authress / authress-sdk.cs

The Authress SDK for C# provides authorization as a service with fully compatible REST apis.

Authress SDK for C#

This is the Authress SDK for C#. Authress provides an authorization API for user identity, access control, and api key management as a drop in SaaS.

The Nuget package connects to the Authress API. You can use Authress to build authentication and authorization directly into your applications and services. Additionally, Authress can be used locally to develop faster without needing an Authress Account

---

Usage

You can either directly install the Authress SDK directly into your current application or checkout the Authress C# Starter Kit.

Installation:

• run: dotnet add Authress.SDK (or install via visual tools)

Verify Authress JWT

The recommended solution is to use the C# built in OpenID provider by Microsoft. An example implementation is available in the Authress C# Starter Kit. However, in some cases you might need to parse the JWT directly and verify it for use in serverless functions.

using Authress.SDK;

// Get an authress custom domain: https://authress.io/app/#/settings?focus=domain
var authressSettings = new AuthressSettings { ApiBasePath = "https://authress.company.com", };
var authressClient = new AuthressClient(tokenProvider, authressSettings)

var verifiedUserIdentity = await authressClient.VerifyToken(jwtToken);
Console.WriteLine($"User ID: {verifiedUserIdentity.UserId}");

Authorize users using user identity token

using Authress.SDK;

namespace Microservice
{
    public class Controller
    {
        public static async void Route()
        {
            // automatically populate forward the users token
            // 1. instantiate all the necessary classes (example using ASP.NET or MVC, but any function works)
            //   If using the HttpContextAccessor, register it first inside the application root
            //   services.TryAddSingleton<IHttpContextAccessor, HttpContextAccessor>();
            var tokenProvider = new DynamicTokenProvider(() =>
            {
                // Then get the access token from the incoming API request and return it
                var httpContextAccessor = ServiceProvider.GetRequiredService<IHttpContextAccessor>();
                var accessToken = await httpContextAccessor.HttpContext.GetTokenAsync("Bearer", "access_token");
                return accessToken;
            });
            // Get an authress custom domain: https://authress.io/app/#/settings?focus=domain
            var authressSettings = new AuthressSettings { ApiBasePath = "https://authress.company.com", };
            var authressClient = new AuthressClient(tokenProvider, authressSettings);

            // 2. At runtime attempt to Authorize the user for the resource
            await authressClient.AuthorizeUser("USERID", "RESOURCE_URI", "PERMISSION");

            // API Route code
            // ...
        }
    }
}

Authorize using an explicitly set token each time

using Authress.SDK;

namespace Microservice
{
    public class Controller
    {
        public static async void Route()
        {
            // automatically populate forward the users token
            // 1. instantiate all the necessary classes
            var tokenProvider = new ManualTokenProvider();
            var authressSettings = new AuthressSettings { ApiBasePath = "https://DOMAIN.api.authress.io", };
            var authressClient = new AuthressClient(tokenProvider, authressSettings);

            // 2. At runtime attempt to Authorize the user for the resource
            tokenProvider.setToken(userJwt);
            await authressClient.AuthorizeUser("USERID", "RESOURCE_URI", "PERMISSION");

            // API Route code
            // ...
        }
    }
}

Authorize users using client secret

using Authress.SDK;

namespace Microservice
{
    public class Controller
    {
        public static async void Route()
        {
            // accessKey is returned from service client creation in Authress UI
            // 1. instantiate all the necessary classes
            var accessKey = 'ACCESS_KEY';
            // Assuming it was encrypted in storage, decrypt it
            var decodedAccessKey = decrypt(accessKey);
            var tokenProvider = new AuthressClientTokenProvider(decodedAccessKey);
            // Get an authress custom domain: https://authress.io/app/#/settings?focus=domain
            var authressSettings = new AuthressSettings { ApiBasePath = "https://authress.company.com", };
            var authressClient = new AuthressClient(tokenProvider, authressSettings);

            // Attempt to Authorize the user for the resource
            // 2. At runtime the token provider will automatically pull the token forward
            await authressClient.AuthorizeUser("USERID", "RESOURCE_URI", "PERMISSION");

            // API Route code
            // ...
        }
    }
}

Contribution guidelines for the Authress SDK

Contribution guidelines

authress-sdk.cs's Issues

How to get the user claim populated so that standard attributes can be used

Hi,

I'm wondering if you have any documentation on the correct way of validating the authentication of a user using the standard .NET way (E.G. via Authorize attributes].

I've tried numerous implementations with the "AddJwtBearer" all with no success.

What I'd expect is to be able to do something like this:

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
    options.Authority = "https://whatever-the-issuer-is.login.authress.io";
});

and have this auto populate the identity so that I can use the attributes as normal.

Any advice on this would be welcome.

Cheers

Pass HttpClient to AuthressClient

It would be great to have the option to pass or configure HttpClient to AuthressClient, so there's a way to configure some retry policy etc.

Add a VerifyToken method to support inline token validation

Add EdDSA token support to Microsoft.Identity.JWT OpenID Provider Authority handling

Update the azure identity token code so that it can handle EdDSA incoming requests and correctly validate them. Refer to #20