cakriwut / singpassnetauth

SingPass .NET Authentication

The SingPass .NET Authentication project is an open-source and cross-platfrom implementation to provide Log in with SingPass authentication in .NET application.

Prerequisites

1. You'll need to install NodeJS and add the NodeJS executable to the Path environment variable.
2. You'll need to install npm package node-jose in the project folder.
3. You'll need to perform SingPass onboarding process, where you will exchange following:
   • ClientJwks , share either your app JWKS urls or manually created JWKS. Please note that SingPass prefer EC key type. (Responsibility: You/Application Owner)
   • RedirectUrl, share one or more redirect urls for SingPass authentication. Default: /signin-singpass. (Responsibility: You/Application Owner)
   • ClientId , after the onboarding SingPass will provide ClientId. (Responsibility: SingPass)

Getting Started

1. Install Package
   Using Package Manager:

   PM> Install-Package SingPassNetAuth
   

   Using .NET CLI:

   > dotnet add-package SingPassNetAuth
   

2. Add Authentication in the Startup.cs

   public void ConfigureServices(IServiceCollection services)
   {
       ...other contents...
       // Refer to SingPass API documentation - https://stg-id.singpass.gov.sg/docs/authorization/api#_staging_and_production_urls
   
       services.AddAuthentication()
          .AddSingPass(options => {
                    options.Authority = "";
                    options.ClientId = "";
                    options.ClientJwks = "";
          })
   
      ...other contents...
   }

Target Frameworks

• .NET Standard 2.0
• .NET Core 3.1
• .NET 5.0

Platforms

• Windows
• Linux

References

1. Login with SingPass
2. NDI Authentication Service Provider

How to Engage, Contribute, and Give Feedback

Need help or wanna share your thoughts? Don't hesitate to create issue, or pull request.

License

This project is licensed under the MIT License.

singpassnetauth's Issues

ClientJwks

Is the ClientJwks generated using the public or private keys?

e.g. is this the right way to generate it using a X509 cert?

var edna = X509certGetECDsaPublicKey();
if(edna != null)
{
    Jwk jwk = new Jwk(edna, isPrivate: false);
    jwk.KeyId = "default-key";

    // now you can use jwk to decode / encode payload
    Jose.JWT.Decode(token, jwk);

    // or serialize to JSON string
    string json = jwk.ToJson(Jose.JWT.DefaultSettings.JsonMapper);
    // get signing keys
    var signingKey = new JsonWebKeySet(json).GetSigningKeys().First();
    // or convert to CngKey is you need one
     CngKey cngKey = jwk.CngKey();

    // or you can also individual properties of JWK, for instance:
    string x = jwk.X;
    string y = jwk.Y;
}

What is the correct way to generate the required JWKs ? Sorry for all the questions, really confused as to what to do at the moment.