<\/div>\n

Merhaba,<\/p>\n

IdentityServer4 Yaz\u0131 Serisi<\/a>nin bir \u00f6nceki kaleme ald\u0131\u011f\u0131m\u0131z Merkezi \u00dcyelik Sistemi Temelleri ba\u015fl\u0131kl\u0131 makalemizde client’\u0131n Auth Server’dan authorization code almas\u0131n\u0131 ba\u015farm\u0131\u015f ve client \u00fczerinde authorize olan k\u0131s\u0131mlara yetkili bir \u015fekilde eri\u015fimi test etmi\u015ftik. Bu i\u00e7eri\u011fimizde ise Auth Server’dan elde edilen authorization code \u00fczerinde bulunan ve client’a g\u00f6nderilen claim’lerin ve ‘Authentication Propertyleri’nin nas\u0131l okundu\u011funu\/elde edildi\u011fini inceleyece\u011fiz.<\/p>\n

\u00d6ncelikle Claim ve Authentication Property terimlerinin ne oldu\u011funu a\u00e7\u0131klayarak ba\u015flayal\u0131m;<\/p>\n

Claim Nedir?<\/strong>
\n\u00d6nceden klavyeye alm\u0131\u015f oldu\u011fumuz Claim Bazl\u0131 Kimlik Do\u011frulama<\/a> ba\u015fl\u0131kl\u0131 yaz\u0131m\u0131zda yahut bu serinin d\u00f6rd\u00fcnc\u00fc makalesi olan IdentityServer4 Cleam Bazl\u0131 Yetkilendirme<\/a> ba\u015fl\u0131kl\u0131 i\u00e7eri\u011fimizde claim hakk\u0131nda yeterlice hasbihalde bulunmu\u015ftuk. Dolay\u0131s\u0131yla \u015fuana kadar claim’in ne oldu\u011funu \u00e7ok iyi bilmeniz y\u00fcksek ihtimal oldu\u011fundan dolay\u0131 ne olur ne olmaz diyerek k\u00fc\u00e7\u00fck bir a\u00e7\u0131klama yap\u0131p \u00e7ok fazla tan\u0131ma girmeden ge\u00e7mekte fayda g\u00f6r\u00fcyorum..<\/p>\n
Claim; kullan\u0131c\u0131 hakk\u0131nda key – value tarz\u0131nda tutulan ekstra bilgilerdir.\n<\/li>\n

Authentication Property Nedir?<\/strong>
\nAuthorization code i\u00e7erisinde ta\u015f\u0131nan ve access token, id token, refresh token vs. gibi bilgileri tutan propertylerdir.\n<\/li>\n<\/ul>\n
Claim’lere Eri\u015fim?<\/h3>\n
Authorization code i\u00e7erisindeki claim’lere eri\u015febilmek i\u00e7in controller s\u0131n\u0131flarda User.Claims<\/code> komutunun kullan\u0131lmas\u0131 yeterlidir. Gelen claim’lere g\u00f6z atarsak e\u011fer; \n<\/a><\/p>\n
\nsid<\/em><\/strong> \nOpenIdConnect taraf\u0131ndan kullan\u0131c\u0131ya \u00f6zel \u00fcretilen kullan\u0131c\u0131 Id(subid)’yi ifade eder.<\/li>\n http:\/\/schemas.xmlsoap.org\/ws\/2005\/05\/identity\/claims\/nameidentifier<\/em><\/strong> \nKullan\u0131n\u0131n Subject Id’sine(hat\u0131rlarsan\u0131z e\u011fer test user tan\u0131mlarken bildirmi\u015ftik)<\/span> manuel eri\u015fmek gerekti\u011finde bu sabit \u00fczerinden elde edilebilir. Otomatik \u015femad\u0131r. <\/li>\n auth_time<\/em><\/strong> \nSaniye cinsinden yetki s\u00fcresini ifade eder.<\/li>\n http:\/\/schemas.microsoft.com\/identity\/claims\/identityprovider<\/em><\/strong> \nHangi sa\u011flay\u0131c\u0131 \u00fczerinden giri\u015f yap\u0131ld\u0131ysa onun bilgisini d\u00f6ner. Misal; Facebook ya da Google \u00fczerinden yetki al\u0131nsayd\u0131 ilgili harici kayna\u011f\u0131n ad\u0131 ge\u00e7iyor olacakt\u0131.\n<\/li>\nhttp:\/\/schemas.microsoft.com\/claims\/authnmethodsreferences<\/em><\/strong> \nYetkilendirme s\u00fcrecinde hangi ak\u0131\u015f mekanizmas\u0131n\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 ifade eder. ‘pwd’, Resource Owner Credentials Grant(Flow)<\/a>‘a kar\u015f\u0131l\u0131k gelmektedir.