<\/div>\n

Merhaba,<\/p>\n

Bu i\u00e7eri\u011fimizde OpenIddict k\u00fct\u00fcphanesi ile iki a\u015famal\u0131 do\u011frulama ger\u00e7ekle\u015ftirmemizi gereki k\u0131lan Authorization Code Flow<\/em>‘un nas\u0131l uygulanabilece\u011fini ele al\u0131yor olaca\u011f\u0131z. Hadi buyurun ba\u015flayal\u0131m.<\/p>\n

Authorization Code Nedir?<\/h4>\n
Tabi \u00f6ncelikle Authorization Code’un ne oldu\u011funu ele alarak ba\u015flamakta fayda oldu\u011fu kanaatindeyim. Bunun i\u00e7in zaman\u0131nda Authorization Code Grant(Flow)<\/a> ba\u015fl\u0131\u011f\u0131ndaki makalede Authorization Code’u IdentityServer4 k\u00fct\u00fcphanesi e\u015fli\u011finde tam teferruatl\u0131 klavyeye alm\u0131\u015f bulunmaktay\u0131m. \u00d6ncelikle ilgili i\u00e7eri\u011fi okuyarak soluklanman\u0131z\u0131 ve ard\u0131ndan buradan devam etmenizi \u00f6neririm.<\/p>\n
Authorization Code<\/em>; client kullan\u0131c\u0131s\u0131n\u0131n Authorization Server \u00fczerinden authorize olmas\u0131 esnas\u0131nda, client taraf\u0131ndan \u00f6\u011frenilmek ve elde edilmek istenen bilgilerin kullan\u0131c\u0131 taraf\u0131ndan onaylanarak verilmesi neticesinde \u00fcretilen bir kodu temsil etmektedir. Kullan\u0131c\u0131 i\u00e7in kritik olan bu kod, authorization server taraf\u0131ndan client’a verildi\u011fi taktirde client bu kod e\u015fli\u011finde authorization server’dan ilgili kullan\u0131c\u0131ya ait yetkilerde access token ve refresh token’\u0131 elde edebilecektir.<\/p>\n
Konuyu daha iyi anlayabilmek i\u00e7in a\u015fa\u011f\u0131daki g\u00f6rseli inceleyebilirsiniz. $\"OpenIddict$ <\/a>
\nKullan\u0131c\u0131, client taraf\u0131ndan yetkilerine sahip olunabilmesi i\u00e7in client identifier, username ve password bilgileri e\u015fli\u011finde authorization server’a y\u00f6nlendirilir. Kullan\u0131c\u0131, client’\u0131n belli ba\u015fl\u0131 bilgilerine olan eri\u015fim talebini bu bilgilerle onaylar veya reddeder. Onay verildi\u011fi taktirde authorization code \u00fcretilir. Neticede tekrar kullan\u0131c\u0131 client’a geri y\u00f6nlendirilir.<\/p>\n
B\u00f6ylece authorization code’a sahip olan client, bu kodu kullanarak authorization server’dan access token talebinde bulunur. Authorization server ise client’tan gelen bu talep neticesinde hem authorization code’u hem de client credential bilgilerini do\u011frular ve kullan\u0131c\u0131 yetkilerine sahip olan bir access token \u00fcretip client’a d\u00f6nd\u00fcr\u00fcr. Ve nihai olarak bu access token ile client art\u0131k yetkilendirilmi\u015f olur ve art\u0131k istedi\u011fi resource server’lara(API resource’lara) isteklerde bulunabilir.<\/p>\n
\u0130\u015fte t\u00fcm bu s\u00fcre\u00e7te client’\u0131 yetkilendirebilmek i\u00e7in \u00f6nce authorization code’a ard\u0131ndan da access token’a ihtiya\u00e7 duyuldu\u011fu i\u00e7in iki a\u015famal\u0131 do\u011frulama s\u00f6z konusudur.<\/p>\n
Bu girizg\u00e2h sonra art\u0131k OpenIddict ile Authorization Code Flow’un yap\u0131land\u0131rmas\u0131na ge\u00e7ebiliriz.<\/p>\n
OpendIddict ile Authorization Code Flow Yap\u0131land\u0131rmas\u0131<\/h4>\n
Not : Buradaki yap\u0131land\u0131rma s\u00fcrecinde kullan\u0131lan proje temelleri yaz\u0131 serisi boyunca olu\u015fturulup geli\u015ftirilen \u015fu adresteki<\/a> github reposundan \u00e7ekilmi\u015ftir.<\/span>
\n\u0130lk olarak authorization code flow’u etkinle\u015ftirebilmek i\u00e7in a\u015fa\u011f\u0131daki konfig\u00fcrasyonlar\u0131n yap\u0131lmas\u0131 gerekmektedir;<\/p>\n
\n
\r\n\/\/OpenIddict servisini uygulamaya ekliyoruz.\r\nbuilder.Services.AddOpenIddict()\r\n .AddCore(options =>\r\n {\r\n .\r\n .\r\n .\r\n })\r\n .AddServer(options =>\r\n {\r\n options.SetTokenEndpointUris("\/connect\/token")\r\n \/\/Authorization Code talebinde bulunulacak endpoint'i set ediyoruz.\r\n .SetAuthorizationEndpointUris("\/connect\/authorize");\r\n \r\n options.AllowClientCredentialsFlow()\r\n \/\/Authorization Code Flow'u etkile\u015ftiriyoruz.\r\n .AllowAuthorizationCodeFlow()\r\n .RequireProofKeyForCodeExchange();\r\n .\r\n .\r\n .\r\n options.UseAspNetCore()\r\n .EnableTokenEndpointPassthrough()\r\n \/\/EnableAuthorizationEndpointPassthrough: OpenID Connect request'lerinin Authorization Endpoint i\u00e7in aktifle\u015ftirilmesini sa\u011flar.\r\n .EnableAuthorizationEndpointPassthrough();\r\n .\r\n .\r\n .\r\n });\r\n<\/pre>\n<\/div>\n
