OpenIddict #3 – Authorization Code Flow

//OpenIddict servisini uygulamaya ekliyoruz.
builder.Services.AddOpenIddict()
    .AddCore(options =>
    {
        .
        .
        .
    })
    .AddServer(options =>
    {
        options.SetTokenEndpointUris("/connect/token")
               //Authorization Code talebinde bulunulacak endpoint'i set ediyoruz.
               .SetAuthorizationEndpointUris("/connect/authorize");
        
        options.AllowClientCredentialsFlow()
               //Authorization Code Flow'u etkileştiriyoruz.
               .AllowAuthorizationCodeFlow()
               .RequireProofKeyForCodeExchange();
        .
        .
        .
        options.UseAspNetCore()
               .EnableTokenEndpointPassthrough()
               //EnableAuthorizationEndpointPassthrough: OpenID Connect request'lerinin Authorization Endpoint için aktifleştirilmesini sağlar.
               .EnableAuthorizationEndpointPassthrough();
       .
       .
       .
    });

    public class AuthorizationController : Controller
    {
        readonly IOpenIddictApplicationManager _applicationManager;

        public AuthorizationController(IOpenIddictApplicationManager applicationManager)
        {
            _applicationManager = applicationManager;
        }

        //Bu action'ın endpoint'ini token endpoint ile aynı şekilde ayarlıyoruz.
        [HttpPost("~/connect/token"), Produces("application/json")]
        public async Task<IActionResult> Exchange()
        {
            .
            .
            .
        }

        [HttpGet("~/connect/authorize"), HttpPost("~/connect/authorize")]
        public async Task<IActionResult> Authorize(string accept, string deny)
        {
            var request = HttpContext.GetOpenIddictServerRequest() ?? throw new InvalidOperationException("The OpenID Connect request cannot be retrieved.");

            //Cookie'de authentication için tutulan veriden kullanıcı bilgisini alıyoruz.
            var result = await HttpContext.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            //Eğer kullanıcı bilgisi yoksa kullanıcıyı login sayfasına yönlendiriyoruz.
            if (!result.Succeeded)
                return Challenge(
                    authenticationSchemes: CookieAuthenticationDefaults.AuthenticationScheme,
                    properties: new AuthenticationProperties()
                    {
                        RedirectUri = $"{Request.PathBase}{Request.Path}{(QueryString.Create(Request.HasFormContentType ? Request.Form.ToList() : Request.Query.ToList()))}"
                    });

            var identity = new ClaimsIdentity(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
            identity.AddClaim(OpenIddictConstants.Claims.Subject, result.Principal.Identity.Name, Destinations.AccessToken);
            identity.AddClaim(JwtRegisteredClaimNames.Aud, "Example-OpenIddict", Destinations.AccessToken, Destinations.IdentityToken);
            identity.AddClaim("ornek-claim", "ornek claim value", Destinations.AccessToken);

            var application = await _applicationManager.FindByClientIdAsync(request.ClientId);
            if (HttpContext.Request.Method == "GET")
                return View(new AuthorizeVM
                {
                    ApplicationName = await _applicationManager.GetLocalizedDisplayNameAsync(application),
                    Scopes = request.Scope
                });
            else if (!string.IsNullOrEmpty(accept))
            {
                var claimsPrincipal = new ClaimsPrincipal(identity);
                claimsPrincipal.SetScopes(request.GetScopes());

                return SignIn(claimsPrincipal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
            }

            return Forbid(authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                properties: new AuthenticationProperties(new Dictionary<string, string>
                {
                    [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidScope
                }));
        }
    }

@using Microsoft.Extensions.Primitives
@using OpenIddict.AuthorizationServer.ViewModels
@model AuthorizeVM
<div class="jumbotron">
    <h1>Yetki Onaylama</h1>

    <p class="lead text-left"><strong>@Model.ApplicationName</strong> uygulamasına erişim yetkisi vermek istiyor musunuz? (Beklenen yetkiler: @Model.Scopes)</p>

    <form asp-controller="Authorization" asp-action="Authorize" method="post">
        @foreach (var parameter in Context.Request.HasFormContentType ?
        (IEnumerable<KeyValuePair<string, StringValues>>)Context.Request.Form : Context.Request.Query)
        {
            <input type="hidden" name="@parameter.Key" value="@parameter.Value" />
        }

        <input class="btn btn-lg btn-success" name="accept" type="submit" value="Yes" />
        <input class="btn btn-lg btn-danger" name="deny" type="submit" value="No" />
    </form>
</div>

    public class AuthorizeVM
    {
        public string ApplicationName { get; set; }
        public string Scopes { get; set; }
        public string Button { get; set; }
    }

    public class AuthorizationController : Controller
    {
        readonly IOpenIddictApplicationManager _applicationManager;

        public AuthorizationController(IOpenIddictApplicationManager applicationManager)
        {
            _applicationManager = applicationManager;
        }

