Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/aloji/JwtSecurity
JWT Server for Asp.Net Core and Asp.Net WebAPI2
https://github.com/aloji/JwtSecurity
asp-net-core asp-net-web-api-2 aspnetcore jwt-client jwt-middleware jwt-server jwt-token netcore2 oauth2 owin
Last synced: 2 days ago
JSON representation
JWT Server for Asp.Net Core and Asp.Net WebAPI2
- Host: GitHub
- URL: https://github.com/aloji/JwtSecurity
- Owner: aloji
- Created: 2018-08-09T16:14:11.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2022-12-08T01:11:13.000Z (almost 2 years ago)
- Last Synced: 2024-08-31T03:21:50.514Z (3 months ago)
- Topics: asp-net-core, asp-net-web-api-2, aspnetcore, jwt-client, jwt-middleware, jwt-server, jwt-token, netcore2, oauth2, owin
- Language: C#
- Homepage:
- Size: 57.6 KB
- Stars: 17
- Watchers: 4
- Forks: 5
- Open Issues: 7
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
[](https://dev.azure.com/aloji/Aloji/_build/latest?definitionId=6)
# JwtSecurity
The object is to allow using a token generated in an OWIN OAuth 2.0 Server in AspNet.Core projects.
#### Nugets: https://www.nuget.org/profiles/aloji
## Real life problem
We have the authorization server implemented with [OWIN OAuth 2.0](https://docs.microsoft.com/en-us/aspnet/aspnet/overview/owin-and-katana/owin-oauth-20-authorization-server), but the new developments are with AspNetCore
The first idea was to use the machine keys
###### MachineKey
> If the authorization server and the resource server are not on the same computer, the OAuth middleware will use the different machine keys to encrypt and decrypt bearer access token. In order to share the same private key between both projects, we add the same machinekey setting in both web.config files.
The problem is that machinekey does not exist in AspNetCore, but MS gives us a [compatibility solution](https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/compatibility/replacing-machinekey?view=aspnetcore-2.1) to replace the machinekey settings in AspNetWebApi2 and using a [key storge provider](https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/implementation/key-storage-providers?view=aspnetcore-2.1) like redis we can be shared the keys.
After several hours trying to implement this solution, I realized that it was easier, cleaner and cheaper to change the token generator to use JWT and dont use any external provider.
## Configuration
How to setup the JwtSecurity in OWIN OAuth 2.0 Server ([full sample code](https://github.com/aloji/JwtSecurity/blob/master/samples/AuthServer.Owin.NetFramework/Startup.cs))
```csharp
public class Startup
{
public void Configuration(IAppBuilder appBuilder)
{
appBuilder.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
{
AccessTokenFormat = new JwtSecureDataFormat(
new JwtSecurityOptions
{
Issuer = "yourIssuerCode",
IssuerSigningKey = "yourIssuerSigningKeyCode"
})
});
}
}
```
How to setup the JwtSecurity in Resource Server .NetFramework ([full sample code](https://github.com/aloji/JwtSecurity/blob/master/samples/ResourceServer.NetFramewok/Startup.cs))
```csharp
public class Startup
{
public void Configuration(IAppBuilder appBuilder)
{
appBuilder.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
{
AccessTokenFormat = new JwtSecureDataFormat(
new JwtSecurityOptions
{
Issuer = "yourIssuerCode",
IssuerSigningKey = "yourIssuerSigningKeyCode"
})
});
}
}
```
How to setup the JwtSecurity in Resource Server .NetFramework with Owin Auth Compatibility
```csharp
public class Startup
{
public void Configuration(IAppBuilder appBuilder)
{
appBuilder.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
{
AccessTokenFormat = new MachineKeyCompatibilityDataFormat(
new JwtSecurityOptions
{
Issuer = "yourIssuerCode",
IssuerSigningKey = "yourIssuerSigningKeyCode"
})
});
}
}
```
How to setup the JwtSecurity in Resource Server .NetCore ([full sample code](https://github.com/aloji/JwtSecurity/blob/master/samples/ResourceServer.AspNetCore/Startup.cs))
```csharp
public class Startup
{
public void ConfigureServices(IServiceCollection services)
{
services
.AddJwtBearerAuthentication(options =>
{
options.Issuer = "yourIssuerCode";
options.IssuerSigningKey = "yourIssuerSigningKeyCode";
});
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.UseAuthentication();
}
}
```
#### Bonus:
I developed a middleware to create a JwtServer with AspNetCore very similar to OwinOAuth2 settings
How to setup the JwtServer in AspNetCore ([full sample code](https://github.com/aloji/JwtSecurity/blob/master/samples/AuthServer.AspNetCore/Startup.cs))
```csharp
public class Startup
{
public void ConfigureServices(IServiceCollection services)
{
services.AddJwtServer();
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.UseJwtServer(options => {
options.TokenEndpointPath = "/token";
options.AccessTokenExpireTimeSpan = new TimeSpan(1, 0, 0);
options.Issuer = "yourIssuerCode";
options.IssuerSigningKey = "yourIssuerSigningKeyCode";
options.AuthorizationServerProvider = new AuthorizationServerProvider
{
OnGrantResourceOwnerCredentialsAsync = async (context) =>
{
if (context.UserName != context.Password)
{
context.SetError("Invalid user authentication");
return;
}
var claims = new List
{
new Claim(ClaimTypes.Surname, context.UserName)
};
context.Validated(claims);
await Task.FromResult(0);
}
};
});
}
}
```