\n<\/li>\n<\/ul>\nEvet… Gelen claim’ler i\u015fte bu kadar. \u015eimdi muhtemelen bir \u00f6nceki<\/a> makalemizde olu\u015fturulan test user’lar da tan\u0131mlad\u0131\u011f\u0131m\u0131z ve ‘IdentityResource’ i\u00e7erisinde new IdentityResources.Profile()<\/code> komutu ile authorization code’a eklenmesini s\u00f6yledi\u011fimiz claim’lerin neden gelmedi\u011fini soruyor olabilirsiniz.<\/p>\n\n\n\n\n\n\nTest User<\/th>\n IdentityResource<\/th>\n<\/tr>\n<\/thead>\n <\/a><\/td>\n <\/a><\/td>\n<\/tr>\n \u0130lgili claim’lerin eklendi\u011fi noktalardaki g\u00f6rseller…<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nBu claim’lerin User.Claims<\/code>‘e eklenmemesinin sebebi ilgili cookie yahut token de\u011ferinin \u015fi\u015firilmemesidir. \u0130\u015flevsel olarak IdentityServer4 k\u00fct\u00fcphanesi UserInfo Endpoint’i \u00fczerinden kullan\u0131c\u0131ya dair t\u00fcm claim’lerin eri\u015filebilir olmas\u0131n\u0131 sa\u011flamaktad\u0131r. Dolay\u0131s\u0131yla ihtiya\u00e7 yahut istek neticesinde ilgili de\u011ferlerin elde edilebilmesi i\u00e7in bahsedilen endpoint’in kullan\u0131lmas\u0131 inisiyatife ba\u011fl\u0131 olaca\u011f\u0131ndan dolay\u0131 framework geli\u015ftiricileri, default olarak harici claim’lerin cookie yahut token’a eklenmesini performans a\u00e7\u0131s\u0131ndan uygun g\u00f6rmemi\u015ftir.<\/p>\n Tabi ki de bu durum, istenildi\u011fi taktirde kullan\u0131c\u0131ya dair t\u00fcm claim’lerin \u00fcretilecek cookie ya da token de\u011ferine eklenmesini engelleyen bir durum demek de\u011fildir. E\u011fer ki t\u00fcm claim’lerin otomatik olarak cookie ya da token de\u011ferine eklenmesini istiyorsan\u0131z ilgili client’\u0131n ‘Startup.cs’ dosyas\u0131nda a\u015fa\u011f\u0131daki gibi ‘GetClaimsFromUserInfoEndpoint’ konfig\u00fcrasyonunun yap\u0131lmas\u0131 yeterli olacakt\u0131r.<\/p>\n \r\n public class Startup\r\n {\r\n public void ConfigureServices(IServiceCollection services)\r\n {\r\n services.AddAuthentication(_ =>\r\n {\r\n _.DefaultScheme = "OnlineBankamatikCookie";\r\n _.DefaultChallengeScheme = "oidc";\r\n })\r\n .AddCookie("OnlineBankamatikCookie")\r\n .AddOpenIdConnect("oidc", _ =>\r\n {\r\n _.SignInScheme = "OnlineBankamatikCookie";\r\n _.Authority = "https:\/\/localhost:1000";\r\n _.ClientId = "OnlineBankamatik";\r\n _.ClientSecret = "onlinebankamatik";\r\n _.ResponseType = "code id_token";\r\n _.GetClaimsFromUserInfoEndpoint = true;\r\n });\r\n services.AddControllersWithViews();\r\n }\r\n }\r\n<\/pre>\n‘GetClaimsFromUserInfoEndpoint’ propertysine ‘true’ de\u011ferini set ederek, olu\u015fturulacak cookie yahut token de\u011ferlerine sistemde tan\u0131mlanm\u0131\u015f olan t\u00fcm claim’leri eklemi\u015f bulunmaktay\u0131z. Burada mimari, arkaplanda Userinfo Endpoint’ine t\u00fcm claim’ler i\u00e7in istek g\u00f6ndererek \u00e7al\u0131\u015fmay\u0131 sergileyecektir.<\/p>\n GetClaimsFromUserInfoEndpoint; claim’lerden, profil i\u00e7in default olarak tan\u0131mlanm\u0131\u015f olan de\u011ferleri getirecektir. name<\/code>, family_name<\/code>, given_name<\/code>, middle_name<\/code>, nickname<\/code>, preferred_username<\/code>, profile<\/code>, picture<\/code>, website<\/code>, gender<\/code>, birthdate<\/code>, zoneinfo<\/code>, locale<\/code>, updated_at<\/code><\/p><\/blockquote>\n Bu ayar l\u00fczumlu l\u00fczumsuz her cookie yahut token \u00fcretiminde kullan\u0131c\u0131ya dair t\u00fcm claim’leri ekleyecektir. Halbuki bizler bu claim’lere eri\u015fimi daha iradeli bir \u015fekilde ger\u00e7ekle\u015ftirmek ve ihtiyaca istinaden elde etmek istiyorsak Userinfo Endpoint’ini kullanmam\u0131z gerekmektedir.