420.5 Keycloak and MVC - chempkovsky/CS82ANGULAR GitHub Wiki

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;

namespace MvcCore01
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            builder.Services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
            })
            .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
            .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, "SSO", o =>
            {
                //o.SignInScheme = IdentityConstants.ExternalScheme;
                //o.SignOutScheme = OpenIdConnectDefaults.AuthenticationScheme; // IdentityConstants.ApplicationScheme;


                o.ClientId = "Mvc01";
                o.ClientSecret = "YYYYYYYYYYYYYYYYY"; // copy ClientSecret from the Keycloak
                o.Authority = "https://kc.rupbes.by:8445/realms/rupbes.test";

                // default value == "/signin-oidc"
                // Keycloak  "Valid redirect URIs"-param must be set to "/signin-oidc"
                o.CallbackPath = new PathString("/signin-oidc");

                // default value == "/signout-callback-oidc"
                // Keycloak  "Valid post logout redirect URIs"-param must be set to "/signout-callback-oidc"
                o.SignedOutCallbackPath = new PathString("/signout-callback-oidc");


                /// <summary>
                /// The uri where the user agent will be redirected to after application is signed out from the identity provider.
                /// The redirect will happen after the SignedOutCallbackPath is invoked.
                /// </summary>
                /// <remarks>This URI can be out of the application's domain. By default it points to the root.</remarks>
                o.SignedOutRedirectUri = new PathString("/Home/DoCleanUpCookie");              // default value = "/"


                o.ResponseType = OpenIdConnectResponseType.Code;
                o.UsePkce = true;

                o.Scope.Clear();
                o.Scope.Add("openid");
                o.Scope.Add("profile");
                o.Scope.Add("email");
                o.Scope.Add("phone");
                o.SaveTokens = true;
            });




            // Add services to the container.
            builder.Services.AddControllersWithViews();

            var app = builder.Build();

            // Configure the HTTP request pipeline.
            if (!app.Environment.IsDevelopment())
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthentication(); // Added
            app.UseAuthorization();

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");

            app.Run();
        }
    }
}

...

        public IActionResult DoLogin()
        {
            // defining  "RedirectUri" is important !!!
            var authProps = new AuthenticationProperties
            {
                RedirectUri = "/"
            };
            // do not use HttpContext.ChallengeAsync(...)-method call !!! It will not work
            return Challenge(authProps, OpenIdConnectDefaults.AuthenticationScheme);
        }

        // public async Task DoLogout()
        // {
        //    await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
        // }

        
        public IActionResult DoLogout()
        {
            return new SignOutResult(
                new[] {
                OpenIdConnectDefaults.AuthenticationScheme
                //  CookieAuthenticationDefaults.AuthenticationScheme // do not insert this line
            });
        }
        

        public async Task DoCleanUpCookie()
        {
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        }
...

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;

namespace MvcCore01
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            builder.Services.AddOpenIdConnectAccessTokenManagement(o =>
            {
                // o.ClientCredentialsScope = "openid profile offline_access";
                // o.ClientCredentialsResource = "OidcWebApiResource OidcWebApiIntrospectionResource";
                // o.DPoPJsonWebKey = "jwk";
            });

            builder.Services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
            })
            .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
                 options => {
                     options.Events.OnSigningOut = async e =>
                     {
                         await e.HttpContext.RevokeRefreshTokenAsync();
                     };
                 }
            )
            .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, "SSO", o =>
            {
                //o.SignInScheme = IdentityConstants.ExternalScheme;
                //o.SignOutScheme = OpenIdConnectDefaults.AuthenticationScheme; // IdentityConstants.ApplicationScheme;


                o.ClientId = "Mvc01";
                o.ClientSecret = "8JQRgt9U7kJKhl7HGBgQ6rhH6WlmU94p";
                o.Authority = "https://kc.rupbes.by:8445/realms/rupbes.test";

                // default value == "/signin-oidc"
                // Keycloak  "Valid redirect URIs"-param must be set to "/signin-oidc"
                o.CallbackPath = new PathString("/signin-oidc");


                /// <summary>
                /// The uri where the user agent will be redirected to after application is signed out from the identity provider.
                /// The redirect will happen after the SignedOutCallbackPath is invoked.
                /// </summary>
                /// <remarks>This URI can be out of the application's domain. By default it points to the root.</remarks>
                o.SignedOutRedirectUri = new PathString("/Home/DoCleanUpCookie");              // default value = "/"


                // default value == "/signout-callback-oidc"
                // Keycloak  "Valid post logout redirect URIs"-param must be set to "/signout-callback-oidc"
                o.SignedOutCallbackPath = new PathString("/signout-callback-oidc");


                o.ResponseType = OpenIdConnectResponseType.Code;
                o.UsePkce = true;

                o.Scope.Clear();
                o.Scope.Add("openid");
                o.Scope.Add("profile");
                o.Scope.Add("email");
                o.Scope.Add("phone");
                o.Scope.Add("offline_access");
                
                o.SaveTokens = true;
            });


            // Add services to the container.
            builder.Services.AddControllersWithViews();

            var app = builder.Build();

            // Configure the HTTP request pipeline.
            if (!app.Environment.IsDevelopment())
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthentication(); // Added
            app.UseAuthorization();

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");

            app.Run();
        }
    }
}