<\/div>\n

Merhaba,<\/p>\n

Bu i\u00e7eri\u011fimizde Asp.NET Core uygulamalar\u0131nda OAuth 2.0\/OpenID Connect server’lar\u0131 olu\u015fturmak i\u00e7in tasarlanm\u0131\u015f olan ve a\u00e7\u0131k kaynak olarak geli\u015ftirilen OpenIddict Framework’\u00fcn\u00fc ele al\u0131yor olaca\u011f\u0131z.<\/p>\n

OpenIddict Nedir?<\/h4>\n
OpenIddict ilk olarak 2015 y\u0131l\u0131nda temelleri at\u0131lm\u0131\u015f olan ve OpenID Connect server kurmak i\u00e7in \u00e7\u00f6z\u00fcm sa\u011flayan bir k\u00fct\u00fcphanedir. Identity Server<\/a>‘a nazaran biraz daha d\u00fc\u015f\u00fck seviyede i\u015flevselli\u011fe sahiptir.<\/p>\n

Neden IdentityServer4 Yerine OpenIddict’i Kullanmal\u0131y\u0131z?<\/h4>\n
Y\u0131llarca .NET \u00e7at\u0131s\u0131 alt\u0131nda OAuth2 + OpenID Connect protokolleri e\u015fli\u011finde g\u00fcvenli bir token hizmeti sa\u011flamak i\u00e7in IdentityServer k\u00fct\u00fcphanesinden istifade etti\u011fimize \u00e7o\u011funuz vak\u0131ft\u0131r. Lakin IdentityServer, gelecek s\u00fcr\u00fcmleri lisanslamaya karar verdi\u011finden dolay\u0131, bu durum ticari uygulamalar i\u00e7in ekstradan maliyet kalemi olarak projelerimize yans\u0131m\u0131\u015f bulunmaktad\u0131r. Her ne kadar iyi bir yaz\u0131l\u0131m i\u00e7in ekstradan \u00f6deme yapmak pek \u00e7ok proje veya \u015firket i\u00e7in bir sorun te\u015fkil etmese de, yine de bir alternatif araman\u0131n zaman\u0131n\u0131n geldi\u011fini d\u00fc\u015f\u00fcnmedik de\u011fil. Haliyle yapt\u0131\u011f\u0131m\u0131z ufak ara\u015ft\u0131rmalar neticesinde OpenIddict k\u00fct\u00fcphanesiyle kar\u015f\u0131la\u015ft\u0131k. Denedik, test ettik. Bir nebze eksikliklerini g\u00f6zlemlediysekte, basit ama etkili oldu\u011funa kanaat getirdik. Ayr\u0131ca var olan bir ticari projemizde bu k\u00fct\u00fcphaneyi sahada tecr\u00fcbe etme \u015fans\u0131m\u0131z oldu. Nihayetinde edindi\u011fimiz kazan\u0131mlar e\u015fli\u011finde ve bu k\u00fct\u00fcphanenin t\u00fcm teferruatlar\u0131n\u0131 b\u00fct\u00fcnsel olarak derleyip bir yaz\u0131 serisi olarak sizlere aktarman\u0131n karar\u0131n\u0131 vermi\u015f bulunuyoruz.<\/p>\n
OAuth2 ve OpenID Connect Nedir?(Hat\u0131rlayal\u0131m)<\/h4>\n
Esas\u0131nda bu kavramlar\u0131 IdentityServer4 Nedir? OAuth 2.0 ve OpenID Connect Protokolleri Nelerdir?<\/a> ba\u015fl\u0131kl\u0131 yaz\u0131m\u0131zda tam teferruatl\u0131 izah etmi\u015f bulunuyoruz. Yine de usul gere\u011fi bu i\u00e7eri\u011fimizde hafiften \u00f6zetlememiz gerekirse e\u011fer; OAuth 2.0<\/strong><\/em>, uygulamalar aras\u0131 veri transferinde kullan\u0131lan a\u00e7\u0131k bir yetkilendirme(authorization) protokol\u00fcyken, OpenID Connect<\/strong><\/em> ise bir protokolden ziyade OAuth 2.0 \u00fczerinde kimlik do\u011frulama(authentication) i\u015flemlerini \u00fcstlenen bir katmand\u0131r.<\/p>\n
OpenIddict Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h4>\n