<\/p>\n Authentication Propertylere Eri\u015fim?<\/h3>\nAuthentication propertyler; ‘Access Token’, ‘ID Token’ ve ‘Refresh Token’ olmak \u00fczere temelde \u00fc\u00e7 tanedirler. Auth Server’dan gelen authentication property’lere controller s\u0131n\u0131flar\u0131ndan eri\u015febilmek i\u00e7in (await HttpContext.AuthenticateAsync()).Properties.Items<\/code> kod konseptinin kullan\u0131lmas\u0131 yeterli olacakt\u0131r.<\/p>\n \u0130stek neticesinde gelen authentication property’lere g\u00f6z atarsak e\u011fer; \n<\/a> \ng\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere belli ba\u015fl\u0131 de\u011ferler gelmi\u015f bulunmakta lakin hi\u00e7biri operasyonel a\u00e7\u0131dan bizim i\u00e7in bir anlam ifade etmemektedir. Hani hoca! Access token, refresh token ve id token nerede?<\/strong><\/em> diye sordu\u011funuzu duyar gibiyim \ud83d\ude42 Evet, b\u00f6ylece authentication property’ler i\u00e7erisinde ilgili de\u011ferlerin default olarak gelmedi\u011fini ve \u00f6zellikle ad\u0131 ge\u00e7en parametrelere eri\u015febilmek i\u00e7in ekstradan bildirilerde bulunmam\u0131z gerekti\u011fini anlam\u0131\u015f bulunmaktay\u0131z.<\/p>\n \u015eimdi s\u0131ras\u0131yla bu propertylere nas\u0131l eri\u015filebildi\u011fini inceleyelim;<\/p>\n \nAccess Token<\/strong> \nClient’\u0131n API’lere eri\u015fiminde temel yetkiyi sa\u011flayacak olan access token de\u011ferinin elde edilebilmesi i\u00e7in ilgili client’\u0131n ‘Startup.cs’ dosyas\u0131nda ‘SaveTokens’ property’sine ‘true’ de\u011feri set edilmelidir. B\u00f6ylece Auth server’dan ilgili access token de\u011feri client taraf\u0131ndan elde edilmi\u015f olacakt\u0131r.<\/p>\n\r\n services.AddAuthentication(_ =>\r\n {\r\n _.DefaultScheme = "OnlineBankamatikCookie";\r\n _.DefaultChallengeScheme = "oidc";\r\n })\r\n .AddCookie("OnlineBankamatikCookie")\r\n .AddOpenIdConnect("oidc", _ =>\r\n {\r\n .\r\n .\r\n .\r\n _.SaveTokens = true;\r\n });\r\n<\/pre>\n‘SaveTokens’ \u00f6zelli\u011fi varsay\u0131lan olarak ‘false’ de\u011ferine sahiptir. ‘true’ de\u011feri set edildikten sonra i\u015flevsel olarak, ba\u015far\u0131l\u0131 bir authorization i\u015fleminin ard\u0131ndan Authentication Propertylere access token de\u011ferini kaydedecektir. Dolay\u0131s\u0131yla bizler bu de\u011feri kullanarak hedef API’lardan veri transferini sa\u011flayabilece\u011fiz.<\/p>\nIdentity Server taraf\u0131ndan \u00fcretilen bir access token’\u0131n default \u00f6mr\u00fc 1 saattir.<\/em><\/p><\/blockquote>\n E\u011fer ki, \u00fcretilecek access token’\u0131n \u00f6mr\u00fcn\u00fc siz belirlemek istiyorsan\u0131z Auth Server’da ki ‘Config.cs’ dosyas\u0131nda tan\u0131mlanan claim’lerden ilgilisinde ‘AccessTokenLifetime’ \u00f6zelli\u011fini kullanman\u0131z ve saniye cinsinden de\u011fer ataman\u0131z yeterli olacakt\u0131r.<\/p>\n\r\n new Client\r\n {\r\n .\r\n .\r\n .