        //Bu action'ın endpoint'ini token endpoint ile aynı şekilde ayarlıyoruz.
        [HttpPost("~/connect/token"), Produces("application/json")]
        public async Task<IActionResult> Exchange()
        {
            var request = HttpContext.GetOpenIddictServerRequest();


            if (request?.IsAuthorizationCodeGrantType() is not null)
            {
                //Authorization Code'da store edilen request sorumlusunu elde ediyoruz.
                var principal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;

                //Principal'ı yani kullanıcıyı doğrula
                //if ((await _userManager.GetUserAsnyc(principal)) != null)
                //{

                //}

                return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);

            }
            else if (request?.IsClientCredentialsGrantType() is not null)
            {
                .
                .
                return SignIn(claimsPrincipal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
            }
            throw new NotImplementedException("The specified grant type is not implemented.");
        }

        [HttpGet("~/connect/authorize"), HttpPost("~/connect/authorize")]
        public async Task<IActionResult> Authorize(string accept, string deny)
        {
            .
            .
            .
        }
    }

    public class ClientsController : Controller
    {
        readonly IOpenIddictApplicationManager _openIddictApplicationManager;

        public ClientsController(IOpenIddictApplicationManager openIddictApplicationManager)
        {
            _openIddictApplicationManager = openIddictApplicationManager;
        }

        .
        .
        .

        [HttpPost]
        public async Task<IActionResult> CreateClient(ClientCreateVM model)
        {
            var client = await _openIddictApplicationManager.FindByClientIdAsync(model.ClientId);
            if (client is null)
            {
                await _openIddictApplicationManager.CreateAsync(new OpenIddictApplicationDescriptor
                {
                    ClientId = model.ClientId,
                    ClientSecret = model.ClientSecret,
                    DisplayName = model.DisplayName,
                    RedirectUris = { new("https://oauth.pstmn.io/v1/callback") },
                    Permissions =
                    {
                        OpenIddictConstants.Permissions.Endpoints.Token,
                        OpenIddictConstants.Permissions.Endpoints.Authorization,

                        OpenIddictConstants.Permissions.GrantTypes.ClientCredentials,
                        OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,

                        OpenIddictConstants.Permissions.Prefixes.Scope + "read",
                        OpenIddictConstants.Permissions.Prefixes.Scope + "write",

                        OpenIddictConstants.Permissions.ResponseTypes.Code,
                    }
                });
                ViewBag.Message = "Client başarıyla oluşturulmuştur.";
                return View();
            }
            ViewBag.Message = "Client zaten mevcuttur.";
            return View();
        }
    }

        .
        .
        RedirectUris = { new("https://filanca.com/...") },

using Client.Models;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using OpenIddict.Client;
using static OpenIddict.Abstractions.OpenIddictConstants;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllersWithViews();

builder.Services.AddDbContext<ApplicationDbContext>(options =>
{
    options.UseSqlServer(builder.Configuration.GetConnectionString("SQLServer"));
    options.UseOpenIddict();
});

builder.Services.AddAuthentication(options => options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
    {
        options.LoginPath = "/login";
        options.ExpireTimeSpan = TimeSpan.FromMinutes(15);
    });

builder.Services.AddOpenIddict()
    .AddCore(options =>
    {
        options.UseEntityFrameworkCore()
        .UseDbContext<ApplicationDbContext>();

        //Burada MongoDB kullanmak isterseniz aşağıdaki yapılandırma kodlarından istifade edebilirsiniz.
        // options.UseMongoDb()
        //        .UseDatabase(new MongoClient().GetDatabase("openiddict"));
    })
    //OpenIddict client componentinin yapılandırması.
    .AddClient(options =>
    {
        options.SetRedirectionEndpointUris("/callback/login/local");
        options.SetPostLogoutRedirectionEndpointUris("/callback/logout/local");

        options.AddDevelopmentEncryptionCertificate()
               .AddDevelopmentSigningCertificate();

        options.UseAspNetCore()
                      .EnableStatusCodePagesIntegration()
                      .EnableRedirectionEndpointPassthrough()
                      .EnablePostLogoutRedirectionEndpointPassthrough();

        options.UseSystemNetHttp();

        options.AddRegistration(new OpenIddictClientRegistration
        {
            Issuer = new Uri("https://localhost:7047", UriKind.Absolute),

            ClientId = "my-client",
            ClientSecret = "my-client-secret",
            Scopes = { "read", "write" },

            RedirectUri = new Uri("https://localhost:7226/callback/login/local", UriKind.Absolute),
            PostLogoutRedirectUri = new Uri("https://localhost:7226/callback/logout/local", UriKind.Absolute),
        });
    });

builder.Services.AddHttpClient();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");

app.Run();

    public class AuthenticationController : Controller
    {
        [HttpGet("~/login")]
        public IActionResult LogIn(string returnUrl)
        {
            var properties = new AuthenticationProperties(new Dictionary<string, string?>
            {
                [OpenIddictClientAspNetCoreConstants.Properties.Issuer] = "https://localhost:7047"
            });
            properties.RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/";

            //Challenge metodu ile OpenIddict middleware'ı sayesinde ilgili Issuer'a karşılık gelen client bilgilerini authorization server'a yönlendiriyoruz.
            return Challenge(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
        }