Yukar\u0131daki konfig\u00fcrasyonel kodlar\u0131 incelersek e\u011fer; 13.<\/strong> sat\u0131rda SetAuthorizationEndpointUris<\/code> metodu ile authorization code talebi i\u00e7in endpoint tan\u0131mlamas\u0131nda bulunuyoruz. 17.<\/strong> sat\u0131rda ise AllowAuthorizationCodeFlow<\/code> metodu ile authorization code flow’u etkinle\u015ftiriyor ve hemen ard\u0131ndan 18.<\/strong> sat\u0131rda RequireProofKeyForCodeExchange<\/code> metodu ile de t\u00fcm bu client’lar\u0131n PKCE<\/a> kullanmas\u0131 gerekti\u011fini ifade ediyoruz. 25.<\/strong> sat\u0131rda ise EnableAuthorizationEndpointPassthrough<\/code> metodu ile gelen request’leri authorization endpoint’i ile kar\u015f\u0131l\u0131yoruz.<\/p>\n
Authorization Endpoint’inin Yap\u0131land\u0131r\u0131lmas\u0131<\/h4>\n\u015eimdi, authorization code talebinde bulunulabilmesi i\u00e7in ‘AuthorizationController’ i\u00e7erisinde a\u015fa\u011f\u0131daki authorization endpoint g\u00f6revini g\u00f6recek olan ‘Authorize’ action metodunu in\u015fa edelim.<\/p>\n\n\r\n public class AuthorizationController : Controller\r\n {\r\n readonly IOpenIddictApplicationManager _applicationManager;\r\n\r\n public AuthorizationController(IOpenIddictApplicationManager applicationManager)\r\n {\r\n _applicationManager = applicationManager;\r\n }\r\n\r\n \/\/Bu action'\u0131n endpoint'ini token endpoint ile ayn\u0131 \u015fekilde ayarl\u0131yoruz.\r\n [HttpPost("~\/connect\/token"), Produces("application\/json")]\r\n public async Task<IActionResult> Exchange()\r\n {\r\n .\r\n .\r\n .\r\n }\r\n\r\n [HttpGet("~\/connect\/authorize"), HttpPost("~\/connect\/authorize")]\r\n public async Task<IActionResult> Authorize(string accept, string deny)\r\n {\r\n var request = HttpContext.GetOpenIddictServerRequest() ?? throw new InvalidOperationException("The OpenID Connect request cannot be retrieved.");\r\n\r\n \/\/Cookie'de authentication i\u00e7in tutulan veriden kullan\u0131c\u0131 bilgisini al\u0131yoruz.\r\n var result = await HttpContext.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);\r\n \/\/E\u011fer kullan\u0131c\u0131 bilgisi yoksa kullan\u0131c\u0131y\u0131 login sayfas\u0131na y\u00f6nlendiriyoruz.\r\n if (!result.Succeeded)\r\n return Challenge(\r\n authenticationSchemes: CookieAuthenticationDefaults.AuthenticationScheme,\r\n properties: new AuthenticationProperties()\r\n {\r\n RedirectUri = $"{Request.PathBase}{Request.Path}{(QueryString.Create(Request.HasFormContentType ? Request.Form.ToList() : Request.Query.ToList()))}"\r\n });\r\n\r\n var identity = new ClaimsIdentity(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);\r\n identity.AddClaim(OpenIddictConstants.Claims.Subject, result.Principal.Identity.Name, Destinations.AccessToken);\r\n identity.AddClaim(JwtRegisteredClaimNames.Aud, "Example-OpenIddict", Destinations.AccessToken, Destinations.IdentityToken);\r\n identity.AddClaim("ornek-claim", "ornek claim value", Destinations.AccessToken);\r\n\r\n var application = await _applicationManager.FindByClientIdAsync(request.ClientId);\r\n if (HttpContext.Request.Method == "GET")\r\n return View(new AuthorizeVM\r\n {\r\n ApplicationName = await _applicationManager.GetLocalizedDisplayNameAsync(application),\r\n Scopes = request.Scope\r\n });\r\n else if (!string.IsNullOrEmpty(accept))\r\n {\r\n var claimsPrincipal = new ClaimsPrincipal(identity);\r\n claimsPrincipal.SetScopes(request.GetScopes());\r\n\r\n return SignIn(claimsPrincipal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);\r\n }\r\n\r\n return Forbid(authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,\r\n properties: new AuthenticationProperties(new Dictionary<string, string>\r\n {\r\n [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidScope\r\n }));\r\n }\r\n }\r\n<\/pre>\n<\/div>\n\u0130lgili metodun i\u00e7eri\u011fini incelerseniz e\u011fer; Client Credentials Flow<\/a>‘dan farkl\u0131 olarak authorization code, onay i\u00e7in kullan\u0131c\u0131 bilgisine odaklanmaktad\u0131r. Her ne kadar client authorization server’dan kullan\u0131c\u0131 bilgilerini talep ediyor olsa da bizler kullan\u0131c\u0131n\u0131n \u00f6nceden oturum a\u00e7\u0131p a\u00e7mad\u0131\u011f\u0131n\u0131 25.<\/strong> sat\u0131rda denetliyor, gerekirse 27<\/strong> ile 33.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda oldu\u011fu gibi login sayfas\u0131na y\u00f6nlendiriyoruz.<\/p>\n Kullan\u0131c\u0131 kimli\u011fi do\u011frulanm\u0131\u015fsa e\u011fer client’a kullan\u0131c\u0131ya dair verilecek bilgiler 35<\/strong> ile 38.