Cocoar.Auth.Client.AspNetCore 0.2.1

Cocoar.Auth.Client.AspNetCore

ASP.NET Core integration for resource servers that authenticate against a Cocoar.Auth identity provider.

The lib does two things on top of vanilla AddJwtBearer:

1. Fetches {Authority}/connect/userinfo on token validation and merges the resource_access[<audience>] block onto the principal.
2. Flattens that block into native ClaimTypes.Role / "permission" / "group" claims so [Authorize(Roles = "...")] and an .RequiresCocoarPermission("...") endpoint filter work natively.

Bypass tiers (realm:admin, <resource>:admin) are pre-expanded IdP-side before emission, so the client lib does pure exact-match — no evaluator logic, no HTTP client, no caching.

Install

dotnet add package Cocoar.Auth.Client.AspNetCore

Quickstart

using Cocoar.Auth.Client.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = "https://auth.cocoar.dev";
        options.Audience  = "event-tree-api";   // matches an OAuthApi in the IdP
    });

builder.Services.AddCocoarAuthClient(o =>
{
    o.Authority = "https://auth.cocoar.dev";
    o.Audience  = "event-tree-api";             // same value as above
});

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

// Role-gated — uses the standard [Authorize] attribute since
// roles are projected to ClaimTypes.Role.
app.MapGet("/admin/ping", () => "pong")
   .RequireAuthorization(p => p.RequireRole("Editor"));

// Permission-gated — bare 2-segment string. The IdP has already
// expanded realm:admin / <resource>:admin to catalog entries, so
// this is a pure contains-check.
app.MapPost("/calendars/{id}", (string id) => Results.Ok())
   .RequiresCocoarPermission("calendar:write");

app.Run();

How the claims land on the principal

The IdP emits permissions per audience in Keycloak shape:

"resource_access": {
  "event-tree-api": {
    "roles":       ["Editor", "Viewer"],
    "permissions": ["calendar:read", "calendar:write"],
    "group":       ["Calendar Team"]
  }
}

CocoarAuthClaimsTransformation projects that into flat claims:

Read them with standard claims APIs:

var perms = ctx.User.FindAll("permission").Select(c => c.Value);

Configuration reference

License

Apache-2.0. See LICENSE.