<\/div>\n
Merhaba,<\/p>\n
IdentityServer4 Yaz\u0131 Serisi<\/a>nin yirmiikinci makalesinde Resource Owner Credential Grant<\/a> ak\u0131\u015f tipini kullanan uygulama geli\u015ftirece\u011fiz.<\/p>\n
Ba\u015flarken<\/strong>
\n\u0130lk olarak bu ak\u0131\u015f t\u00fcr\u00fcn\u00fcn \u00f6zelli\u011fini hat\u0131rlayarak ba\u015flayal\u0131m. Resource Owner Credential Grant<\/em>, kullan\u0131c\u0131y\u0131 y\u00f6nlendirme yapmaks\u0131z\u0131n direkt olarak Auth Server \u00fczerinden yetkilendiren bir ak\u0131\u015f t\u00fcr\u00fcd\u00fcr. Bu ak\u0131\u015f t\u00fcr\u00fcn\u00fc daha detayl\u0131 inceleyebilmek i\u00e7in yukar\u0131da adresi verilen makaleyi okuman\u0131z\u0131 tavsiye ederim.<\/p>\n
Auth Server Uygulamas\u0131<\/strong>
\n\u00d6rneklendirmeyi MVC client uygulamas\u0131 tasarlayarak ger\u00e7ekle\u015ftirece\u011fiz. Tabi her\u015feyden \u00f6nce bu uygulamaya kar\u015f\u0131l\u0131k Auth Server’da client tasarlayarak ba\u015flayal\u0131m;
\n(Not: Config.cs dosyas\u0131 ve IdentityServer4 konfig\u00fcrasyonlar\u0131 yaz\u0131 serisi boyunca de\u011ferlendirildi\u011fi i\u00e7in bu i\u00e7erikte ele al\u0131nmayacak, yap\u0131ld\u0131klar\u0131 varsay\u0131lacakt\u0131r.)<\/span><\/p>\n
\r\n                .\r\n                .\r\n                .\r\n                new Client{\r\n                    ClientId = "ResourceOwnerClient",\r\n                    ClientName = "Resource Owner Client",\r\n                    ClientSecrets = { new Secret("resourceownerclient".Sha256()) },\r\n                    AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,\r\n                    AllowedScopes =\r\n                    {\r\n                        "Garanti.Write", "Garanti.Read",\r\n                        IdentityServerConstants.StandardScopes.Profile,\r\n                        IdentityServerConstants.StandardScopes.OpenId,\r\n                        IdentityServerConstants.StandardScopes.Email,\r\n                        "Roles" \/\/Identity Resource\r\n                    },\r\n                    AccessTokenLifetime = 3 * 60,\r\n                    AllowOfflineAccess = true,\r\n                    RefreshTokenUsage = TokenUsage.OneTimeOnly,\r\n                    RefreshTokenExpiration = TokenExpiration.Absolute,\r\n                    AbsoluteRefreshTokenLifetime = (3 * 60) + 30,\r\n                    RequirePkce = false\r\n                }\r\n                .\r\n                .\r\n                .\r\n<\/pre>\nYukar\u0131daki client tan\u0131mlamas\u0131nda g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere 8.<\/strong><\/em> sat\u0131rda oldu\u011fu gibi ‘AllowedGrantTypes’ \u00f6zelli\u011fine ‘GrantTypes.ResourceOwnerPassword’ de\u011feri verilerek ilgili ak\u0131\u015f t\u00fcr\u00fcyle \u00e7al\u0131\u015f\u0131laca\u011f\u0131 bildirilmektedir. Geri kalan t\u00fcm \u00f6zellikler ise \u00f6nceden inceledi\u011fimiz konfig\u00fcrasyonlara kar\u015f\u0131l\u0131k gelmektedir.<\/p>\n
Akabinde ilgili uygulama \u00fczerinden giri\u015f yapabilecek bir user’a ihtiyac\u0131m\u0131z olacakt\u0131r. Bunun i\u00e7in a\u015fa\u011f\u0131daki gibi bir test user tan\u0131mlamas\u0131 yapmam\u0131z yeterlidir;<\/p>\n\r\n                new TestUser\r\n                {\r\n                     SubjectId = "test-user1",\r\n                     Username = "test-user1",\r\n                     Password = "12345",\r\n                     Claims = new List<Claim>\r\n                     {\r\n                         new Claim("email", "test-user@identity.com"),\r\n                         new Claim("role", "admin"),\r\n                         new Claim("role", "moderator"),\r\n                         new Claim("name", "hilmi")\r\n                     }\r\n                }\r\n<\/pre>\nEvet, MVC uygulamam\u0131z\u0131n Resource Owner Credential ak\u0131\u015f\u0131 ile \u00e7al\u0131\u015fmas\u0131 i\u00e7in Auth Server neredeyse haz\u0131r. \u015eimdi MVC client’\u0131 \u00fczerinden bu ak\u0131\u015f ile bir istek yap\u0131ld\u0131\u011f\u0131 zaman o iste\u011fi kar\u015f\u0131layacak ve gerekli username ve password bilgileri e\u015fli\u011finde kimlik do\u011frulamay\u0131 ger\u00e7ekle\u015ftirecek olan IResourceOwnerPasswordValidator<\/em> katman\u0131n\u0131 tasarlamam\u0131z gerekmektedir.<\/p>\n
