Merge pull request 'Added a redirect packet attachment to UI signout process' (#75) from payments into master

Reviewed-on: #75

LiteCharms.Features/Api/Configuration/AuthentikSettings.cs

@@ -6,9 +6,9 @@ public sealed class AuthentikSettings
 
     public string? IntrospectionUrl { get; set; }
 
-    public string? ApiResourceName { get; set; }
+    public string? ClientId { get; set; }
 
-    public string? ApiResourceSecret { get; set; }
+    public string? ClientSecret { get; set; }
 
     public string? RequiredClaimName { get; set; }
 

LiteCharms.Features/Extensions/Api.cs

@@ -9,7 +9,54 @@ public static class Api
     public const string Books = nameof(Books);
     public const string Payments = nameof(Payments);
 
-    public static IServiceCollection AddAuthentic(this IServiceCollection services, IConfiguration configuration)
+    public static IServiceCollection AddAuthentikUiSecurity(this IServiceCollection services, IConfiguration configuration)
+    {
+        var configSection = configuration.GetSection(nameof(AuthentikSettings));
+
+        var authOptions = new AuthentikSettings();
+        configSection.Bind(authOptions);
+
+        services.Configure<AuthentikSettings>(configSection);
+
+        services.AddAuthentication(options =>
+        {
+            options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
+        })
+        .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
+        .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
+        {
+            options.Authority = authOptions.Authority;
+
+            options.ClientId = authOptions.ClientId;
+            options.ClientSecret = authOptions.ClientSecret;
+            options.SignedOutCallbackPath = "/signout-callback-oidc";
+            options.SignedOutRedirectUri = "/";
+
+            options.ResponseType = "code";
+            options.SaveTokens = true;
+            options.GetClaimsFromUserInfoEndpoint = true;
+
+            options.Scope.Clear();
+            options.Scope.Add("openid");
+            options.Scope.Add("profile");
+            options.Scope.Add("email");
+
+            options.Events = new OpenIdConnectEvents
+            {
+                OnRedirectToIdentityProviderForSignOut = context =>
+                {
+                    context.ProtocolMessage.PostLogoutRedirectUri = context.Properties.RedirectUri;
+
+                    return Task.CompletedTask;
+                },
+            };
+        });
+
+        return services;
+    }
+
+    public static IServiceCollection AddAuthentikApiSecurity(this IServiceCollection services, IConfiguration configuration)
     {
         var configSection = configuration.GetSection(nameof(AuthentikSettings));
 
@@ -23,16 +70,23 @@ public static class Api
             {
                 options.Authority = authOptions.Authority;
                 options.IntrospectionEndpoint = authOptions.IntrospectionUrl;
-                options.ClientId = authOptions.ApiResourceName;
-                options.ClientSecret = authOptions.ApiResourceSecret;
+                options.ClientId = authOptions.ClientId;
+                options.ClientSecret = authOptions.ClientSecret;
 
                 options.NameClaimType = "sub";
                 options.DiscoveryPolicy.RequireHttps = authOptions.RequireHttpsMetadata;
                 options.DiscoveryPolicy.ValidateEndpoints = false;
-                options.EnableCaching = false;                
+                options.EnableCaching = false;
             });
 
-        services.AddAuthorization();
+        if (!string.IsNullOrWhiteSpace(authOptions.RequiredClaimName) && !string.IsNullOrWhiteSpace(authOptions.RequiredClaimNameValue))
+        {
+            services.AddAuthorizationBuilder()
+                .AddPolicy("RequiredScope", policy =>
+                    policy.RequireClaim(authOptions.RequiredClaimName, authOptions.RequiredClaimNameValue));
+        }
+        else
+            services.AddAuthorization();
 
         return services;
     }
@@ -124,5 +178,4 @@ public static class Api
 
     public static string ToEndpointName(this Type target, string? annotation = "") =>
         $"{target.Name.Replace("Endpoint", string.Empty)}{annotation}".ToLower(CultureInfo.CurrentCulture);
-
 }

LiteCharms.Features/LiteCharms.Features.csproj

@@ -38,6 +38,8 @@
     <PackageReference Include="Microsoft.AspNetCore.Authentication.Certificate" Version="10.0.8" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
 
+    <Using Include="Microsoft.AspNetCore.Authentication.OpenIdConnect"/>
+    <Using Include="Microsoft.AspNetCore.Authentication.Cookies"/>
     <Using Include="IdentityModel.AspNetCore.OAuth2Introspection"/>
   </ItemGroup>