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda claim olarak haz\u0131rlanmaktad\u0131r. 41<\/strong> ile 53.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda ise client’\u0131n, authorization server’dan kullan\u0131c\u0131ya dair isteyece\u011fi yetkilerin kullan\u0131c\u0131 tarafl\u0131 onay\u0131n\u0131 sunmakta ve bu onay\u0131n verilip verilmedi\u011fi kontrol edilmektedir. 42<\/strong> ile 46.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda onay sayfas\u0131na y\u00f6nlendirme ger\u00e7ekle\u015ftirilmekte, 48<\/strong> ile 53.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda ise onay verildiyse SignIn<\/code> fonksiyonunu kullanarak authorization code’a kar\u015f\u0131l\u0131k access token d\u00f6nd\u00fcrebilmesi i\u00e7in OpenIddict middleware’i tetiklemektedir. Ve son olarak 55<\/strong> ile 59.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda ise onay verilmedi\u011fi taktirde Forbid<\/code> metodu ile yetkilendirmeye engel olunmaktad\u0131r.<\/p>\n Burada onay sayfas\u0131 taraf\u0131m\u0131zca a\u015fa\u011f\u0131daki gibi tasarlanm\u0131\u015ft\u0131r.<\/p>\n \n\r\n@using Microsoft.Extensions.Primitives\r\n@using OpenIddict.AuthorizationServer.ViewModels\r\n@model AuthorizeVM\r\n<div class="jumbotron">\r\n <h1>Yetki Onaylama<\/h1>\r\n\r\n <p class="lead text-left"><strong>@Model.ApplicationName<\/strong> uygulamas\u0131na eri\u015fim yetkisi vermek istiyor musunuz? (Beklenen yetkiler: @Model.Scopes)<\/p>\r\n\r\n <form asp-controller="Authorization" asp-action="Authorize" method="post">\r\n @foreach (var parameter in Context.Request.HasFormContentType ?\r\n (IEnumerable<KeyValuePair<string, StringValues>>)Context.Request.Form : Context.Request.Query)\r\n {\r\n <input type="hidden" name="@parameter.Key" value="@parameter.Value" \/>\r\n }\r\n\r\n <input class="btn btn-lg btn-success" name="accept" type="submit" value="Yes" \/>\r\n <input class="btn btn-lg btn-danger" name="deny" type="submit" value="No" \/>\r\n <\/form>\r\n<\/div>\r\n<\/pre>\n<\/div>\nVe kullan\u0131lan viewmodel’\u0131n i\u00e7eri\u011fini de payla\u015fmam\u0131z gerekirse e\u011fer;<\/p>\n\n\r\n public class AuthorizeVM\r\n {\r\n public string ApplicationName { get; set; }\r\n public string Scopes { get; set; }\r\n public string Button { get; set; }\r\n }\r\n<\/pre>\n<\/div>\nToken Endpoint’inin Yap\u0131land\u0131r\u0131lmas\u0131<\/h4>\nArt\u0131k authorization code flow’u desteklendi\u011fimiz i\u00e7in token endpoint’i ona g\u00f6re yap\u0131land\u0131rmam\u0131z gerekmektedir.<\/p>\n\n\r\n public class AuthorizationController : Controller\r\n {\r\n readonly IOpenIddictApplicationManager _applicationManager;\r\n\r\n public AuthorizationController(IOpenIddictApplicationManager applicationManager)\r\n {\r\n _applicationManager = applicationManager;\r\n }\r\n\r\n \/\/Bu action'\u0131n endpoint'ini token endpoint ile ayn\u0131 \u015fekilde ayarl\u0131yoruz.\r\n [HttpPost("~\/connect\/token"), Produces("application\/json")]\r\n public async Task<IActionResult> Exchange()\r\n {\r\n var request = HttpContext.GetOpenIddictServerRequest();\r\n\r\n\r\n if (request?.IsAuthorizationCodeGrantType() is not null)\r\n {\r\n \/\/Authorization Code'da store edilen request sorumlusunu elde ediyoruz.\r\n var principal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;\r\n\r\n \/\/Principal'\u0131 yani kullan\u0131c\u0131y\u0131 do\u011frula\r\n \/\/if ((await _userManager.GetUserAsnyc(principal)) != null)\r\n \/\/{\r\n\r\n \/\/}\r\n\r\n return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);\r\n\r\n }\r\n else if (request?.IsClientCredentialsGrantType() is not null)\r\n {\r\n .\r\n .\r\n return SignIn(claimsPrincipal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);\r\n }\r\n throw new NotImplementedException("The specified grant type is not implemented.");\r\n }\r\n\r\n [HttpGet("~\/connect\/authorize"), HttpPost("~\/connect\/authorize")]\r\n public async Task<IActionResult> Authorize(string accept, string deny)\r\n {\r\n .\r\n .\r\n .\r\n }\r\n }\r\n<\/pre>\n<\/div>\nYukar\u0131daki kod blo\u011funu incelerseniz e\u011fer 17<\/strong> ile 30.<\/strong> sat\u0131r aral\u0131\u011f\u0131n\u0131 ekstradan eklemi\u015f ve IsAuthorizationCodeGrantType<\/code> fonksiyonu ile ilgili ak\u0131\u015fa g\u00f6re bir \u00e7al\u0131\u015fma ger\u00e7ekle\u015ftirmi\u015f bulunuyoruz.