IResourceOwnerPasswordValidator Interface’i \u0130le Kimlik Bilgilerini Do\u011frulama<\/strong>
\nYukar\u0131da da bahsedildi\u011fi gibi Resource Owner Credential ak\u0131\u015f\u0131 ile kimlik do\u011frulamay\u0131 ger\u00e7ekle\u015ftirebilmek i\u00e7in Auth Server’da IResourceOwnerPasswordValidator<\/em> interface’inden t\u00fcreyen bir s\u0131n\u0131f tasarlamam\u0131z gerekmektedir.<\/p>\n\r\n    public class ResourceOwnerPasswordValidator : IResourceOwnerPasswordValidator\r\n    {\r\n        public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)\r\n        {\r\n            if (context.UserName == "test-user1" && context.Password == "12345")\r\n                context.Result = new GrantValidationResult("test-user1", OidcConstants.AuthenticationMethods.Password);\r\n        }\r\n    }\r\n<\/pre>\nYukar\u0131daki s\u0131n\u0131f\u0131 incelerseniz ilgili interface taraf\u0131ndan implemente edilen ‘ValidateAsync’ metodu i\u00e7erisinde kimlik do\u011frulama i\u015flemi ger\u00e7ekle\u015ftirilmektedir. Tabi burada test user kulland\u0131\u011f\u0131m\u0131zdan dolay\u0131 manuel bir kar\u015f\u0131la\u015ft\u0131rma olsa da esas\u0131nda kullan\u0131c\u0131 bilgileri veritaban\u0131nda tutulaca\u011f\u0131 i\u00e7in gerekli \u00e7al\u0131\u015fman\u0131n yap\u0131lmas\u0131 ve veritaban\u0131 \u00fczerinden sorgulanmas\u0131 gerekmektedir. Velhas\u0131l bir \u015fekilde kullan\u0131c\u0131 bilgileri do\u011fruland\u0131ktan sonra ilgili metodun ‘ResourceOwnerPasswordValidationContext’ t\u00fcr\u00fcnden olan context isimli parametresinin ‘Result’ property’sine ‘GrantValidationResult’ t\u00fcr\u00fcnden bir nesne set ediyor ve ilk parametresine kullan\u0131c\u0131n\u0131n subject id de\u011ferini, ikincisine ise kullan\u0131lan authentication metot t\u00fcr\u00fcn\u00fc yani resource owner grant(nam-\u0131 di\u011fer password) de\u011ferini veriyoruz.<\/p>\n
Ard\u0131ndan ilgili s\u0131n\u0131f\u0131 Auth Server’\u0131n ‘Startup.cs’ dosyas\u0131nda ‘AddResourceOwnerValidator’ metodu e\u015fli\u011finde IdentityServer servisine dahil ediyoruz.<\/p>\n\r\n            services.AddIdentityServer()\r\n                    .\r\n                    .\r\n                    .\r\n                    .AddResourceOwnerValidator<ResourceOwnerPasswordValidator>()\r\n                    .AddDeveloperSigningCredential();\r\n<\/pre>\nMVC Uygulamas\u0131<\/strong>
\nS\u0131ra client uygulamas\u0131n\u0131 geli\u015ftirmeye gelmi\u015ftir. \u0130lk olarak MVC client’\u0131n\u0131 geli\u015ftirece\u011fimizden dolay\u0131 bir adet Asp.NET Core MVC uygulamas\u0131 olu\u015ftural\u0131m ve i\u00e7erisine ‘HomeController’\u0131 ekleyelim. Ard\u0131ndan ilgili controller i\u00e7erisine ‘Login’ action metodunu olu\u015ftural\u0131m ve .cshtml dosyas\u0131n\u0131 a\u015fa\u011f\u0131daki gibi tasarlayal\u0131m.<\/p>\n\r\n@model UserLogin\r\n\r\n<form method="post">\r\n    <div class="form-group">\r\n        <label>Username<\/label>\r\n        <input asp-for="Username" type="text" class="form-control">\r\n    <\/div>\r\n    <div class="form-group">\r\n        <label>Password<\/label>\r\n        <input type="password" asp-for="Password" class="form-control">\r\n    <\/div>\r\n    <button type="submit" class="btn btn-primary">Giri\u015f Yap<\/button>\r\n<\/form>\r\n<\/pre>\nBu, kullan\u0131c\u0131 giri\u015finin yap\u0131laca\u011f\u0131 sayfad\u0131r. Username ve password bilgilerini ta\u015f\u0131yan ‘UserLogin’ modeli ise a\u015fa\u011f\u0131daki gibidir.