\nhttps:\/\/localhost:4000\/api\/auths?userName<\/span>=gncy&password<\/span>=12345<\/code>\n<\/div>\nPeki hocam, neden Startup.cs dosyas\u0131nda Authentication servisini uygulamaya dahil etmedik?<\/strong> \n‘AuthAPI’ projesi, yukar\u0131da ifade etti\u011fimiz gibi sade ve sadece token \u00fcretiminden sorumlu bir servistir. ‘Startup.cs’ dosyas\u0131nda Authentication servisini eklemek demek, bu uygulamada kimlik do\u011frulama i\u015flemi yap\u0131lacak demektir. Halbuki bizler sadece token \u00fcretece\u011fiz. Amma velakin ‘ProductAPI’, ‘CustomerAPI’ ve ‘APIGateway’ sevislerinde kullan\u0131c\u0131 denetimi sa\u011flanaca\u011f\u0131 i\u00e7in ‘Startup.cs’ dosyas\u0131nda authentication mod\u00fcl\u00fc y\u00fcklenecek ve b\u00f6ylece gelen isteklerde kimlik do\u011frulama i\u015flemleri aktifle\u015ftirilmi\u015f olacakt\u0131r.<\/p>\n ‘AuthAPI’ projesini de geli\u015ftirdikten sonra s\u0131ra ‘ProductAPI’ ve ‘CustomerAPI’ projelerine gelmi\u015f bulunmaktad\u0131r. \u00d6rneklendirmemizde authentication yap\u0131lanmas\u0131n\u0131n \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 daha net test edebilmek i\u00e7in bu projelerden birinde(ProductAPI) authorize ile kontrol i\u015flemi ger\u00e7ekle\u015ftirecek, di\u011ferinde(CustomerAPI) ise serbest eri\u015fim sa\u011flayaca\u011f\u0131z.<\/p>\n ProductAPI;<\/u><\/p>\n\r\n [ApiController]\r\n [Route("api\/[controller]")]\r\n [Authorize]\r\n public class ProductsController : ControllerBase\r\n {\r\n public IActionResult Get()\r\n {\r\n return Ok(new List<string> {\r\n "Telefon", "Terlik", "Kalem", "Ka\u011f\u0131t", "Ampul", "Ka\u011f\u0131t"\r\n });\r\n }\r\n }\r\n<\/pre>\nYukar\u0131da bahsedildi\u011fi gibi \u00fcr\u00fcn i\u015flemlerini ger\u00e7ekle\u015ftirece\u011fimiz ‘ProductAPI’ i\u00e7erisindeki olu\u015fturulan bu farazi controller’da authorize i\u015flemi yap\u0131lmaktad\u0131r. Dolay\u0131s\u0131yla ilgili uygulama yap\u0131lan isteklerde bir kimlik do\u011frulamas\u0131 ger\u00e7ekle\u015ftirmek zorunda. Bunun i\u00e7in ‘Startup.cs’ dosyas\u0131nda a\u015fa\u011f\u0131daki gibi ‘AddAuthentication’ ile birlikte ‘AddJwtBearer’ servislerinin eklenmesi ve temel konfig\u00fcrasyonlar\u0131n\u0131n yap\u0131lmas\u0131 gerekmektedir;<\/p>\n\r\n public class Startup\r\n {\r\n .\r\n .\r\n .\r\n public void ConfigureServices(IServiceCollection services)\r\n {\r\n SymmetricSecurityKey signInKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JWT:Security"]));\r\n string authenticationProviderKey = "TestKey";\r\n services.AddAuthentication(option => option.DefaultAuthenticateScheme = authenticationProviderKey)\r\n .AddJwtBearer(authenticationProviderKey, options =>\r\n {\r\n options.RequireHttpsMetadata = false;\r\n options.TokenValidationParameters = new TokenValidationParameters\r\n {\r\n ValidateIssuerSigningKey = true,\r\n IssuerSigningKey = signInKey,\r\n ValidateIssuer = true,\r\n ValidIssuer = _configuration["JWT:Issuer"],\r\n ValidateAudience = true,\r\n ValidAudience = _configuration["JWT:Audience"],\r\n ValidateLifetime = true,\r\n ClockSkew = TimeSpan.Zero,\r\n RequireExpirationTime = true\r\n };\r\n });\r\n services.AddControllers();\r\n }\r\n\r\n public void Configure(IApplicationBuilder app, IWebHostEnvironment env)\r\n {\r\n .