<\/div>\n

Merhaba,<\/p>\n

Bu i\u00e7eri\u011fimizde OpenIddict k\u00fct\u00fcphanesi ile OpenID Connect<\/em> protokol\u00fcn\u00fc nas\u0131l kullanabilece\u011fimizi ve ekstra kullan\u0131c\u0131 bilgilerini sorgulaman\u0131n nas\u0131l yap\u0131labilece\u011fini inceliyor olaca\u011f\u0131z.<\/p>\n

Her \u015feyden \u00f6nce temel terminolojiyi oturtabilmek i\u00e7in OpenId Connect’in ne oldu\u011funu izah ederek ba\u015flamakta fayda g\u00f6r\u00fcyorum.<\/p>\n

OpenID Connect Nedir?<\/h4>\n
Esas\u0131nda OpenID Connect hakk\u0131nda detayl\u0131 bilgiyi OAuth 2.0 ve OpenID Connect Protokolleri Nelerdir?<\/a> ba\u015fl\u0131kl\u0131 makalemden edinebilirsiniz. Amma velakin burada da ufak bir tan\u0131mlamada bulunman\u0131n bu i\u00e7eri\u011fin insicam\u0131 i\u00e7in gerekli oldu\u011funu d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fcmden ilgili yaz\u0131dan ufak bir al\u0131nt\u0131yla devam etmek istiyorum…<\/p>\n
…OpenID Connect, esas\u0131nda bir protokolden ziyade OAuth 2.0 \u00fczerinde kimlik do\u011frulama(authentication) i\u015flemlerini \u00fcstlenen bir katmand\u0131r. API dostu bir yap\u0131 sa\u011flamakta ve i\u015flemleri basit tutarak JWT kullan\u0131m\u0131n\u0131 kolayla\u015ft\u0131rmaktad\u0131r…<\/em><\/p><\/blockquote>\n
OpenID Connect protokol\u00fc kimlik do\u011frulama i\u015flemlerini \u00fcstlendi\u011fi i\u00e7in i\u00e7erisinde kullan\u0131c\u0131 bilgilerini bar\u0131nd\u0131ran identity token<\/em> ad\u0131nda bir token sa\u011flamaktad\u0131r. Bizler bu token’\u0131 kullanarak ekstradan kullan\u0131c\u0131 bilgilerini edinebilmekte ve varsa ekstradan i\u015flemleri ger\u00e7ekle\u015ftirebilmekteyiz.<\/p>\n
OpenID Connect Protokol\u00fcn\u00fc Etkinle\u015ftirme<\/h4>\nOpenIddict, OpenID Connect protokol\u00fcn\u00fc zaten uygulamaktad\u0131r ve openid<\/code> scope’u e\u015fli\u011finde yap\u0131lan taleplere kar\u015f\u0131l\u0131k identity token<\/em> d\u00f6nd\u00fcrmektedir. Bunu a\u015fa\u011f\u0131daki gibi test edebilir ve identity token<\/em>‘\u0131n elde edildi\u011fini g\u00f6rebilirsiniz.<\/a>Yukar\u0131daki istek neticesinde response olarak access token e\u015fli\u011finde a\u015fa\u011f\u0131daki gibi bir identity token elde edilecektir.<\/a>Bu identity token de\u011ferini jwt.io \u00fczerinden \u00e7\u00f6z\u00fcmleyerek incelersek e\u011fer;<\/a>\u015feklinde bir i\u00e7eri\u011fe sahip oldu\u011funu g\u00f6zlemlemekteyiz.<\/p>\n
Identity token’a istedi\u011finiz bilgileri depolayabilirsiniz. Bunun i\u00e7in e\u011fer ki ak\u0131\u015f olarak authorization code flow’u kullan\u0131yorsan\u0131z ‘AuthorizationController’ i\u00e7erisindeki ‘Authorize’ metodunda yahut client credential flow’u kullan\u0131yorsan\u0131z da token endpoint’ine kar\u015f\u0131l\u0131k gelen ‘Exchange’ fonksiyonunda \u00e7al\u0131\u015fabilirsiniz.<\/p>\n
\n\r\n public async Task<IActionResult> Authorize(string accept, string deny)\r\n {\r\n .\r\n .\r\n .\r\n var identity = new ClaimsIdentity(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);\r\n identity.AddClaim(OpenIddictConstants.Claims.Subject, result.Principal.Identity.Name, Destinations.AccessToken);\r\n identity.AddClaim(JwtRegisteredClaimNames.Aud, "Example-OpenIddict", Destinations.AccessToken, Destinations.IdentityToken);\r\n identity.AddClaim("ornek-claim", "ornek claim value", Destinations.AccessToken, Destinations.IdentityToken);\r\n identity.AddClaim("a", "a value", Destinations.AccessToken, Destinations.IdentityToken);\r\n identity.AddClaim("b", "b value", Destinations.AccessToken, Destinations.IdentityToken);\r\n .\r\n .\r\n .\r\n }\r\n<\/pre>\n<\/div>\nUserinfo Endpoint’i<\/h4>\nOpenID Connect protokol\u00fc kullan\u0131c\u0131 hakk\u0131nda bilgi al\u0131nabilmesi i\u00e7in bir endpoint sa\u011flayabilmektedir. Bunun i\u00e7in endpoint’e dair a\u015fa\u011f\u0131daki gibi konfig\u00fcrasyonun ger\u00e7ekle\u015ftirilmesi gerekmektedir.