<\/p>\n\r\n    public class UserLogin\r\n    {\r\n        public string Username { get; set; }\r\n        public string Password { get; set; }\r\n    }\r\n<\/pre>\nPost neticesinde verileri kar\u015f\u0131layacak olan metoduda tasarlarsak e\u011fer;<\/p>\n\r\n        public async Task Login(UserLogin userLogin)\r\n        {\r\n            HttpClient client = new HttpClient();\r\n            DiscoveryDocumentResponse disco = await client.GetDiscoveryDocumentAsync("https:\/\/localhost:1000");\r\n            PasswordTokenRequest password = new PasswordTokenRequest()\r\n            {\r\n                UserName = userLogin.Username,\r\n                Password = userLogin.Password,\r\n                ClientId = "ResourceOwnerClient",\r\n                ClientSecret = "resourceownerclient",\r\n                Address = disco.TokenEndpoint\r\n            };\r\n            TokenResponse token = await client.RequestPasswordTokenAsync(password);\r\n            UserInfoRequest userInfoRequest = new UserInfoRequest\r\n            {\r\n                Token = token.AccessToken,\r\n                Address = disco.UserInfoEndpoint\r\n            };\r\n            UserInfoResponse userInfo = await client.GetUserInfoAsync(userInfoRequest);\r\n            ClaimsIdentity claimsIdentity = new ClaimsIdentity(userInfo.Claims, CookieAuthenticationDefaults.AuthenticationScheme, "name", "role");\r\n            ClaimsPrincipal claimsPrincipal = new ClaimsPrincipal(claimsIdentity);\r\n            AuthenticationProperties properties = new AuthenticationProperties();\r\n            properties.StoreTokens(new List<AuthenticationToken>\r\n            {\r\n              new AuthenticationToken\r\n                                     {\r\n                                         Name = OpenIdConnectParameterNames.IdToken,\r\n                                         Value = token.IdentityToken\r\n                                     },\r\n              new AuthenticationToken\r\n                                     {\r\n                                         Name = OpenIdConnectParameterNames.AccessToken,\r\n                                         Value = token.AccessToken\r\n                                     },\r\n              new AuthenticationToken\r\n                                     {\r\n                                         Name = OpenIdConnectParameterNames.RefreshToken,\r\n                                         Value = token.RefreshToken\r\n                                     },\r\n              new AuthenticationToken\r\n                                     {\r\n                                         Name = OpenIdConnectParameterNames.ExpiresIn,\r\n                                         Value = DateTime.UtcNow.AddSeconds(token.ExpiresIn).ToString("O")\r\n                                     },\r\n            });\r\n            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, claimsPrincipal, properties);\r\n        }\r\n<\/pre>\n\u015feklinde olacakt\u0131r. Yukar\u0131daki kod blo\u011funu izah edersek e\u011fer;<\/p>\n\n3 – 12. sat\u0131r aral\u0131\u011f\u0131<\/em><\/strong>
\nKlasik discovery endpoint<\/a>‘e istek g\u00f6nderilmekte ve token talebi i\u00e7in gerekli request nesnesi(PasswordTokenRequest) \u00fcretilmektedir.\n<\/li>\n
13. sat\u0131r<\/em><\/strong>
\nAuth Server’a ‘RequestPasswordTokenAsync’ fonksiyonu ile resource owner credential t\u00fcr\u00fcnde istek yap\u0131lmakta ve token talep edilmektedir.\n<\/li>\n