<\/p>\nClient’a Redirect Urls Bilgisinin Verilmesi<\/h4>\nAuthorization server’dan, authorization code i\u00e7in talepte bulunan client geri d\u00f6n\u00fc\u015f url’i olarak hangi adreste kar\u015f\u0131lama yapaca\u011f\u0131n\u0131 bildirmek mecburiyetindedir. Haliyle bizler postman uygulamas\u0131n\u0131 test ama\u00e7l\u0131 kullanaca\u011f\u0131m\u0131zdan dolay\u0131 postman client g\u00f6revi g\u00f6recektir ve bundan dolay\u0131 authorization code flow ile yap\u0131lan talepler neticesinde authorization server’dan postman’e geri d\u00f6n\u00fc\u015f yap\u0131labilmesi i\u00e7in postman’in bizlere sunmu\u015f oldu\u011fu \u015fu:https:\/\/oauth.pstmn.io\/v1\/callback<\/span> adresi kullan\u0131l\u0131yor olacakt\u0131r.<\/p>\n Bunun i\u00e7in client’lar\u0131n tan\u0131mland\u0131\u011f\u0131 veya bir ba\u015fka deyi\u015fle kay\u0131t edildi\u011fi ‘ClientsController’ s\u0131n\u0131f\u0131n\u0131n i\u00e7erisindeki ‘CreateClient’ metodunda a\u015fa\u011f\u0131daki gibi \u00e7al\u0131\u015fman\u0131n yap\u0131lmas\u0131 gerekmektedir.<\/p>\n\n\r\n public class ClientsController : Controller\r\n {\r\n readonly IOpenIddictApplicationManager _openIddictApplicationManager;\r\n\r\n public ClientsController(IOpenIddictApplicationManager openIddictApplicationManager)\r\n {\r\n _openIddictApplicationManager = openIddictApplicationManager;\r\n }\r\n\r\n .\r\n .\r\n .\r\n\r\n [HttpPost]\r\n public async Task<IActionResult> CreateClient(ClientCreateVM model)\r\n {\r\n var client = await _openIddictApplicationManager.FindByClientIdAsync(model.ClientId);\r\n if (client is null)\r\n {\r\n await _openIddictApplicationManager.CreateAsync(new OpenIddictApplicationDescriptor\r\n {\r\n ClientId = model.ClientId,\r\n ClientSecret = model.ClientSecret,\r\n DisplayName = model.DisplayName,\r\n RedirectUris = { new("https:\/\/oauth.pstmn.io\/v1\/callback") },\r\n Permissions =\r\n {\r\n OpenIddictConstants.Permissions.Endpoints.Token,\r\n OpenIddictConstants.Permissions.Endpoints.Authorization,\r\n\r\n OpenIddictConstants.Permissions.GrantTypes.ClientCredentials,\r\n OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode,\r\n\r\n OpenIddictConstants.Permissions.Prefixes.Scope + "read",\r\n OpenIddictConstants.Permissions.Prefixes.Scope + "write",\r\n\r\n OpenIddictConstants.Permissions.ResponseTypes.Code,\r\n }\r\n });\r\n ViewBag.Message = "Client ba\u015far\u0131yla olu\u015fturulmu\u015ftur.";\r\n return View();\r\n }\r\n ViewBag.Message = "Client zaten mevcuttur.";\r\n return View();\r\n }\r\n }\r\n<\/pre>\n<\/div>\nYa da client olarak postman yerine farkl\u0131 bir uygulama kullan\u0131lacaksa e\u011fer yukar\u0131daki kod blo\u011funun 25.<\/strong> sat\u0131r\u0131 o uygulaman\u0131n redirect url’ine g\u00f6re ayarlanmas\u0131 gerekmektedir.<\/p>\n \n\r\n .\r\n .\r\n RedirectUris = { new("https:\/\/filanca.com\/...") },\r\n<\/pre>\n<\/div>\nEk olarak client’\u0131n izinleri olarak da ‘Permissions’ property’sine ‘Authorization’, ‘AuthorizationCode’ ve ‘Code’ yetkilerinin de verildi\u011fine dikkatinizi \u00e7ekerim.<\/p>\n Ayr\u0131ca burada isterseniz redirect url’i yine client’tan talep edebilirsiniz. Tabi bu sefer bahsedilen client eklenecek olan de\u011fil, bu ekleme i\u015flemini yapacak olan client’t\u0131r \ud83d\ude42<\/p>\n Client’lar\u0131n redirect url’lerini bu \u015fekilde belirledikten sonra yeni gelecek olan client kay\u0131tlar\u0131nda verilerin a\u015fa\u011f\u0131daki gibi veritaban\u0131na yans\u0131t\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6zlemliyor olaca\u011f\u0131z. \n<\/a><\/p>\n Postman \u00dczerinden Test Edilmesi<\/h4>\nArt\u0131k yapt\u0131\u011f\u0131m\u0131z \u00e7al\u0131\u015fmay\u0131 test edip, g\u00f6zlemleyebiliriz. Bunun i\u00e7in ilk olarak postman’in ‘OAuth 2.0’ t\u00fcr\u00fc \u00fczerinden bir token talebinde bulunacak ard\u0131ndan kendi geli\u015ftirece\u011fimiz custom bir client \u00fczerinden de testimizi ger\u00e7ekle\u015ftiriyor olaca\u011f\u0131z. \n<\/a><\/a>Yukar\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere gerekli bilgileri postman aray\u00fcz\u00fcne i\u015fledikten sonra a\u015fa\u011f\u0131daki ‘Get New Access Token’ butonuna t\u0131klad\u0131\u011f\u0131m\u0131zda yandaki gibi onay sayfas\u0131na y\u00f6nlendirildi\u011fimizi g\u00f6rece\u011fiz. Burada ‘Yes’ ya da ‘No’ butonlar\u0131 i\u015flevlerine g\u00f6re authorization code’un \u00fcretilmesi s\u00fcrecini ya ba\u015flatacakt\u0131r ya da ba\u015flamadan iptal edecektir. ‘Yes’ butonuna t\u0131kland\u0131\u011f\u0131 vakit \u00f6nceki sat\u0131rlarda geli\u015ftirdi\u011fimiz ‘AuthorizationController’ i\u00e7erisindeki ‘Authorize’ action’\u0131na bir POST<\/code> at\u0131lacak ve burada authorization code ile gerekli access token’\u0131n \u00fcretilebilmesi i\u00e7in SignIn<\/code> metodu e\u015fli\u011finde OpenIddict middleware’i devreye sokulacakt\u0131r. Ard\u0131ndan bu i\u015flemden sonra authorization code \u00fcretilecek ve ilgili client’\u0131n redirect url’ine ‘code’ query string’i e\u015fli\u011finde g\u00f6nderilecektir.