\r\n AccessTokenLifetime = 2 * 60 * 60\r\n }\r\n<\/pre>\nVelhas\u0131l, bu konfig\u00fcrasyondan sonra uygulamalar\u0131 test ama\u00e7l\u0131 derleyip, \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131m\u0131zda Auth Server’dan gelen cookie i\u00e7erisinde access token ve id token de\u011ferlerini a\u015fa\u011f\u0131daki gibi g\u00f6rebilmekteyiz. \n<\/a>\n<\/li>\n ID Token<\/strong> \nEsas amac\u0131, access token’\u0131n Auth Server taraf\u0131ndan \u00fcretilmi\u015f bir token olup olmad\u0131\u011f\u0131n\u0131 do\u011frulamakt\u0131r. Identity Server taraf\u0131ndan private key ile imzalanan id token client taraf\u0131ndan elde edilen public key ile do\u011frulanmakta ve b\u00f6ylece Auth Server taraf\u0131ndan ilgili access token do\u011frulanm\u0131\u015f olmaktad\u0131r.<\/p>\nId Token’a eri\u015fim sa\u011flanabilmesi i\u00e7in access token’\u0131n eri\u015fim konfig\u00fcrasyonlar\u0131 yeterlidir. Bir \u00f6nceki ad\u0131mda sonu\u00e7 olarak access token yan\u0131nda id token’da elde edilmi\u015ftir.\n<\/li>\n Refresh Token<\/strong> \nAuthentication property’ler aras\u0131nda bir client i\u00e7in refresh token de\u011ferininde elde edilebilmesi i\u00e7in yine Auth Server’da ki ‘Config.cs’ dosyas\u0131nda ilgili client’a dair ‘AllowOfflineAccess’ \u00f6zelli\u011fine ‘true’ de\u011ferinin verilmesiyle birlikte a\u015fa\u011f\u0131daki konfig\u00fcrasyonlar\u0131n eklenmesi gerekmektedir.<\/p>\n\r\n new Client\r\n {\r\n .\r\n .\r\n .\r\n AllowedScopes = { IdentityServerConstants.StandardScopes.OpenId, IdentityServerConstants.StandardScopes.Profile, IdentityServerConstants.StandardScopes.OfflineAccess },\r\n AllowOfflineAccess = true,\r\n RefreshTokenUsage = TokenUsage.OneTimeOnly,\r\n RefreshTokenExpiration = TokenExpiration.Absolute,\r\n AbsoluteRefreshTokenLifetime = 2 * 60 * 60 + (10 * 60)\r\n }\r\n<\/pre>\nBurada ‘RefreshTokenUsage’ propertysi client’a dair \u00fcretilecek refresh token’\u0131n kullan\u0131labilirli\u011fini ayarlamaktad\u0131r. ‘OneTimeOnly’ de\u011feri yaln\u0131zca tek seferlik bir kullan\u0131m hakk\u0131 tan\u0131nd\u0131\u011f\u0131n\u0131 ifade etmekle birlikte, ‘ReUse’ de\u011feri ile birden fazla kez kullan\u0131labilirlikte ayarlanabilmektedir. ‘AbsoluteRefreshTokenLifetime’ property’si ise refresh token’\u0131n \u00f6mr\u00fcn\u00fc belirlemektedir. Burada refresh token \u00f6mr\u00fc i\u00e7in ‘SlidingRefreshTokenLifetime’da kullan\u0131labilir. \u0130kisi aras\u0131ndaki fark; ilki net \u00f6mr\u00fc belirtirken, ikincisi ise belli bir s\u00fcre i\u00e7erisinde kullan\u0131ld\u0131\u011f\u0131 taktirde \u00f6mr\u00fcn periyodik uzat\u0131lmas\u0131n\u0131 sa\u011flamaktad\u0131r.<\/p>\n Bu ayarlar\u0131n d\u0131\u015f\u0131nda ‘AllowedScopes’ property’sine dikkat edilirse e\u011fer IdentityServerConstants.StandardScopes.OfflineAccess<\/code> komutu ile ilgili client’a, \u00fcretilecek olan refresh token’a dair eri\u015fim yetkisi de verilmektedir.<\/p>\n Son olarak ilgili client’\u0131n ‘Startup.cs’ dosyas\u0131nda yukar\u0131da eklenen OfflineAccess’e kar\u015f\u0131l\u0131k gelen ‘offline_access’ scope de\u011ferinin a\u015fa\u011f\u0131daki gibi eklenmesi gerekmektedir.<\/p>\n\r\n services.AddAuthentication(_ =>\r\n {\r\n _.DefaultScheme = "OnlineBankamatikCookie";\r\n _.DefaultChallengeScheme = "oidc";\r\n })\r\n .AddCookie("OnlineBankamatikCookie")\r\n .AddOpenIdConnect("oidc", _ =>\r\n {\r\n .\r\n .\r\n .