\r\n .\r\n .\r\n app.UseAuthentication();\r\n app.UseAuthorization();\r\n .\r\n .\r\n .\r\n }\r\n }\r\n<\/pre>\nBu servisler sayesinde bizler uygulamaya kimlik do\u011frulama niteli\u011fini kazand\u0131rm\u0131\u015f bulunmaktay\u0131z. Ayr\u0131ca bu sevisleri ekleyebilmek i\u00e7in ‘AuthAPI’da oldu\u011fu gibi bu uygulamayada ‘Microsoft.IdentityModel.Tokens<\/a>‘ ve ‘System.IdentityModel.Tokens.Jwt<\/a>‘ k\u00fct\u00fcphanelerinin yan\u0131nda Microsoft.AspNetCore.Authentication.JwtBearer<\/a> k\u00fct\u00fcphanesinin eklenmesi gerekmektedir.<\/p>\n \ndotnet add package Microsoft.IdentityModel.Tokens<\/code> \ndotnet add package System.IdentityModel.Tokens.Jwt<\/code> \ndotnet add package Microsoft.AspNetCore.Authentication.JwtBearer<\/code>\n<\/p><\/blockquote>\n Velhas\u0131l yukar\u0131daki kod blo\u011funu inceledi\u011fimizde, 11.<\/strong><\/em> sat\u0131rdaki ‘AddJwtBearer’ servisine ‘authenticationProviderKey’ de\u011fi\u015fkenindeki ‘TestKey’ de\u011ferinin verildi\u011fine dikkatinizi \u00e7ekerim. Bu de\u011fer bizler i\u00e7in kimlik do\u011frulama s\u00fcrecinde bir authentication scheme g\u00f6revi g\u00f6recektir. \u0130\u00e7eri\u011fimizin devam\u0131nda ‘APIGateway’ projesi i\u00e7inde yapaca\u011f\u0131m\u0131z birebir ayn\u0131 konfig\u00fcrasyonlar neticesinde, gelen ve Ocelot taraf\u0131ndan do\u011frulanacak iste\u011fi bu \u015fema ile ay\u0131rt edebilecek ve ‘ProductAPI’ ile ili\u015fkilendirece\u011fiz. B\u00f6ylece orada(APIGateway) do\u011frulanan token burada da(ProductAPI) do\u011frulanm\u0131\u015f olacakt\u0131r. Ayriyetten 35<\/strong><\/em> ve 36.<\/strong><\/em> sat\u0131rlara g\u00f6z atarsan\u0131z e\u011fer ‘UseAuthentication’ ve ‘UseAuthorization’ middleware’leri \u00e7a\u011fr\u0131larak uygulamada \u00fczerine \u00e7al\u0131\u015f\u0131lan t\u00fcm servisler i\u015flevsel hale getirilmi\u015f olmaktad\u0131r.<\/p>\n Son olarak ‘appsettings.json’ dosyas\u0131na a\u015fa\u011f\u0131daki konfig\u00fcrasyon datalar\u0131n\u0131 yerle\u015ftirelim.<\/p>\n \r\n "JWT": {\r\n "Security": "ocelot authentication example project",\r\n "Issuer": "https:\/\/localhost:4000",\r\n "Audience": "Ocelot Example"\r\n }\r\n<\/pre>\nBurada dikkat edilmesi gereken m\u00fchim bir husus mevcuttur! O da \u015fudur ki, token de\u011ferini \u00fcreten servisteki(AuthAPI) konfig\u00fcrasyon de\u011ferleri ile bu token’\u0131 kullanacak olan t\u00fcm servislerdeki konfig\u00fcrasyon de\u011ferlerinin birebir ayn\u0131 olmas\u0131 gerekti\u011fidir. Bunun nedeni, do\u011frulama esnas\u0131nda ilgili servisin gelen token’da ki \u015fifrelenmi\u015f datalar\u0131n\u0131n ge\u00e7erlili\u011fini verilen datalarla check etmesidir.<\/p>\nToken \u00fcreten servis ile o token’\u0131 kullanan servisler ayn\u0131 konfig\u00fcrasyon de\u011ferlerini baz almal\u0131d\u0131rlar.