420.6 Keycloak and MVC - chempkovsky/CS82ANGULAR GitHub Wiki

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using MvcCore01.Data;

//
// https://kc.rupbes.by:8445/realms/rupbes.test/account
//

namespace MvcCore01
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);


            // Add services to the container.
            var connectionString = builder.Configuration.GetConnectionString("DefaultConnection") ?? throw new InvalidOperationException("Connection string 'DefaultConnection' not found.");
            builder.Services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(connectionString));
            builder.Services.AddDatabaseDeveloperPageExceptionFilter();

            builder.Services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
                .AddEntityFrameworkStores<ApplicationDbContext>()
                ;//.AddDefaultTokenProviders();

            builder.Services.AddAuthentication(options =>
            { 
                
                options.DefaultAuthenticateScheme = IdentityConstants.ApplicationScheme;
                options.DefaultChallengeScheme = IdentityConstants.ApplicationScheme;
                options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
                
            })
            .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
                    options =>
                    {
                        options.LoginPath = "/Account/Login/";
                        options.LogoutPath = "/Account/Logout";
                    }
            )
            .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, "SSO with Keycloak", o =>
             {
                 o.SignInScheme = IdentityConstants.ExternalScheme;
                 o.SignOutScheme = IdentityConstants.ApplicationScheme;


                 o.ClientId = "Mvc01";
                 o.ClientSecret = "XXXXXXXXXXXXXXXXXXXXXXX"; // copy Secret from keycloak console
                 o.Authority = "https://kc.rupbes.by:8445/realms/rupbes.test";

                 // default value == "/signin-oidc"
                 // Keycloak  "Valid redirect URIs"-param must be set to "/signin-oidc"
                 o.CallbackPath = new PathString("/signin-oidc");


                 // Requests received on this path will cause the handler to invoke SignOut using the SignOutScheme.
                 //o.RemoteSignOutPath = new PathString("/Home/DoLogout");              // default value


                 // default value == "/signout-callback-oidc"
                 // Keycloak  "Valid post logout redirect URIs"-param must be set to "/signout-callback-oidc"
                 //            o.SignedOutCallbackPath = new PathString("/signout-callback-oidc");
                 /// <summary>
                 /// The uri where the user agent will be redirected to after application is signed out from the identity provider.
                 /// The redirect will happen after the SignedOutCallbackPath is invoked.
                 /// </summary>
                 /// <remarks>This URI can be out of the application's domain. By default it points to the root.</remarks>
                 //             o.SignedOutRedirectUri = new PathString("/Home/DoCleanUpCookie");                       // default value


                 o.ResponseType = OpenIdConnectResponseType.Code;
                 o.UsePkce = true;

                 // o.Scope.Add("user.read");

                 // o.MapInboundClaims = false;
                 o.Scope.Clear();
                 o.Scope.Add("openid");
                 o.Scope.Add("profile");
                 o.Scope.Add("email");
                 o.Scope.Add("phone");
                 //  o.Scope.Add("offline_access");

                 o.SaveTokens = true;
             });

            builder.Services.AddControllersWithViews();

            var app = builder.Build();

            // Configure the HTTP request pipeline.
            if (app.Environment.IsDevelopment())
            {
                app.UseMigrationsEndPoint();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthorization();

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
            app.MapRazorPages();

            app.Run();
        }
    }
}

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using MvcCore02.Data;

//
// https://kc.rupbes.by:8445/realms/rupbes.test/account
//

namespace MvcCore02
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);


            // Add services to the container.
            var connectionString = builder.Configuration.GetConnectionString("DefaultConnection") ?? throw new InvalidOperationException("Connection string 'DefaultConnection' not found.");
            builder.Services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(connectionString));
            builder.Services.AddDatabaseDeveloperPageExceptionFilter();

            builder.Services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
                .AddEntityFrameworkStores<ApplicationDbContext>()
                ;//.AddDefaultTokenProviders();

            builder.Services.AddAuthentication(options =>
            { 
                
                options.DefaultAuthenticateScheme = IdentityConstants.ApplicationScheme;
                options.DefaultChallengeScheme = IdentityConstants.ApplicationScheme;
                options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
                
            })
            .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
                    options =>
                    {
                        options.LoginPath = "/Account/Login/";
                        options.LogoutPath = "/Account/Logout";
                    }
            )
            .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, "SSO with Keycloak", o =>
             {
                 o.SignInScheme = IdentityConstants.ExternalScheme;
                 o.SignOutScheme = IdentityConstants.ApplicationScheme;


                 o.ClientId = "Mvc02";
                 o.ClientSecret = "YYYYYYYYYYYYYYYYYYYYYYY"; // copy Secret from keycloak console
                 o.Authority = "https://kc.rupbes.by:8445/realms/rupbes.test";

                 // default value == "/signin-oidc"
                 // Keycloak  "Valid redirect URIs"-param must be set to "/signin-oidc"
                 o.CallbackPath = new PathString("/signin-oidc");


                 // Requests received on this path will cause the handler to invoke SignOut using the SignOutScheme.
                 //o.RemoteSignOutPath = new PathString("/Home/DoLogout");              // default value


                 // default value == "/signout-callback-oidc"
                 // Keycloak  "Valid post logout redirect URIs"-param must be set to "/signout-callback-oidc"
                 //            o.SignedOutCallbackPath = new PathString("/signout-callback-oidc");
                 /// <summary>
                 /// The uri where the user agent will be redirected to after application is signed out from the identity provider.
                 /// The redirect will happen after the SignedOutCallbackPath is invoked.
                 /// </summary>
                 /// <remarks>This URI can be out of the application's domain. By default it points to the root.</remarks>
                 //             o.SignedOutRedirectUri = new PathString("/Home/DoCleanUpCookie");                       // default value


                 o.ResponseType = OpenIdConnectResponseType.Code;
                 o.UsePkce = true;

                 // o.Scope.Add("user.read");

                 // o.MapInboundClaims = false;
                 o.Scope.Clear();
                 o.Scope.Add("openid");
                 o.Scope.Add("profile");
                 o.Scope.Add("email");
                 o.Scope.Add("phone");
                 //  o.Scope.Add("offline_access");

                 o.SaveTokens = true;
             });

            builder.Services.AddControllersWithViews();

            var app = builder.Build();

            // Configure the HTTP request pipeline.
            if (app.Environment.IsDevelopment())
            {
                app.UseMigrationsEndPoint();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthorization();

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");
            app.MapRazorPages();

            app.Run();
        }
    }
}

        public async Task<IActionResult> OnPost(string returnUrl = null)
        {
            Claim? clm = this.User?.FindFirst("http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod");
            
            await _signInManager.SignOutAsync();
            _logger.LogInformation("User logged out.");
            if ("OpenIdConnect".Equals(clm?.Value, StringComparison.OrdinalIgnoreCase))
            {
                return new RedirectResult("https://kc.rupbes.by:8445/realms/rupbes.test/account");
            }
            else
            {
                if (returnUrl != null)
                {
                    return LocalRedirect(returnUrl);
                    //return new RedirectResult("https://kc.rupbes.by:8445/realms/rupbes.test/account");
                }
                else
                {
                    // This needs to be a redirect so that the browser performs a new
                    // request and the identity for the user gets updated.
                    return RedirectToPage();
                    //return new RedirectResult("https://kc.rupbes.by:8445/realms/rupbes.test/account");
                }
            }
            
        }
    }