<\/a>\u0130\u015fte postman’de ilgili redirect url’in ekran g\u00f6r\u00fcnt\u00fcs\u00fc yukar\u0131daki gibidir ve daha da \u00f6nemlisi \u00fcretilmi\u015f olan authorization code ‘code’ query string parametresinde oldu\u011fu gibi client taraf\u0131ndan elde edilmektedir.<\/p>\n Bu sayfa a\u00e7\u0131ld\u0131\u011f\u0131 taktirde elde edilen authorization code ile ‘AuthorizationController’ i\u00e7erisindeki ‘Exchange’ action’\u0131na authorization code grant t\u00fcr\u00fcnde istek g\u00f6nderilmekte ve ilgili authorization code’a nazaran access token \u00fcretilerek geri d\u00f6nd\u00fcr\u00fclmektedir. \n<\/a>Bu a\u015famadan sonra ilgili access token’\u0131 kullanarak Resource Server’lara(ya da API Server’lara) yap\u0131lan t\u00fcm istekler ba\u015far\u0131l\u0131 \u015fekilde sonu\u00e7lanacakt\u0131rlar.<\/a><\/p>\n Access Token’\u0131n jwt.io<\/a>‘da Decode Edilmesi<\/h4>\n\u00dcretilen access token de\u011ferini decode edip incelememiz gerekirse e\u011fer bunun i\u00e7in jwt.io<\/a>‘dan istifade edebiliriz. \n<\/a><\/p>\n Custom Geli\u015ftirilen Asp.NET Core MVC Temelli Client \u00dczerinden Test Edilmesi<\/h4>\n\u015eimdide yapt\u0131\u011f\u0131m\u0131z \u00e7al\u0131\u015fmay\u0131 custom geli\u015ftirece\u011fimiz uygulama \u00fczerinden test edelim. Bunun i\u00e7in ‘Client’ ad\u0131nda bir Asp.NET Core MVC uygulamas\u0131 olu\u015fturarak i\u00e7erisine a\u015fa\u011f\u0131daki k\u00fct\u00fcphaneleri y\u00fckleyerek ba\u015flayabiliriz.<\/p>\n\ndotnet add package OpenIddict --version 4.0.0-preview3.22422.72<\/a><\/code> \ndotnet add package OpenIddict.EntityFrameworkCore --version 4.0.0-preview3.22422.72<\/a><\/code> \ndotnet add package OpenIddict.AspNetCore --version 4.0.0-preview3.22422.72<\/a><\/code>\n<\/div>\nBu k\u00fct\u00fcphanelerle Asp.NET Core uygulamas\u0131n\u0131 client olarak tasarlayabilecek ve gerekli konfig\u00fcrasyonlar\u0131 sa\u011flayabilece\u011fiz.<\/p>\n Temel k\u00fct\u00fcphaneleri y\u00fckledikten sonra ‘Program.cs’ dosyas\u0131nda a\u015fa\u011f\u0131daki yap\u0131land\u0131rmalarda bulunal\u0131m;<\/p>\n\n\r\nusing Client.Models;\r\nusing Microsoft.AspNetCore.Authentication.Cookies;\r\nusing Microsoft.AspNetCore.Authentication.OpenIdConnect;\r\nusing Microsoft.EntityFrameworkCore;\r\nusing Microsoft.IdentityModel.Protocols.OpenIdConnect;\r\nusing OpenIddict.Client;\r\nusing static OpenIddict.Abstractions.OpenIddictConstants;\r\n\r\nvar builder = WebApplication.CreateBuilder(args);\r\n\r\nbuilder.Services.AddControllersWithViews();\r\n\r\nbuilder.Services.AddDbContext<ApplicationDbContext>(options =>\r\n{\r\n options.UseSqlServer(builder.Configuration.GetConnectionString("SQLServer"));\r\n options.UseOpenIddict();\r\n});\r\n\r\nbuilder.Services.AddAuthentication(options => options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme)\r\n .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>\r\n {\r\n options.LoginPath = "\/login";\r\n options.ExpireTimeSpan = TimeSpan.FromMinutes(15);\r\n });\r\n\r\nbuilder.Services.AddOpenIddict()\r\n .AddCore(options =>\r\n {\r\n options.UseEntityFrameworkCore()\r\n .UseDbContext<ApplicationDbContext>();\r\n\r\n \/\/Burada MongoDB kullanmak isterseniz a\u015fa\u011f\u0131daki yap\u0131land\u0131rma kodlar\u0131ndan istifade edebilirsiniz.\r\n \/\/ options.UseMongoDb()\r\n \/\/ .UseDatabase(new MongoClient().GetDatabase("openiddict"));\r\n })\r\n \/\/OpenIddict client componentinin yap\u0131land\u0131rmas\u0131.