Teknik olarak kullan\u0131c\u0131 ad\u0131 ve \u015fifre do\u011frulamalar\u0131n\u0131 harici bir provider olan authorization server \u00fczerinden ger\u00e7ekle\u015ftirdikten sonra, OAuth2 ve OpenID Connect ak\u0131\u015flar\u0131(flows) i\u00e7in OpenIddict devreye girmektedir. Bu ak\u0131\u015flar di\u011fer uygulamalar(clients) taraf\u0131ndan desteklenmekte ve temel olarak bu client’lar\u0131 kullanan kullan\u0131c\u0131lar i\u00e7in yetkilendirmeleri ger\u00e7ekle\u015ftirmektedir.<\/p>\n
Burada s\u00fcre\u00e7 \u015f\u00f6yle cereyan etmektedir. Kullan\u0131c\u0131, authorization server taraf\u0131ndan yetki kontrol\u00fc sa\u011flanan bir kayna\u011fa client \u00fczerinden eri\u015fmek istedi\u011fi zaman \u00f6nce bu kullan\u0131c\u0131 client taraf\u0131ndan authorization server’a y\u00f6nlendirilir. Kullan\u0131c\u0131 gerekli authentication’\u0131 sa\u011flarsa e\u011fer kayna\u011fa eri\u015febilmesi i\u00e7in yetkisinin olup olmad\u0131\u011f\u0131 de\u011ferlendirilerek, duruma g\u00f6re eri\u015fimi ger\u00e7ekle\u015ftirilecek ya da ger\u00e7ekle\u015ftirilmeyecektir.<\/p>\n
Authorization Server Olu\u015fturma<\/h4>\n
\u015eimdi bu i\u00e7eri\u011fimizde bir Authorization Server i\u00e7in minimum kurulum gerektirecek \u015fekilde uygulama in\u015fa ederek sonraki i\u00e7eriklere temel olu\u015fturaca\u011f\u0131z.<\/p>\n
Authorization Server i\u00e7in login i\u015flemi yapabilece\u011fimiz bir sayfan\u0131n olmas\u0131 gayet yerinde olacakt\u0131r. Haliyle biz bu uygulamay\u0131 Asp.NET Core MVC mimarisinde tasarlamay\u0131 tercih ediyoruz.<\/p>\n
\n
Ad\u0131m 1 | (Asp.NET Core MVC Uygulamas\u0131n\u0131n Olu\u015fturulmas\u0131)<\/span><\/strong>
\n $\"OpenIddict$ <\/a>\u0130lk olarak ismini istedi\u011finiz \u015fekilde belirtebilece\u011finiz bir Asp.NET Core MVC uygulamas\u0131 olu\u015ftural\u0131m. Bizlerin, bu serinin sonraki i\u00e7eriklerinde geli\u015ftirece\u011fimiz t\u00fcm uygulamalar\u0131 bu solution alt\u0131nda toparlayaca\u011f\u0131m\u0131z\u0131 \u015fimdiden bildirmekte fayda var.<\/p>\n
O y\u00fczden solution ad\u0131na ‘OpenIddict’ ve Authorization Server uygulamas\u0131na da ‘OpenIddict.AuthorizationServer’ ad\u0131n\u0131 vermi\u015f bulunmaktay\u0131z.\n<\/li>\n
Ad\u0131m 2 | (Local Sertifikan\u0131n Y\u00fcklenmesi)<\/span><\/strong>
\nOpenIddict local’de \u00e7al\u0131\u015f\u0131rken bile sertifika gerektirebilmektedir. Bu y\u00fczden local certificate’in g\u00fcvenilir oldu\u011fundan emin olmak i\u00e7in ilgili proje dizininde powershell \u00fczerinden a\u015fa\u011f\u0131daki talimat\u0131n verilmesi yeterlidir.<\/p>\n
\n`dotnet dev-certs https --trust<\/code><\/strong>\n<\/div>\n``<\/a>\n<\/li>\n`