        [HttpPost("~/logout"), ValidateAntiForgeryToken]
        public async Task<ActionResult> LogOut(string returnUrl)
        {
            //Elde bulunan authentication cookie bilgilerini elde ediyoruz. Eğer yoksa zaten kullanıcının henüz oturum açmadığını anlıyoruz.
            var result = await HttpContext.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            if (result is not { Succeeded: true })
                return Redirect(Url.IsLocalUrl(returnUrl) ? returnUrl : "/");

            //SignOut yaparak mevcut authentication cookie bilgilerini temizliyoruz.
            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);

            var properties = new AuthenticationProperties(new Dictionary<string, string?>
            {
                [OpenIddictClientAspNetCoreConstants.Properties.Issuer] = "https://localhost:7047",
                [OpenIddictClientAspNetCoreConstants.Properties.IdentityTokenHint] = result.Properties.GetTokenValue(OpenIddictClientAspNetCoreConstants.Tokens.BackchannelIdentityToken)
            });
            properties.RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "/";

            return SignOut(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
        }

        [HttpGet("~/callback/login/{provider}"), HttpPost("~/callback/login/{provider}"), IgnoreAntiforgeryToken]
        public async Task<ActionResult> LogInCallback()
        {
            // OpenIddict tarafından doğrulanan yetkilendirme verilerini elde ediyoruz.
            var result = await HttpContext.AuthenticateAsync(OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);

            if (result.Principal.Identity is not ClaimsIdentity { IsAuthenticated: true })
            {
                throw new InvalidOperationException("The external authorization data cannot be used for authentication.");
            }

            var claims = new List<Claim>(result.Principal.Claims
                .Select(claim => claim switch
                {
                    { Type: Claims.Subject }
                        => new Claim(ClaimTypes.NameIdentifier, claim.Value, claim.ValueType, claim.Issuer),
                    { Type: Claims.Name }
                        => new Claim(ClaimTypes.Name, claim.Value, claim.ValueType, claim.Issuer),
                    _ => claim
                })
                .Where(claim => claim switch
                {
                    { Type: ClaimTypes.NameIdentifier or ClaimTypes.Name } => true,
                    _ => false
                }));

            var identity = new ClaimsIdentity(claims,
                authenticationType: CookieAuthenticationDefaults.AuthenticationScheme,
                nameType: ClaimTypes.Name,
                roleType: ClaimTypes.Role);

            var properties = new AuthenticationProperties(result.Properties.Items);

            // Gerekirse authorization server tarafından döndürülen tokenlar authentication cookie'de de saklanabilir.
            properties.StoreTokens(result.Properties.GetTokens().Where(token => token switch
            {
                {
                    Name: OpenIddictClientAspNetCoreConstants.Tokens.BackchannelAccessToken or
                          OpenIddictClientAspNetCoreConstants.Tokens.BackchannelIdentityToken or
                          OpenIddictClientAspNetCoreConstants.Tokens.RefreshToken
                } => true,
                _ => false
            }));

            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity), properties);

            return Redirect(properties.RedirectUri);
        }

        [HttpGet("~/callback/logout/{provider}"), HttpPost("~/callback/logout/{provider}"), IgnoreAntiforgeryToken]
        public async Task<ActionResult> LogOutCallback()
        {
            var result = await HttpContext.AuthenticateAsync(OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);
            return Redirect(result!.Properties!.RedirectUri);
        }
    }

    public class HomeController : Controller
    {
        readonly IHttpClientFactory _httpClientFactory;

        public HomeController(IHttpClientFactory httpClientFactory)
            => _httpClientFactory = httpClientFactory;

        public IActionResult Index()
            => View();

        [HttpPost]
        [Authorize]
        public async Task<IActionResult> Index(CancellationToken cancellationToken)
        {
            string? token = await HttpContext.GetTokenAsync(CookieAuthenticationDefaults.AuthenticationScheme, OpenIddictClientAspNetCoreConstants.Tokens.BackchannelAccessToken);

            using HttpClient httpClient = _httpClientFactory.CreateClient();
            using HttpRequestMessage httpRequestMessage = new(HttpMethod.Get, "https://localhost:7056/api/values/a");
            httpRequestMessage.Headers.Authorization = new("Bearer", token);

            using HttpResponseMessage httpResponseMessage = await httpClient.SendAsync(httpRequestMessage, cancellationToken);

            return View(model: await httpResponseMessage.Content.ReadAsStringAsync(cancellationToken));
        }
    }

@model string

@{
    ViewData["Title"] = "Home Page";
}

<div class="text-center">
    <h1 class="display-4">Welcome</h1>
    <p>Learn about <a href="https://docs.microsoft.com/aspnet/core">building Web apps with ASP.NET Core</a>.</p>
</div>

<form asp-action="Index" asp-controller="Home">
    <button>İstek Yap</button>
</form>
<form asp-action="Logout" asp-controller="Authentication" method="post">
    <button class="btn btn-lg btn-danger" type="submit">Sign out</button>
</form>

<p>
    @Model
</p>