\r\n .AddClient(options =>\r\n {\r\n options.SetRedirectionEndpointUris("\/callback\/login\/local");\r\n options.SetPostLogoutRedirectionEndpointUris("\/callback\/logout\/local");\r\n\r\n options.AddDevelopmentEncryptionCertificate()\r\n .AddDevelopmentSigningCertificate();\r\n\r\n options.UseAspNetCore()\r\n .EnableStatusCodePagesIntegration()\r\n .EnableRedirectionEndpointPassthrough()\r\n .EnablePostLogoutRedirectionEndpointPassthrough();\r\n\r\n options.UseSystemNetHttp();\r\n\r\n options.AddRegistration(new OpenIddictClientRegistration\r\n {\r\n Issuer = new Uri("https:\/\/localhost:7047", UriKind.Absolute),\r\n\r\n ClientId = "my-client",\r\n ClientSecret = "my-client-secret",\r\n Scopes = { "read", "write" },\r\n\r\n RedirectUri = new Uri("https:\/\/localhost:7226\/callback\/login\/local", UriKind.Absolute),\r\n PostLogoutRedirectUri = new Uri("https:\/\/localhost:7226\/callback\/logout\/local", UriKind.Absolute),\r\n });\r\n });\r\n\r\nbuilder.Services.AddHttpClient();\r\n\r\nvar app = builder.Build();\r\n\r\nif (!app.Environment.IsDevelopment())\r\n{\r\n app.UseExceptionHandler("\/Home\/Error");\r\n app.UseHsts();\r\n}\r\n\r\napp.UseHttpsRedirection();\r\napp.UseStaticFiles();\r\n\r\napp.UseRouting();\r\n\r\napp.UseAuthentication();\r\napp.UseAuthorization();\r\n\r\napp.MapControllerRoute(\r\n name: "default",\r\n pattern: "{controller=Home}\/{action=Index}\/{id?}");\r\n\r\napp.Run();\r\n\r\n<\/pre>\n<\/div>\nBurada \u00f6zellikle 37<\/strong> ile 63.<\/strong> sat\u0131r aral\u0131\u011f\u0131na g\u00f6z atarsan\u0131z e\u011fer OpenIddict i\u00e7in gerekli client yap\u0131land\u0131rmalar\u0131 sa\u011flanmaktad\u0131r. SetRedirectionEndpointUris<\/code> ve SetPostLogoutRedirectionEndpointUris<\/code> fonksiyonlar\u0131 ile authorization server’a yap\u0131lan authorization code yahut logout talepleri i\u00e7in uygulamadaki y\u00f6nlendirme adresleri bildirilmektedir. \u00d6zellikle 52<\/strong> ile 62.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda ise AddRegistration<\/code> fonksiyonu e\u015fli\u011finde client bilgileri tan\u0131mlanmaktad\u0131r. Tabi buradaki client bilgilerini esas\u0131nda authorization server’a gidip tan\u0131mlaman\u0131z gerekti\u011fini hat\u0131rlatmakta fayda g\u00f6rmekteyim.<\/p>\n Bu tan\u0131mlamalar\u0131 yapt\u0131ktan sonra olu\u015fturdu\u011fumuz bu client uygulamas\u0131nda ‘AuthenticationController.cs’ isminde bir controller s\u0131n\u0131f\u0131 olu\u015ftural\u0131m ve i\u00e7eri\u011fini a\u015fa\u011f\u0131daki gibi doldural\u0131m.<\/p>\n\n\r\n public class AuthenticationController : Controller\r\n {\r\n [HttpGet("~\/login")]\r\n public IActionResult LogIn(string returnUrl)\r\n {\r\n var properties = new AuthenticationProperties(new Dictionary<string, string?>\r\n {\r\n [OpenIddictClientAspNetCoreConstants.Properties.Issuer] = "https:\/\/localhost:7047"\r\n });\r\n properties.RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "\/";\r\n\r\n \/\/Challenge metodu ile OpenIddict middleware'\u0131 sayesinde ilgili Issuer'a kar\u015f\u0131l\u0131k gelen client bilgilerini authorization server'a y\u00f6nlendiriyoruz.\r\n return Challenge(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);\r\n }\r\n\r\n [HttpPost("~\/logout"), ValidateAntiForgeryToken]\r\n public async Task<ActionResult> LogOut(string returnUrl)\r\n {\r\n \/\/Elde bulunan authentication cookie bilgilerini elde ediyoruz. E\u011fer yoksa zaten kullan\u0131c\u0131n\u0131n hen\u00fcz oturum a\u00e7mad\u0131\u011f\u0131n\u0131 anl\u0131yoruz.\r\n var result = await HttpContext.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);\r\n if (result is not { Succeeded: true })\r\n return Redirect(Url.IsLocalUrl(returnUrl) ? returnUrl : "\/");\r\n\r\n \/\/SignOut yaparak mevcut authentication cookie bilgilerini temizliyoruz.\r\n await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);\r\n\r\n var properties = new AuthenticationProperties(new Dictionary<string, string?>\r\n {\r\n [OpenIddictClientAspNetCoreConstants.Properties.Issuer] = "https:\/\/localhost:7047",\r\n [OpenIddictClientAspNetCoreConstants.Properties.IdentityTokenHint] = result.Properties.GetTokenValue(OpenIddictClientAspNetCoreConstants.Tokens.BackchannelIdentityToken)\r\n });\r\n properties.RedirectUri = Url.IsLocalUrl(returnUrl) ? returnUrl : "\/";\r\n\r\n return SignOut(properties, OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);\r\n }\r\n\r\n [HttpGet("~\/callback\/login\/{provider}"), HttpPost("~\/callback\/login\/{provider}"), IgnoreAntiforgeryToken]\r\n public async Task<ActionResult> LogInCallback()\r\n {\r\n \/\/ OpenIddict taraf\u0131ndan do\u011frulanan yetkilendirme verilerini elde ediyoruz.