<\/em><\/strong><\/p><\/blockquote>\n CustomerAPI;<\/u> \n‘CustomerAPI’ uygulamas\u0131 i\u00e7erisinde ise a\u015fa\u011f\u0131daki gibi bir controller tasarlanmas\u0131 i\u00e7eri\u011fimiz a\u00e7\u0131s\u0131ndan olduk\u00e7a yeterli olacakt\u0131r;<\/p>\n\r\n [ApiController]\r\n [Route("api\/[controller]")]\r\n public class CustomersController : ControllerBase\r\n {\r\n public IActionResult Get()\r\n {\r\n return Ok(new List<string> {\r\n "Hilmi", "H\u00fcseyin", "R\u0131fk\u0131", "Necati", "\u015euayip", "Muallim", "Muiddin"\r\n });\r\n }\r\n }\r\n<\/pre>\n\u0130lgili serviste herhangi bir authentication i\u015flemi yapmayaca\u011f\u0131m\u0131z\u0131 yukar\u0131daki sat\u0131rlarda belirtti\u011fimizden dolay\u0131 geli\u015ftirilmesi bu kadard\u0131r…<\/p>\n\u015eimdi olu\u015fturdu\u011fumuz servisleri test etmek i\u00e7in hepsini dotnet build<\/strong><\/code> komutu ile derleyelim ve ard\u0131ndan dotnet run<\/strong><\/code> komutuyla aya\u011fa kald\u0131ral\u0131m. Ard\u0131ndan Postman uygulamas\u0131 arac\u0131l\u0131\u011f\u0131yla her bir servise ayr\u0131 ayr\u0131 ve biryandan da Ocelot arac\u0131l\u0131\u011f\u0131yla isteklerde bulunal\u0131m. B\u00f6ylece geli\u015ftirmede yapmam\u0131z gereken eksiklikleri daha rahat g\u00f6rebilecek ve taraf\u0131mca izah edebilece\u011fiz. \nAyr\u0131 ayr\u0131 yap\u0131lan istekler; \n<\/a> \nYukar\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcn\u00fc incelerseniz e\u011fer ‘ProductAPI’ servisi d\u0131\u015f\u0131ndaki di\u011fer servisler kusursuz \u00e7al\u0131\u015fmaktad\u0131rlar. S\u00f6z konusu servis ise yap\u0131lan authentication konfig\u00fcrasyonundan dolay\u0131 \u015f\u00f6yle bir hata vermektedir;<\/p>\n \nSystem.InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action configureOptions). \n<\/em><\/p><\/blockquote>\n Bu hatan\u0131n kayna\u011f\u0131 ilgili serviste yap\u0131lan authentication konfig\u00fcrasyonunun ‘TestKey’ gibi farkl\u0131 bir \u015fema ismiyle isimlendirilmesidir. E\u011fer ki \u015fema ad\u0131 ‘Bearer’ olsayd\u0131 bu hata ortadan kalkacak lakin herhangi bir token ile talepte bulunulmad\u0131\u011f\u0131ndan dolay\u0131 klasik 401 hatas\u0131 kar\u015f\u0131m\u0131za gelecekti. \u015eimdi yap\u0131lan bu \u00e7al\u0131\u015fmay\u0131 Ocelot \u00fczerinden test edelim ve tek tek t\u00fcm servislere istek g\u00f6nderelim.<\/p>\n Ocelot arac\u0131l\u0131\u011f\u0131yla yap\u0131lan istekler; \n<\/a> \nYukar\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcn\u00fc de incelerseniz e\u011fer Ocelot \u00fczerinden(APIGateway) yap\u0131lan t\u00fcm istek y\u00f6nlendirmelerinde yine sadece ‘ProductAPI’ hata vermektedir. Hatan\u0131n kayna\u011f\u0131 ve mesaj\u0131 \u00f6ncekiyle birebir ayn\u0131d\u0131r. Haliyle, istek Ocelot’dan da gelse de\u011fi\u015fen bi\u015fey olmamakta ve tekrardan hatayla kar\u015f\u0131la\u015f\u0131lmaktad\u0131r. \u0130\u015fte bu durumda Ocelot \u00fczerinden \u015femaya uygun authorization konfig\u00fcrasyonunun yap\u0131lmas\u0131 yeterli olacak ve hata ortadan kald\u0131r\u0131lacakt\u0131r. Bunun i\u00e7in ‘APIGateway’ projesindeki ‘ocelot.json’ dosyas\u0131nda a\u015fa\u011f\u0131daki ayarlaman\u0131n yap\u0131lmas\u0131 gerekmektedir;<\/p>\n \r\n{\r\n "Routes": [\r\n {\r\n "DownstreamPathTemplate": "\/api\/products",\r\n "DownstreamScheme": "https",\r\n "DownstreamHostAndPorts": [\r\n {\r\n "Host": "localhost",\r\n "Port": 1000\r\n }\r\n ],\r\n "UpstreamPathTemplate": "\/api\/products",\r\n "UpstreamHttpMethod": [ "Get" ],\r\n "AuthenticationOptions": {\r\n "AuthenticationProviderKey": "TestKey",\r\n "AllowedScopes": []\r\n }\r\n },\r\n {\r\n "DownstreamPathTemplate": "\/api\/customers",\r\n "DownstreamScheme": "https",\r\n "DownstreamHostAndPorts": [\r\n {\r\n "Host": "localhost",\r\n "Port": 2000\r\n }\r\n ],\r\n "UpstreamPathTemplate": "\/api\/customers",\r\n "UpstreamHttpMethod": [ "Get" ]\r\n },\r\n {\r\n "DownstreamPathTemplate": "\/api\/auths",\r\n "DownstreamScheme": "https",\r\n "DownstreamHostAndPorts": [\r\n {\r\n "Host": "localhost",\r\n "Port": 3000\r\n }\r\n ],\r\n "UpstreamPathTemplate": "\/api\/auths",\r\n "UpstreamHttpMethod": [ "Get" ]\r\n }\r\n ],\r\n "GlobalConfiguration": {\r\n "BaseUrl": "https:\/\/localhost:4000"\r\n }\r\n}\r\n<\/pre>\nBurada 14<\/em><\/strong> ile 17.<\/em><\/strong> sat\u0131rlar aras\u0131na dikkatimizi \u00e7ekersek e\u011fer ‘ProductAPI’ route’una \u00f6zel bir ‘AuthenticationOptions’ tan\u0131mland\u0131\u011f\u0131n\u0131 g\u00f6rece\u011fiz. Hemen ilgili alan\u0131 hususi olarak a\u015fa\u011f\u0131ya al\u0131rsak e\u011fer;<\/p>\n\r\n "AuthenticationOptions": {\r\n "AuthenticationProviderKey": "TestKey",\r\n "AllowedScopes": []\r\n }\r\n<\/pre>\ng\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere ilgili route’a bir authentication konfig\u00fcrasyonu sa\u011flamaktad\u0131r. ‘AuthenticationProviderKey’ alan\u0131 ile hangi \u015fema \u00fczerinden kimlik do\u011frulama i\u015flemi yap\u0131laca\u011f\u0131 bildirilmektedir. Ayriyetten bu tan\u0131mlaman\u0131n sade ve sadece authentication i\u015flemi yap\u0131lan route’lara yap\u0131lmas\u0131 gerekti\u011fini \u00f6zellikle vurgulamakta fayda g\u00f6rmekteyim.<\/p>\n Bu konfig\u00fcrasyondan sonra ‘APIGateway’ uygulamas\u0131na da ayn\u0131 \u015fema ad\u0131nda authentication servisinin dahil edilmesi gerekmektedir;<\/p>\n\r\n public class Startup\r\n {\r\n .\r\n .\r\n .\r\n public void ConfigureServices(IServiceCollection services)\r\n {\r\n SymmetricSecurityKey signInKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JWT:Security"]));\r\n\r\n string authenticationProviderKey = "TestKey";\r\n services.AddAuthentication(option => option.DefaultAuthenticateScheme = authenticationProviderKey)\r\n .AddJwtBearer(authenticationProviderKey, options =>\r\n {\r\n options.RequireHttpsMetadata = false;\r\n options.TokenValidationParameters = new TokenValidationParameters\r\n {\r\n ValidateIssuerSigningKey = true,\r\n IssuerSigningKey = signInKey,\r\n ValidateIssuer = true,\r\n ValidIssuer = _configuration["JWT:Issuer"],\r\n ValidateAudience = true,\r\n ValidAudience = _configuration["JWT:Audience"],\r\n ValidateLifetime = true,\r\n ClockSkew = TimeSpan.Zero,\r\n RequireExpirationTime = true\r\n };\r\n });\r\n services.AddOcelot();\r\n .\r\n .\r\n .