Cirreum.Runtime.Wasm.Oidc 1.0.40

Cirreum.Runtime.Wasm.Oidc

Seamless OIDC authentication for Blazor WebAssembly applications in the Cirreum ecosystem

Overview

Cirreum.Runtime.Wasm.Oidc provides OpenID Connect (OIDC) authentication for Blazor WebAssembly applications built on the Cirreum framework.

It supports both:

• Static OIDC configuration (traditional single-tenant apps)
• Dynamic, runtime-resolved OIDC configuration (multi-tenant / white-label / BYOID scenarios)

The library extends Microsoft’s WASM authentication stack with enhanced claims handling, authorization defaults, session monitoring, and fluent configuration.

Features

• OIDC Authentication

  • Full OpenID Connect support for Blazor WebAssembly
  • Works with any OIDC-compliant identity provider

• Dynamic Tenant Authentication

  • Resolve OIDC settings at runtime per tenant
  • No compile-time dependency on a specific IdP
  • Supports Okta, Auth0, Ping, Keycloak, Duende, and others

• Enhanced Claims Processing

  • Custom claims principal factory
  • Optional claims extenders for provider-specific mapping

• Authorization Policies

  • Standard policies included by default:

    • Standard
    • StandardInternal
    • StandardAgent
    • StandardManager
    • StandardAdmin

• Session Monitoring

  • Idle timeout and absolute session lifetime support

• Application User Integration

  • Fluent registration of application user factories

• Fluent Configuration API

  • Builder-based chaining for auth-related concerns

Installation

dotnet add package Cirreum.Runtime.Wasm.Oidc

Usage

Static (Traditional) OIDC Setup

builder.AddOidcAuth(options =>
{
    options.Authority = "https://your-identity-provider.com";
    options.ClientId = "your-client-id";
    options.ResponseType = "code";
    options.DefaultScopes.Add("openid");
    options.DefaultScopes.Add("profile");
});

Static OIDC with Custom Claims Extender

builder.AddOidcAuth(options =>
{
    options.Authority = "https://your-identity-provider.com";
    options.ClientId = "your-client-id";
})
.AddClaimsExtender<MyClaimsExtender>();

Dynamic (Tenant-Resolved) OIDC Authentication

AddDynamicAuth enables runtime OIDC configuration, allowing the application to authenticate users against different identity providers based on the current tenant.

This is ideal for:

• Multi-tenant SaaS
• White-label platforms
• Bring-Your-Own-Identity (BYOID)
• Customer-hosted IdPs

Program.cs

var builder = DomainApplication.CreateBuilder(args);

builder.AddDynamicAuth();

await builder.BuildAndRunAsync<MyDomain>();

Dynamic Auth with Claims Extender

builder.AddDynamicAuth()
    .AddClaimsExtender<OktaClaimsExtender>();

How Dynamic Auth Works

1. A lightweight loader script runs before Blazor starts
2. The loader fetches tenant-specific OIDC configuration
3. Configuration is written to:

window.tenantAuthConfig

4. AddDynamicAuth() reads this configuration during startup
5. OIDC authentication is configured dynamically

Loader Contract

To enable dynamic auth, the loader must define:

<script
  src="cirreum-wasm-loader.js"
  auth-type="dynamic"
  auth-type-url="https://auth.example.com/tenants/{tenant}/oidc">
</script>

• {tenant} is replaced with the tenant slug derived from the URL
• The endpoint must return a valid tenant auth configuration payload

Required Tenant Configuration Fields

{
  "authority": "https://idp.example.com",
  "clientId": "client-id",
  "responseType": "code",
  "scopes": ["openid", "profile", "email"]
}

Validation

AddDynamicAuth throws an exception at startup if:

• Tenant configuration is missing
• Authority is not defined
• ClientId is not defined

This ensures authentication failures are detected early and explicitly.

Adding Session Monitoring

builder.AddOidcAuth(options => { /* ... */ })
    .AddSessionMonitoring(session =>
    {
        session.IdleTimeout = TimeSpan.FromMinutes(30);
        session.SessionTimeout = TimeSpan.FromHours(8);
    });

Works identically for static and dynamic authentication.

Adding Application User Support

builder.AddOidcAuth(options => { /* ... */ })
    .AddApplicationUserResolver<MyUserResolver>();

Or with dynamic auth:

builder.AddDynamicAuth()
    .AddApplicationUserResolver<MyUserResolver>();

Architecture

Built on top of:

• Cirreum.Runtime.Wasm
• Microsoft.AspNetCore.Components.WebAssembly.Authentication
• Microsoft.IdentityModel.JsonWebTokens

Dynamic auth is layered cleanly on top of the standard WASM auth pipeline and does not replace or fork Microsoft’s implementation.

Versioning

This package follows Semantic Versioning:

• Major — Breaking changes
• Minor — Backward-compatible features
• Patch — Bug fixes

Dynamic authentication was introduced as a non-breaking additive feature.

License

MIT License. See LICENSE.

Cirreum Foundation Framework Layered simplicity for modern .NET