\r\n var result = await HttpContext.AuthenticateAsync(OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);\r\n\r\n if (result.Principal.Identity is not ClaimsIdentity { IsAuthenticated: true })\r\n {\r\n throw new InvalidOperationException("The external authorization data cannot be used for authentication.");\r\n }\r\n\r\n var claims = new List<Claim>(result.Principal.Claims\r\n .Select(claim => claim switch\r\n {\r\n { Type: Claims.Subject }\r\n => new Claim(ClaimTypes.NameIdentifier, claim.Value, claim.ValueType, claim.Issuer),\r\n { Type: Claims.Name }\r\n => new Claim(ClaimTypes.Name, claim.Value, claim.ValueType, claim.Issuer),\r\n _ => claim\r\n })\r\n .Where(claim => claim switch\r\n {\r\n { Type: ClaimTypes.NameIdentifier or ClaimTypes.Name } => true,\r\n _ => false\r\n }));\r\n\r\n var identity = new ClaimsIdentity(claims,\r\n authenticationType: CookieAuthenticationDefaults.AuthenticationScheme,\r\n nameType: ClaimTypes.Name,\r\n roleType: ClaimTypes.Role);\r\n\r\n var properties = new AuthenticationProperties(result.Properties.Items);\r\n\r\n \/\/ Gerekirse authorization server taraf\u0131ndan d\u00f6nd\u00fcr\u00fclen tokenlar authentication cookie'de de saklanabilir.\r\n properties.StoreTokens(result.Properties.GetTokens().Where(token => token switch\r\n {\r\n {\r\n Name: OpenIddictClientAspNetCoreConstants.Tokens.BackchannelAccessToken or\r\n OpenIddictClientAspNetCoreConstants.Tokens.BackchannelIdentityToken or\r\n OpenIddictClientAspNetCoreConstants.Tokens.RefreshToken\r\n } => true,\r\n _ => false\r\n }));\r\n\r\n await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity), properties);\r\n\r\n return Redirect(properties.RedirectUri);\r\n }\r\n\r\n [HttpGet("~\/callback\/logout\/{provider}"), HttpPost("~\/callback\/logout\/{provider}"), IgnoreAntiforgeryToken]\r\n public async Task<ActionResult> LogOutCallback()\r\n {\r\n var result = await HttpContext.AuthenticateAsync(OpenIddictClientAspNetCoreDefaults.AuthenticationScheme);\r\n return Redirect(result!.Properties!.RedirectUri);\r\n }\r\n }\r\n<\/pre>\n<\/div>\nYukar\u0131daki kod blo\u011funa g\u00f6z atarsan\u0131z e\u011fer; 4<\/strong> ile 14.<\/strong> sat\u0131r aral\u0131\u011f\u0131ndaki LogIn<\/code> metodu i\u00e7erisinde kullan\u0131c\u0131 taraf\u0131ndan onay istenecek \u015fekilde authorization server \u00fczerinden login i\u015flemleri ger\u00e7ekle\u015ftirilmektedir.<\/p>\n 17<\/strong> ile 35.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda ise LogOut<\/code> action’\u0131 i\u00e7erisinde logout operasyonlar\u0131 ger\u00e7ekle\u015ftirilmektedir. Tabi bu operasyonlar\u0131n sa\u011fl\u0131kl\u0131 bir \u015fekilde ger\u00e7ekle\u015febilmesi i\u00e7in authorization server’da bir ka\u00e7 konfig\u00fcrasyona ihtiya\u00e7 olacakt\u0131r. Bunlardan ilki client eklerken PostLogoutRedirectUris<\/code> property’sine logout an\u0131nda geri d\u00f6n\u00fc\u015f de\u011ferinin verilmesi, bir di\u011feri ise ‘Program.cs’de SetLogoutEndpointUris(\"\/connect\/logout\")<\/code> metodu ile logout endpoint url’inin set edilmesidir.<\/p>\n 38<\/strong> ile 84.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda ise login yap\u0131ld\u0131ktan sonra authorization server’dan gelecek olan authorization code’u kar\u015f\u0131lay\u0131p gerekli signin i\u015flemleri y\u00fcr\u00fct\u00fclmektedir. Ayn\u0131 \u015fekilde 81<\/strong> ile 91.<\/strong> sat\u0131r aral\u0131\u011f\u0131nda da logout neticesinde authentication cookie’leri temizlenmektedir.<\/p>\n Bu i\u015flemlerden sonra art\u0131k client taraf\u0131ndan edinilen kullan\u0131c\u0131 yetkilerini deneyimleyebilece\u011fimiz bir \u00e7al\u0131\u015fma yapmam\u0131z yeterli olacakt\u0131r. Bunun i\u00e7in ‘HomeController’ i\u00e7erisinde a\u015fa\u011f\u0131daki gibi in\u015fada bulunabiliriz.<\/p>\n\n\r\n public class HomeController : Controller\r\n {\r\n readonly IHttpClientFactory _httpClientFactory;\r\n\r\n public HomeController(IHttpClientFactory httpClientFactory)\r\n => _httpClientFactory = httpClientFactory;\r\n\r\n public IActionResult Index()\r\n => View();\r\n\r\n [HttpPost]\r\n [Authorize]\r\n public async Task<IActionResult> Index(CancellationToken cancellationToken)\r\n {\r\n string? token = await HttpContext.GetTokenAsync(CookieAuthenticationDefaults.AuthenticationScheme, OpenIddictClientAspNetCoreConstants.Tokens.BackchannelAccessToken);\r\n\r\n using HttpClient httpClient = _httpClientFactory.CreateClient();\r\n using HttpRequestMessage httpRequestMessage = new(HttpMethod.Get, "https:\/\/localhost:7056\/api\/values\/a");\r\n httpRequestMessage.Headers.Authorization = new("Bearer", token);\r\n\r\n using HttpResponseMessage httpResponseMessage = await httpClient.SendAsync(httpRequestMessage, cancellationToken);\r\n\r\n return View(model: await httpResponseMessage.Content.ReadAsStringAsync(cancellationToken));\r\n }\r\n }\r\n<\/pre>\n<\/div>\n\n\r\n@model string\r\n\r\n@{\r\n ViewData["Title"] = "Home Page";\r\n}\r\n\r\n<div class="text-center">\r\n <h1 class="display-4">Welcome<\/h1>\r\n <p>Learn about <a href="https:\/\/docs.microsoft.com\/aspnet\/core">building Web apps with ASP.NET Core<\/a>.