\r\n }\r\n\r\n public async void Configure(IApplicationBuilder app, IWebHostEnvironment env)\r\n {\r\n .\r\n .\r\n .\r\n app.UseAuthentication();\r\n app.UseAuthorization();\r\n await app.UseOcelot();\r\n .\r\n .\r\n .\r\n }\r\n }\r\n<\/pre>\nT\u00fcm bu geli\u015ftirmelerden sonra servisleri derleyip, \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131m\u0131zda a\u015fa\u011f\u0131daki gibi bir i\u015flevsellikle kar\u015f\u0131la\u015faca\u011f\u0131z. \n<\/a> \nG\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere istek neticesinde token ge\u00e7erliyse hedef data, aksi taktirde 401 durum kodu d\u00f6nd\u00fcr\u00fclmektedir.<\/p>\n Alternatif Tasar\u0131m<\/h3>\nT\u00fcm servislerde authentication konfig\u00fcrasyonu i\u00e7in \u015femaya alternatif olarak default de\u011feri kullanabilirsiniz.<\/p>\n\r\n SymmetricSecurityKey signInKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JWT:Security"]));\r\n\r\n services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)\r\n .AddJwtBearer( options =>\r\n {\r\n options.RequireHttpsMetadata = false;\r\n options.TokenValidationParameters = new TokenValidationParameters\r\n {\r\n ValidateIssuerSigningKey = true,\r\n IssuerSigningKey = signInKey,\r\n ValidateIssuer = true,\r\n ValidIssuer = _configuration["JWT:Issuer"],\r\n ValidateAudience = true,\r\n ValidAudience = _configuration["JWT:Audience"],\r\n ValidateLifetime = true,\r\n ClockSkew = TimeSpan.Zero,\r\n RequireExpirationTime = true\r\n };\r\n });\r\n<\/pre>\n\r\n "AuthenticationOptions": {\r\n "AuthenticationProviderKey": "Bearer",\r\n "AllowedScopes": []\r\n }\r\n<\/pre>\n\u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\nNot: \u00d6rnek uygulamay\u0131 indirmek i\u00e7in buraya<\/a> t\u0131klay\u0131n\u0131z.<\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, \u00d6nceki .NET Core Microservices \u2013 Ocelot API Gateway ba\u015fl\u0131kl\u0131 makalemizde bir Gateway k\u00fct\u00fcphanesi olan Ocelot’un; microservice’ler aras\u0131 ge\u00e7i\u015f g\u00f6revi g\u00f6ren sorumlulu\u011fundan, deploy tasar\u0131mlar\u0131ndan, pratik olarak nas\u0131l kullan\u0131ld\u0131\u011f\u0131ndan ve daha bir\u00e7ok \u00f6zelli\u011finden detayl\u0131ca bahsetmi\u015f...<\/p>\n","protected":false},"author":1,"featured_media":18075,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3573],"tags":[3825,3824],"class_list":["post-18073","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microservices","tag-microservice-authentication","tag-ocelot-authentication"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/18073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=18073"}],"version-history":[{"count":84,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/18073\/revisions"}],"predecessor-version":[{"id":18162,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/18073\/revisions\/18162"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/18075"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=18073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=18073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=18073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}