\r\n _.Scope.Add("offline_access");\r\n });\r\n<\/pre>\nT\u00fcm bu i\u015flemler neticesinde uygulama derlenip, \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda refresh token’\u0131n elde edildi\u011fi g\u00f6r\u00fclecektir. \n<\/a>\n<\/li>\n<\/ul>\n Access Token ile Id Token Aras\u0131ndaki Fark<\/h4>\nHer iki JWT de\u011ferini jwt.io<\/a> sitesi \u00fczerinden incelersek e\u011fer;<\/p>\n\n\n\n\n\n\nAccess Token<\/th>\n Id Token<\/th>\n<\/tr>\n<\/thead>\n <\/a><\/td>\n <\/a><\/td>\n<\/tr>\n \nHer iki de\u011ferin a\u00e7\u0131l\u0131m\u0131na g\u00f6z atarsan\u0131z e\u011fer kendilerine has belli ba\u015fl\u0131 bilgilerin yan\u0131nda, access token, eri\u015fimi sa\u011flayabilmesi i\u00e7in ‘scope’ alt\u0131nda yetkiler bar\u0131nd\u0131rmaktad\u0131r. Lakin id token’da ‘scope’ yer almamaktad\u0131r. Burada id token’\u0131n yukar\u0131larda bahsedildi\u011fi gibi sadece do\u011frulama ama\u00e7l\u0131 \u00fcretilen bir de\u011fer oldu\u011fu daha da netle\u015fmi\u015f olmaktad\u0131r.\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nUserinfo Endpoint<\/h3>\nKullan\u0131c\u0131 hakk\u0131nda claim bilgilerini elde etmek i\u00e7in kullan\u0131lan endpoint’tir. \n\/connect\/userinfo<\/code> endpoint’ine header bilgisi Authorization: Bearer <\/code> olan bir ‘GET’ iste\u011finde bulunulmas\u0131 yeterlidir. \n<\/a> \nG\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Userinfo Endpoint ile elde edilen claim’ler, sadece profil i\u00e7in default olarak tan\u0131mlanm\u0131\u015f de\u011ferler de\u011fil, tam aksine kullan\u0131c\u0131ya dair olan t\u00fcm de\u011ferlerdir.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n Not : \u00d6rnek uygulamay\u0131 indirebilmek i\u00e7in buraya<\/a> t\u0131klay\u0131n\u0131z.<\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, IdentityServer4 Yaz\u0131 Serisinin bir \u00f6nceki kaleme ald\u0131\u011f\u0131m\u0131z Merkezi \u00dcyelik Sistemi Temelleri ba\u015fl\u0131kl\u0131 makalemizde client’\u0131n Auth Server’dan authorization code almas\u0131n\u0131 ba\u015farm\u0131\u015f ve client \u00fczerinde authorize olan k\u0131s\u0131mlara yetkili bir \u015fekilde eri\u015fimi test etmi\u015ftik. Bu...<\/p>\n","protected":false},"author":1,"featured_media":18168,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3826],"tags":[3889,3827,3895,3898,3893,3854,3890,3891,3899,3901,3897,3892,3896,3900,3894],"class_list":["post-18791","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identityserver4","tag-authentication-property","tag-identityserver4","tag-identityserver4-access-token","tag-identityserver4-access-token-alma","tag-identityserver4-authentication-property","tag-identityserver4-claim","tag-identityserver4-claim-okuma","tag-identityserver4-claim-read","tag-identityserver4-get-access-token","tag-identityserver4-get-refresh-token","tag-identityserver4-id-token","tag-identityserver4-read-claim","tag-identityserver4-refresh-token","tag-identityserver4-refresh-token-alma","tag-userinfo-endpoint"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/18791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=18791"}],"version-history":[{"count":77,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/18791\/revisions"}],"predecessor-version":[{"id":18884,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/18791\/revisions\/18884"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/18168"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=18791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=18791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=18791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}