Ad\u0131m 3 | (Kimlik Do\u011frulamay\u0131-Authentication- Etkinle\u015ftirme)<\/strong> \n\u015eimdi olu\u015fturdu\u011fumuz uygulaman\u0131n kimlik do\u011frulama(authentication) \u00f6zelli\u011fini aktifle\u015ftirelim. Bunun i\u00e7in ‘Program.cs’ dosyas\u0131 i\u00e7erisinde a\u015fa\u011f\u0131daki \u00e7al\u0131\u015fmay\u0131 ger\u00e7ekle\u015ftirelim.<\/p>\n\n\r\n.\r\n.\r\n.\r\nbuilder.Services.AddControllersWithViews();\r\n\r\nbuilder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)\r\n .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options => options.LoginPath = "\/account\/login");\r\n.\r\n.\r\n.\r\n<\/pre>\n<\/div>\nYukar\u0131daki kod blo\u011funu incelerseniz bu MVC temelli uygulamam\u0131z i\u00e7in Cookie bazl\u0131 authentication operasyonunu ger\u00e7ekle\u015ftirmi\u015f bulunmaktay\u0131z. Ve ayr\u0131ca dikkat ederseniz ‘\/account\/login’ adresi login i\u015flemleri i\u00e7in ayarlanm\u0131\u015ft\u0131r.<\/p>\n Bu yap\u0131land\u0131rmadan sonra a\u015fa\u011f\u0131daki gibi ‘UseAuthentication’ middleware’ini uygun yerde \u00e7a\u011f\u0131rmam\u0131z gerekmektedir.<\/p>\n\n\r\n.\r\n.\r\n.\r\napp.UseRouting();\r\n\r\napp.UseAuthentication();\r\n\r\napp.UseAuthorization();\r\n\r\napp.MapControllerRoute(\r\n name: "default",\r\n pattern: "{controller=Home}\/{action=Index}\/{id?}");\r\n.\r\n.\r\n.\r\n<\/pre>\n<\/div>\n<\/li>\nAd\u0131m 4 | (Login Sayfas\u0131n\u0131n Tasarlanmas\u0131)<\/strong> \nArt\u0131k authentication’\u0131 etkinle\u015ftirdi\u011fimize g\u00f6re kullan\u0131c\u0131lar\u0131n kimli\u011fini do\u011frulamas\u0131 i\u00e7in bir login sayfas\u0131na ihtiyac\u0131m\u0131z olacakt\u0131r. Bunun i\u00e7in \u00f6ncelikle kullan\u0131c\u0131n\u0131n kimlik do\u011frulamas\u0131 i\u00e7in ihtiya\u00e7 duyulan bilgileri i\u00e7eren viewmodel nesnesini tasarlayarak ba\u015flayal\u0131m.<\/p>\n\n\r\nnamespace OpenIddict.AuthorizationServer.ViewModels\r\n{\r\n public class LoginVM\r\n {\r\n [Required]\r\n public string Username { get; set; }\r\n [Required]\r\n public string Password { get; set; }\r\n }\r\n}\r\n<\/pre>\n<\/div>\nArd\u0131ndan kimlik do\u011frulama sorumlulu\u011funu \u00fcstlenecek olan ‘AccountController’ s\u0131n\u0131f\u0131n\u0131 a\u015fa\u011f\u0131daki gibi tasarlayal\u0131m.<\/p>\n\n\r\nnamespace OpenIddict.AuthorizationServer.Controllers\r\n{\r\n public class AccountController : Controller\r\n {\r\n [HttpGet]\r\n public IActionResult Login(string returnUrl)\r\n {\r\n TempData["returnUrl"] = returnUrl;\r\n return View();\r\n }\r\n\r\n [HttpPost]\r\n [ValidateAntiForgeryToken]\r\n public async Task<IActionResult> Login(LoginVM model)\r\n {\r\n if (ModelState.IsValid)\r\n {\r\n List<Claim> claims = new() { new(ClaimTypes.Name, model.Username) };\r\n ClaimsIdentity identity = new(claims, CookieAuthenticationDefaults.AuthenticationScheme);\r\n ClaimsPrincipal principal = new(identity);\r\n await HttpContext.SignInAsync(principal);\r\n\r\n if (Url.IsLocalUrl(TempData["returnUrl"]?.ToString()))\r\n return Redirect(TempData["returnUrl"].ToString());\r\n\r\n return RedirectToAction("Index", "Home");\r\n }\r\n\r\n return View(model);\r\n }\r\n\r\n public async Task<IActionResult> Logout()\r\n {\r\n await HttpContext.SignOutAsync();\r\n return RedirectToAction("Index", "Home");\r\n }\r\n }\r\n}\r\n<\/pre>\n<\/div>\nYukar\u0131daki \u00f6rne\u011fi incelerseniz e\u011fer 14<\/strong> ile 30.