<\/p>\n\n\r\n .AddServer(options =>\r\n {\r\n options.SetTokenEndpointUris("\/connect\/token")\r\n .SetAuthorizationEndpointUris("\/connect\/authorize")\r\n .SetLogoutEndpointUris("\/connect\/logout")\r\n \/\/Kullan\u0131c\u0131 bilgilerini edinebilmek i\u00e7in userinfo endpoint'ini set ediyoruz.\r\n .SetUserinfoEndpointUris("\/connect\/userinfo");\r\n\r\n options.UseAspNetCore()\r\n .EnableTokenEndpointPassthrough()\r\n .EnableAuthorizationEndpointPassthrough()\r\n .EnableLogoutEndpointPassthrough()\r\n .EnableUserinfoEndpointPassthrough();\r\n .\r\n .\r\n .\r\n });\r\n<\/pre>\n<\/div>\nBu konfig\u00fcrasyondan sonra authorization server’\u0131 yeniden aya\u011fa kald\u0131r\u0131p \nhttps:\/\/localhost:7047\/.well-known\/openid-configuration<\/em><\/span><\/span> \nadresine istek g\u00f6nderirseniz userinfo endpoint’inin uygulamaya eklendi\u011fini g\u00f6rebilirsiniz.<\/a>Bu ad\u0131mdan sonra customer’lar ile hangi kullan\u0131c\u0131 bilgilerini payla\u015fmak istiyorsak ona g\u00f6re userinfo endpoint’ini geli\u015ftirmeye odaklanabiliriz. Bunun i\u00e7in ‘AuthorizationController’ i\u00e7erisinde ‘Userinfo’ action’\u0131n\u0131n\u0131 a\u015fa\u011f\u0131daki gibi geli\u015ftirebiliriz.<\/p>\n \n\r\n public class AuthorizationController : Controller\r\n {\r\n .\r\n .\r\n .\r\n [Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]\r\n [HttpGet("~\/connect\/userinfo")]\r\n public async Task<IActionResult> Userinfo()\r\n {\r\n var claimPrincipal = (await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)).Principal;\r\n\r\n return Ok(new\r\n {\r\n Name = claimPrincipal.GetClaim(OpenIddictConstants.Claims.Subject),\r\n Aud = claimPrincipal.GetClaim(OpenIddictConstants.Claims.Audience),\r\n A = claimPrincipal.GetClaim("a"),\r\n B = claimPrincipal.GetClaim("b"),\r\n OrnekClaim = claimPrincipal.GetClaim("ornek-claim"),\r\n });\r\n }\r\n }\r\n<\/pre>\n<\/div>\nDikkat ederseniz userinfo endpoint’ine ge\u00e7erli bir access token oldu\u011fu taktirde eri\u015filebilmektedir. Gerekli token e\u015fli\u011finde \/connect\/userinfo<\/code> adresine GET iste\u011fi yap\u0131l\u0131rsa a\u015fa\u011f\u0131daki gibi kullan\u0131c\u0131 bilgileri elde edilecektir.<\/a><\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n Not : \u00d6rnek uygulaman\u0131n kaynak kodlar\u0131na a\u015fa\u011f\u0131daki github adresinden eri\u015febilirsiniz. \nhttps:\/\/github.com\/gncyyldz\/OpenIddict-Authorization-Server-Example<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde OpenIddict k\u00fct\u00fcphanesi ile OpenID Connect protokol\u00fcn\u00fc nas\u0131l kullanabilece\u011fimizi ve ekstra kullan\u0131c\u0131 bilgilerini sorgulaman\u0131n nas\u0131l yap\u0131labilece\u011fini inceliyor olaca\u011f\u0131z. Her \u015feyden \u00f6nce temel terminolojiyi oturtabilmek i\u00e7in OpenId Connect’in ne oldu\u011funu izah ederek ba\u015flamakta...<\/p>\n","protected":false},"author":1,"featured_media":3014,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4665],"tags":[3833,4666,4668,4689,3894],"class_list":["post-25743","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-openiddict","tag-openid-connect","tag-openiddict","tag-openiddict-openid-connect","tag-openiddict-userinfo-endpoint","tag-userinfo-endpoint"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=25743"}],"version-history":[{"count":9,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25743\/revisions"}],"predecessor-version":[{"id":25759,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/25743\/revisions\/25759"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/3014"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=25743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=25743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=25743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}