<\/p>\r\n<\/div>\r\n\r\n<form asp-action="Index" asp-controller="Home">\r\n <button>\u0130stek Yap<\/button>\r\n<\/form>\r\n<form asp-action="Logout" asp-controller="Authentication" method="post">\r\n <button class="btn btn-lg btn-danger" type="submit">Sign out<\/button>\r\n<\/form>\r\n\r\n<p>\r\n @Model\r\n<\/p>\r\n<\/pre>\n<\/div>\nG\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere ‘Index’ action’\u0131n\u0131n post versiyonu authorize edilmi\u015f vaziyettedir. Yani yetkilendirme beklemektedir. Uygulamay\u0131 aya\u011fa kald\u0131r\u0131p, login olduktan sonra istek yap butonuna t\u0131kland\u0131\u011f\u0131 taktirde requestin API Resource’a iste\u011fin ba\u015far\u0131yla gidip geldi\u011fini yani client’\u0131n ba\u015far\u0131yla kullan\u0131c\u0131 izinleriyle yetkilendirildi\u011fini g\u00f6zlemliyor olaca\u011f\u0131z.<\/p>\n OpenIddict K\u00fct\u00fcphanesi \u0130le Authorization Code S\u00fcre\u00e7lerindeki Veritaban\u0131nda Olu\u015fan Hareketlili\u011fi \u0130nceleyelim<\/h4>\nClient uygulamas\u0131 ile authorization server \u00fczerinden yap\u0131lan her login talebinde ‘OpenIddictTokens’ tablosuna bir kay\u0131t at\u0131lmaktad\u0131r.<\/a>At\u0131lan kay\u0131t bu iste\u011fin ilk s\u00fcreci oldu\u011fu i\u00e7in state_token<\/code> type de\u011ferinde tutulmaktad\u0131r. Kullan\u0131c\u0131 taraf\u0131ndan onay verilip authorization code elde edildi\u011fi taktirde ilgili tabloya bu token de\u011ferleri de i\u015fleniyor olacakt\u0131r.<\/a>Ve dikkat ederseniz e\u011fer ‘OpenIddictAuthorizations’ tablosunda da ilgili client’a dair hangi tarihler aras\u0131nda bir authorization i\u015flemi ger\u00e7ekle\u015ftirildi\u011fi tutulmaktad\u0131r. Anlayaca\u011f\u0131n\u0131z, authorization server \u00fczerinden yap\u0131lan t\u00fcm talep s\u00fcre\u00e7lerinde ilgili tablolara kay\u0131tlar\u0131n bu seyirde i\u015flenmesi devam edecektir…<\/p>\n Evet, b\u00f6ylece OpenIddict k\u00fct\u00fcphanesi ile Authorization Code Flow’un nas\u0131l uygulanabilece\u011fini incelemi\u015f olduk. Normalde custom uygulamaya \u00f6rnek olarak console projesini de sunmak isterdim lakin i\u00e7eri\u011fin hacmini haddinden fazla \u015fi\u015firmemek i\u00e7in yorumlarda payla\u015fmak \u00fczere makalemizi burada noktal\u0131yorum.<\/p>\n Okuyarak e\u015flik etti\u011finiz i\u00e7in te\u015fekk\u00fcr ederim.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n Not : \u00d6rnek uygulaman\u0131n kaynak kodlar\u0131na a\u015fa\u011f\u0131daki github adresinden eri\u015febilirsiniz. \nhttps:\/\/github.com\/gncyyldz\/OpenIddict-Authorization-Server-Example<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde OpenIddict k\u00fct\u00fcphanesi ile iki a\u015famal\u0131 do\u011frulama ger\u00e7ekle\u015ftirmemizi gereki k\u0131lan Authorization Code Flow‘un nas\u0131l uygulanabilece\u011fini ele al\u0131yor olaca\u011f\u0131z. Hadi buyurun ba\u015flayal\u0131m. Authorization Code Nedir? Tabi \u00f6ncelikle Authorization Code’un ne oldu\u011funu ele alarak...<\/p>\n","protected":false},"author":1,"featured_media":3014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4665],"tags":[3874,3872,4666,4684,4683],"class_list":["post-25671","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-openiddict","tag-authorization-code","tag-authorization-code-flow","tag-openiddict","tag-openiddict-authorization-code","tag-openiddict-authorization-code-flow"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=25671"}],"version-history":[{"count":52,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25671\/revisions"}],"predecessor-version":[{"id":25733,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25671\/revisions\/25733"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/3014"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=25671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=25671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=25671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}