14 – 19. sat\u0131r aral\u0131\u011f\u0131<\/em><\/strong>
\nElde edilen token’da ki access token de\u011feri ile kullan\u0131c\u0131 bilgileri talep edilmektedir.\n<\/li>\n
20 – 21. sat\u0131r aral\u0131\u011f\u0131<\/em><\/strong>
\nKullan\u0131c\u0131 bilgileri tutacak olan ‘ClaimsPrincipal’ nesnesi olu\u015fturulmaktad\u0131r. Burada dikkat edilmesi gereken husus 20. sat\u0131rda \u00fcretilen new ClaimsIdentity(userInfo.Claims, CookieAuthenticationDefaults.AuthenticationScheme, \"name\", \"role\");<\/code> nesnesinin ilk parametresi d\u0131\u015f\u0131nda 2. , 3. ve 4. parametreleridir. 2. parametre, ilgili uygulaman\u0131n kulland\u0131\u011f\u0131 cookie ad\u0131n\u0131 gerektirirken(a\u015fa\u011f\u0131daki sat\u0131rlarda g\u00f6rece\u011fiz)<\/span>, 3. parametre User.Identity.Name<\/code> koduna kar\u015f\u0131l\u0131k kullan\u0131c\u0131dan gelen hangi claim ile e\u015fle\u015ftirilmesi gerekti\u011fini bildirmekte ve 4. parametre ise benzer \u015fekilde kullan\u0131c\u0131n\u0131n authorize\/rol yetkisinin yine kullan\u0131c\u0131dan gelen claim’lerden hangisiyle e\u015fle\u015fmesi gerekti\u011fini belirlemektedir.<\/p>\nBurada ilgili claim de\u011ferlerinin elde edilebilmesi i\u00e7in Auth Server’da a\u015fa\u011f\u0131daki Identity Resource’lerin eklenmesi gerekti\u011fini unutmay\u0131n\u0131z…<\/p>\n\r\n                .\r\n                .\r\n                .\r\n                new IdentityResources.OpenId(),\r\n                new IdentityResources.Profile(),\r\n                new IdentityResources.Email(),\r\n                new IdentityResource\r\n                {\r\n                    Name = "Roles",\r\n                    Description = "Roles",\r\n                    DisplayName = "Roles",\r\n                    UserClaims =\r\n                    {\r\n                        "role"\r\n                    }\r\n                }\r\n                .\r\n                .\r\n                .\r\n<\/pre>\n<\/li>\n22 – 44 sat\u0131r aral\u0131\u011f\u0131<\/em><\/strong>
\nBurada giri\u015f yapan kullan\u0131c\u0131n\u0131n elde etti\u011fi authentication properties bilgilerini client uygulamas\u0131 \u00fczerinde g\u00fcncellemekteyiz. Hatta hat\u0131rlarsan\u0131z IdentityServer4 mimarisi i\u00e7in refresh token<\/a> konusunu ele al\u0131rken de birebir ayn\u0131 i\u015flemi ger\u00e7ekle\u015ftirmi\u015ftik. Lakin ilgili makalede authentication property’leri
\n(await HttpContext.AuthenticateAsync()).Properties;<\/code> kodu ile elde ediyor, \u00fczerine de\u011fi\u015fikliklerimizi ger\u00e7ekle\u015ftiriyorduk. Halbuki burada direkt olarak ‘AuthenticationProperties’ t\u00fcr\u00fcnden nesneyi elimizle manuel olu\u015fturuyoruz.\n<\/li>\n
46. sat\u0131r<\/em><\/strong>
\nGiri\u015f i\u015flemini yukar\u0131da \u00fcretilen de\u011ferler e\u015fli\u011finde ger\u00e7ekle\u015ftiriyoruz.\n<\/li>\n<\/ul>\nBu geli\u015ftirmelerden sonra client uygulamas\u0131n\u0131n ‘Startup.cs’ dosyas\u0131nda a\u015fa\u011f\u0131daki geli\u015ftirmenin yap\u0131lmas\u0131 gerekmektedir;<\/p>\n\r\n            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)\r\n                .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, _ =>\r\n                {\r\n                    _.LoginPath = new PathString("\/home\/login");\r\n                });\r\n<\/pre>\nEklene cookie servisine \u015fema ad\u0131 olarak ‘Cookies’ de\u011ferini ta\u015f\u0131yan CookieAuthenticationDefaults.AuthenticationScheme<\/code> sabit verilmektedir. Dikkat ederseniz ayn\u0131 sabit yukar\u0131da login i\u015flemi esnas\u0131nda da ilgili alanlarda kullan\u0131lmaktad\u0131r.<\/p>\n
