLEM
The server returns the Code (encrypted by default) wrapped in a signed JWT by calling link to GenerateIdentityModelToken.ValueTask() method:
context.Token = context.SecurityTokenHandler.CreateToken(descriptor).
This (especially the signature) blows out the size of the generated code string (becomes > 2,048 symbols) that gets returned in the Query String.

TL;DR: Due to the heavy size of the token, in its turn, the client's request may hit limitations on the Query String and/or URL length.

GOAL:
Keep the generated code string well under 2,048 symbols.
e.g. code=lBm8NqlNa0qKalXTRc7cYA&state=V2VkIEp1bCAyNiAyMDIzIDE4OjE3OjMzIEdNVCsxMDAwIChBdXN0cmFsaWFuIEVhc3Rlcm4gU3RhbmRhcmQgVGltZSk%3D&iss=https%3A%2F%2Flocalhost%3A5003%2F

Update NuGet packages

Use the latest versions of referenced NuGet packages

Target .NET 8 and upfrade OpenIddict to 5.3

1. Change the targeting framework to .net8
2. Upgrade OpenIddict to the latest

Fake POST requests to /signin-oidc cause exception

Sending empty/fake POST requests to /signin-oidc end-point causes this exception:

Microsoft.AspNetCore.Authentication.AuthenticationFailureException:
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1+<HandleRequestAsync>d__12.MoveNext (Microsoft.AspNetCore.Authentication, Version=8.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware+<Invoke>d__6.MoveNext (Microsoft.AspNetCore.Authentication, Version=8.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=8.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol+<ProcessRequests>d__238`1.MoveNext (Microsoft.AspNetCore.Server.Kestrel.Core, Version=8.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
Inner exception Microsoft.AspNetCore.Authentication.AuthenticationFailureException handled at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1+<HandleRequestAsync>d__12.MoveNext:

Here's a cURL command to reproduce:
curl --location --request POST 'https://localhost:5003/signin-oidc'