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda kimlik do\u011frulaman\u0131n farazi olarak ger\u00e7ekle\u015ftirildi\u011fini kabul ediyoruz. Normal \u015fartlarda burada ‘LoginVM’den gelen verileri veritaban\u0131ndan do\u011frulay\u0131p ona g\u00f6re aksiyon alman\u0131z gerekmektedir. Bizler i\u00e7eri\u011fi \u015fi\u015firmemek ad\u0131na buralar\u0131 es ge\u00e7iyor ve direkt olarak gelen bilgilere g\u00f6re bir oturum a\u00e7ma i\u015flemi ger\u00e7ekle\u015ftiriyoruz. 19.<\/strong> sat\u0131ra bakarsan\u0131z e\u011fer CookieAuthenticationDefaults.AuthenticationScheme<\/code> ile Cookie authentication \u015femas\u0131n\u0131 belirtiyoruz. 21.<\/strong> sat\u0131rdaki SignInAsync<\/code> metodu ise ‘CookieAuthenticationHandler’\u0131 \u00e7a\u011f\u0131ran ve login neticesinde \u00fcretilecek de\u011feri cookie’ye yerle\u015ftirip signin yapmam\u0131z\u0131 sa\u011flayacak olan bir extension metottur. Ayn\u0131 \u015fekilde 34.<\/strong> sat\u0131rda SignOutAsync<\/code> metodu ile signout i\u015flemini ger\u00e7ekle\u015ftiriyoruz.<\/p>\n Bu ad\u0131m\u0131n sonuncu hamlesi olarak ‘Login’ action’\u0131n\u0131n view’ini a\u015fa\u011f\u0131daki gibi tasarlayal\u0131m.<\/p>\n \n\r\n@model OpenIddict.AuthorizationServer.ViewModels.LoginVM\r\n<form autocomplete="off" asp-route="Login">\r\n <div class="card">\r\n <input type="text" class="form-control form-control-lg" placeholder="Username" asp-for="Username" autofocus>\r\n <input type="password" class="form-control form-control-lg form-control-last" placeholder="Password" asp-for="Password">\r\n <\/div>\r\n <p>\r\n <button type="submit" class="btn btn-dark btn-block mt-3">Login<\/button>\r\n <\/p>\r\n<\/form>\r\n<\/pre>\n<\/div>\n<\/li>\nAd\u0131m 5 | (Anasayfay\u0131 G\u00fcncellemek)<\/strong> \nSon olarak, kimli\u011fi do\u011frulanmam\u0131\u015f kullan\u0131c\u0131lar i\u00e7in anasayfada gerekli g\u00fcncellemeleri ger\u00e7ekle\u015ftirelim. Bunun i\u00e7in ‘HomeController’\u0131n ‘Index’ action’\u0131n\u0131n view’ine gelelim ve a\u015fa\u011f\u0131daki \u00e7al\u0131\u015fmay\u0131 icra edelim.<\/p>\n\n\r\n@using Microsoft.AspNetCore.Authentication\r\n@if (User.Identity.IsAuthenticated)\r\n{\r\n var authenticationResult = await Context.AuthenticateAsync();\r\n var issued = authenticationResult.Properties.Items[".issued"];\r\n var expires = authenticationResult.Properties.Items[".expires"];\r\n\r\n <div>\r\n <h2>@User.Identity.Name <\/h2>\r\n <p>olarak oturum a\u00e7t\u0131n\u0131z.