Ve bir nazar\u0131n\u0131za de\u011fer noktay\u0131 daha i\u015faret ederim ki o da ‘AddOpenIdConnect’ servisinin kullan\u0131lmamas\u0131d\u0131r. ‘AddOpenIdConnect’ servisi kimlik do\u011frulamay\u0131 ger\u00e7ekle\u015ftiren bir protokold\u00fc. Haliyle bizler bu protokol\u00fcn yapaca\u011f\u0131 i\u015flemi yukar\u0131da manuel yapm\u0131\u015f bulunmaktay\u0131z. O y\u00fczden bu servisi eklemeye gerek kalmam\u0131\u015ft\u0131r.<\/p>\n
Ve son olarak client uygulamas\u0131nda kimlik do\u011frulama ve yetkilendirme i\u015flemlerinin sa\u011fl\u0131kl\u0131 bir \u015fekilde i\u015fleyebilmesi i\u00e7in ‘UseAuthentication’ ve ‘UseAuthorization’ middleware’lerini \u00e7a\u011f\u0131rmay\u0131 unutmuyoruz.<\/p>\n\r\n            app.UseAuthentication();\r\n            app.UseAuthorization();\r\n<\/pre>\n\u00c7\u0131k\u0131\u015f i\u015flemi i\u00e7inde a\u015fa\u011f\u0131daki action’\u0131 kullanabilirsiniz.<\/p>\n\r\n        public async Task Logout()\r\n        {\r\n            await HttpContext.SignOutAsync();\r\n        }\r\n<\/pre>\nVelhas\u0131l kelam, art\u0131k uygulamay\u0131 derleyip, \u00e7al\u0131\u015ft\u0131rabilir ve test edebiliriz.
\n<\/a>
\nG\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere MVC uygulamas\u0131 resource owner credential ak\u0131\u015f\u0131yla gayet ba\u015far\u0131l\u0131 bir \u015fekilde Auth Server’dan yetkilendirilebilmektedir.<\/p>\n
Ayriyeten,
\nAngular vs. gibi SPA uygulamalar\u0131nda yahut Console gibi farkl\u0131 platformlarda resource owner credential kullanmak istiyorsan\u0131z e\u011fer temelde kullanaca\u011f\u0131n\u0131z yap\u0131lanma yine ayn\u0131 tasar\u0131mdan ibaret olacakt\u0131r. Sadece token’\u0131 elde ettikten sonra authentication property’leri MVC’de oldu\u011fu gibi store etmenize gerek kalmayacak, hangi platformda \u00e7al\u0131\u015f\u0131yorsan\u0131z ilgili platformun gere\u011fi ne ise ona g\u00f6re bir tasar\u0131m yap\u0131lmas\u0131 gerekecektir. Tabi, platform olarak Angular gibi SPA tercih ediyorsan\u0131z, uygulama ile Auth Server aras\u0131nda ilgili ak\u0131\u015f\u0131 kullanacak bir API tasarlayabilir ve onun \u00fczerinden Auth Server’la ili\u015fkiyi kurabilirsiniz.<\/p>\n
\u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle…
\nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere…
\n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n
Not : \u00d6rnek uygulamay\u0131 indirebilmek i\u00e7in buraya<\/a> t\u0131klay\u0131n\u0131z.<\/p>\n","protected":false},"excerpt":{"rendered":"
Merhaba, IdentityServer4 Yaz\u0131 Serisinin yirmiikinci makalesinde Resource Owner Credential Grant ak\u0131\u015f tipini kullanan uygulama geli\u015ftirece\u011fiz. Ba\u015flarken \u0130lk olarak bu ak\u0131\u015f t\u00fcr\u00fcn\u00fcn \u00f6zelli\u011fini hat\u0131rlayarak ba\u015flayal\u0131m. Resource Owner Credential Grant, kullan\u0131c\u0131y\u0131 y\u00f6nlendirme yapmaks\u0131z\u0131n direkt olarak Auth...<\/p>\n","protected":false},"author":1,"featured_media":18168,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3826],"tags":[3827,3988,3987],"class_list":["post-19642","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identityserver4","tag-identityserver4","tag-iresourceownerpasswordvalidator","tag-resource-owner-credential-grant"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/19642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=19642"}],"version-history":[{"count":63,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/19642\/revisions"}],"predecessor-version":[{"id":19708,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/19642\/revisions\/19708"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/18168"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=19642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=19642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=19642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}