MudraX.XAF.Keycloak.Blazor 24.2.8.2

MudraX.XAF.Keycloak.Blazor

SSO.Keycloak.Blazor module for Devexpress XAF

• make sure startup uri launchSetting.json is equate Keycloak Server

• Upgrade the package System.IdentityModel.Tokens.Jwt referenced in the Module and Blazor projects from the original 6.* to 8.* https://github.com/openiddict/openiddict-core/issues/2033

• Add reference to Keycloak.Blazor

• Add Microsoft.AspNetCore.Authentication.OpenIdConnect Nuget

    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.*" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="8.*" />
  

Blazor.Server

• Add in BlazorApplication.cs

  protected override List<Controller> CreateLogonWindowControllers()
  {
      var result = base.CreateLogonWindowControllers();
      result.Add(new AdditionalLogonActionsCustomizationController());
      return result;
  }
  
  public override void LogOff()
  {
      base.LogOff();
      var navigationManager = this.ServiceProvider.GetRequiredService<NavigationManager>();
      navigationManager.NavigateTo("Account/Logout", forceLoad: true);
  }
  

• Set launchSettings.json with same Keycloak client settings. ex: https://localhost:7282

• Add in appsettings.json

  "Keycloak": {
    "Authority": "http://localhost:8080/realms/{realm name}",
    "ClientId": "{client name}",
    "ClientSecret": "{client secret}"
  }
  

• Set Startup.cs

  • Add the following in builder.Security section

  ....
  .AddPasswordAuthentication(options => {
      options.IsSupportChangePassword = true;
  })
  .AddAuthenticationProvider<KeycloakAuthenticationProvider>(); 
  

  • Add the following in authentication section

  authentication.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, "Keycloak", options =>
  {
      options.Authority = Configuration["Keycloak:Authority"];
      options.ClientId = Configuration["Keycloak:ClientId"];
      options.ClientSecret = Configuration["Keycloak:ClientSecret"];
      options.SaveTokens = true;
      options.RequireHttpsMetadata = false;
  
      //https://stackoverflow.com/questions/74052650
      options.SignOutScheme = OpenIdConnectDefaults.AuthenticationScheme;
  
      //https://stackoverflow.com/questions/74327614
      options.Scope.Add("openid");
  
      options.Events.OnRedirectToIdentityProvider = async context =>
      {
          context.ProtocolMessage.RedirectUri = context.ProtocolMessage.RedirectUri.Replace("http:", "https:");
          await Task.FromResult(0);
      };
  });
  

  • Add the following in app.UseEndpoints section

  ....
  endpoints.MapGet("/Account/Logout", async context =>
  {
      if (context.User.Identity.AuthenticationType == "AuthenticationTypes.Federation")
          await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
  
      await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme, new AuthenticationProperties
      {
          RedirectUri = "/"
      });
  }).RequireAuthorization();
  
  endpoints.MapControllers();
  

Web API

• Set launchSettings.json with same Keycloak client settings. ex: https://localhost:7282

• Add in appsettings.json

  "Keycloak": {
    "Authority": "http://localhost:8080/realms/{realm name}",
    "ClientId": "{client name}",
    "ClientSecret": "{client secret}"
  }
  

• Modify API\AuthenticationController.cs

  public class AuthenticationController : ControllerBase
  {
      readonly IAuthenticationTokenProvider tokenProvider;
      readonly KeycloakAuthorizationService keycloakAuthorizationService;
      public AuthenticationController(IAuthenticationTokenProvider tokenProvider, KeycloakAuthorizationService keycloakAuthService = null)
      {
          this.tokenProvider = tokenProvider;
          this.keycloakAuthorizationService = keycloakAuthService;
      }
  
      [HttpPost("KeycloakAuthenticate")]
      [SwaggerOperation("Checks if the user with the specified logon parameters exists in the database. If it does, authenticates this user.", "Refer to the following help topic for more information on authentication methods in the XAF Security System: <a href='https://docs.devexpress.com/eXpressAppFramework/119064/data-security-and-safety/security-system/authentication'>Authentication</a>.")]
      public async Task<IActionResult> KeycloakAuthenticate(
          [FromBody]
          [SwaggerRequestBody(@"For example: <br /> { ""userName"": ""Admin"", ""password"": """" }")]
          AuthenticationStandardLogonParameters logonParameters
      )
      {
          try
          {
              var token = await keycloakAuthorizationService.LoginAsync(logonParameters.UserName, logonParameters.Password);
              return Ok(token.AccessToken);
          }
          catch (AuthenticationException ex)
          {
              return Unauthorized(ex.GetJson());
          }
      }
  }
  

• Set Startup.cs

  • Add the following in builder.Security section

    ....
    .AddPasswordAuthentication(options => {
        options.IsSupportChangePassword = true;
    })
    .AddAuthenticationProvider<KeycloakAuthenticationProvider>(); 
    

  • Replace services.AddAuthentication section

    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidIssuer = Configuration["Keycloak:Authority"],
    
                ValidateAudience = true,
                ValidAudience = "account",
    
                ValidateIssuerSigningKey = true,
                ValidateLifetime = false,
    
                IssuerSigningKeyResolver = (token, securityToken, kid, parameters) =>
                {
                    var client = new HttpClient();
                    var keyUri = $"{parameters.ValidIssuer}/protocol/openid-connect/certs";
                    var response = client.GetAsync(keyUri).Result;
                    var keys = new JsonWebKeySet(response.Content.ReadAsStringAsync().Result);
    
                    return keys.GetSigningKeys();
                }
            };
    
            options.RequireHttpsMetadata = false; // Only in develop environment
            options.SaveToken = false;
        });
    

  • Add in end of ConfigureServices

        services.AddHttpClient();
        services.AddScoped<KeycloakAuthorizationService>();