<\/p>\r\n <hr \/>\r\n <dl>\r\n <dt>Issued<\/dt>\r\n <dd>@issued<\/dd>\r\n <dt>Expires<\/dt>\r\n <dd>@expires<\/dd>\r\n <\/dl>\r\n <hr \/>\r\n <p><a class="btn btn-dark" asp-controller="Account" asp-action="Logout">\u00c7\u0131k\u0131\u015f yap<\/a><\/p>\r\n\r\n <\/div>\r\n}\r\n\r\n@if (!User.Identity.IsAuthenticated)\r\n{\r\n <div>\r\n <p>Oturum a\u00e7mal\u0131s\u0131n\u0131z!<\/p>\r\n <p><a class="btn btn-sm btn-dark" asp-controller="Account" asp-action="Login">Oturum a\u00e7<\/a><\/p>\r\n <\/div>\r\n}\r\n<\/pre>\n<\/div>\nE\u011fer ki, kullan\u0131c\u0131 authenticated olduysa belli ba\u015fl\u0131 bilgilerini ekranda g\u00f6steriyoruz. Yok e\u011fer authenticated olmad\u0131ysa, oturum a\u00e7ma sayfas\u0131na g\u00f6t\u00fcren bir buton yerle\u015ftirerek kullan\u0131c\u0131y\u0131 y\u00f6nlendiriyoruz. Tabi ki de sizler daha farkl\u0131 bir \u015fekilde tasar\u0131m ger\u00e7ekle\u015ftirebilirsiniz \ud83d\ude42<\/p>\n Uygulama ba\u015flat\u0131ld\u0131\u011f\u0131nda : \n<\/a> \nOturum a\u00e7arken : \n<\/a> \nve \nOturum a\u00e7\u0131ld\u0131ktan sonra : \n<\/a>\n<\/li>\n<\/ul>\n Netice itibariyle; \nArt\u0131k elimizde authentication ile \u00e7al\u0131\u015fan temel bir Asp.NET Core MVC projemiz mevcuttur. Bundan sonraki i\u00e7eriklerimizde OpenIddict ile yapaca\u011f\u0131m\u0131z \u00e7al\u0131\u015fmalarda bu uygulama \u00fczerinden temel yetkilendirme operasyonlar\u0131n\u0131 ger\u00e7ekle\u015ftiriyor olaca\u011f\u0131z.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n Not : \u00d6rnek uygulaman\u0131n kaynak kodlar\u0131na a\u015fa\u011f\u0131daki github adresinden eri\u015febilirsiniz. \nhttps:\/\/github.com\/gncyyldz\/OpenIddict-Authorization-Server-Example<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde Asp.NET Core uygulamalar\u0131nda OAuth 2.0\/OpenID Connect server’lar\u0131 olu\u015fturmak i\u00e7in tasarlanm\u0131\u015f olan ve a\u00e7\u0131k kaynak olarak geli\u015ftirilen OpenIddict Framework’\u00fcn\u00fc ele al\u0131yor olaca\u011f\u0131z. OpenIddict Nedir? OpenIddict ilk olarak 2015 y\u0131l\u0131nda temelleri at\u0131lm\u0131\u015f olan...<\/p>\n","protected":false},"author":1,"featured_media":3014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4665],"tags":[4666,4669,4667,4668],"class_list":["post-25582","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-openiddict","tag-openiddict","tag-openiddict-authorization-server","tag-openiddict-oauth-2-0","tag-openiddict-openid-connect"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=25582"}],"version-history":[{"count":17,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25582\/revisions"}],"predecessor-version":[{"id":25604,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25582\/revisions\/25604"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/3014"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=25582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=25582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=25582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}