Sotsera.Blazor.Oidc 1.0.0-alpha-1

.NET Standard 2.0
This is a prerelease version of Sotsera.Blazor.Oidc.
There is a newer prerelease version of this package available.
See the version list below for details.
Install-Package Sotsera.Blazor.Oidc -Version 1.0.0-alpha-1
dotnet add package Sotsera.Blazor.Oidc --version 1.0.0-alpha-1
<PackageReference Include="Sotsera.Blazor.Oidc" Version="1.0.0-alpha-1" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add Sotsera.Blazor.Oidc --version 1.0.0-alpha-1
The NuGet Team does not provide support for this client. Please contact its maintainers for support.
#r "nuget: Sotsera.Blazor.Oidc, 1.0.0-alpha-1"
#r directive can be used in F# Interactive, C# scripting and .NET Interactive. Copy this into the interactive tool or source code of the script to reference the package.
// Install Sotsera.Blazor.Oidc as a Cake Addin
#addin nuget:?package=Sotsera.Blazor.Oidc&version=1.0.0-alpha-1&prerelease

// Install Sotsera.Blazor.Oidc as a Cake Tool
#tool nuget:?package=Sotsera.Blazor.Oidc&version=1.0.0-alpha-1&prerelease
The NuGet Team does not provide support for this client. Please contact its maintainers for support.

Sotsera.Blazor.Oidc

OpenID Connect client for Blazor client-side or hosted projects.

Server side projects, and probably hosted projects too, having a server side environment should relay on cookies which are currently considered more secure: Using OAuth and OIDC with Blazor.

This is just a learning exercise built with three constraints:

  • Minimal amount of javascript possible
  • Use the Blazor shipped Json framework
  • Integrate with Blazor authentication and authorization framework

These constraints basically mean that everything must be written from scratch (JWT validation included).

A demo project has been published here.

Installation

Add a reference to the library from NuGet Pre Release

Dependency injection configuration

The library with its configuration settings must be added to the Startup.cs class.

The minimal configuration for connecting through a popup window to an Authorization server using the default callback URIs requires:

  • The issuer (Authorization server) URI
  • The applcation base URI used to construct the default html callback URIs
  • The client ID
  • The response Type for implicit flow or code+pkce
  • The scopes for the access token

As an example, the configuration for the code+pkce flow to the Identity server demo instance is:

public void ConfigureServices(IServiceCollection services)
{
    var issuerUri = new Uri("https://demo.identityserver.io");
    var baseUri = new Uri(WebAssemblyUriHelper.Instance.GetBaseUri());

    services.AddOidc(new OidcSettings(issuerUri, baseUri)
    {
        ClientId = "spa",
        ResponseType = "code",
        Scope = "openid profile email api"
    });
}

Javascript inclusion

Add the following reference to the oidc javascript in the index.html file paying attention to match the library version:

<script src="_content/Sotsera.Blazor.Oidc/sotsera.blazor.oidc-1.0.0-alpha-1.js"></script>

Blazor Authorization

Surround the default router in the App.razor component with a CascadingAuthenticationState component:

<CascadingAuthenticationState>
    <Router AppAssembly="typeof(Program).Assembly">
        <NotFoundContent>
            <p>Sorry, there's nothing at this address.</p>
        </NotFoundContent>
        <NotAuthorizedContent>
            <h1>Sorry</h1>
            <p>You're not authorized to reach this page.</p>
            <p>You may need to log in as a different user.</p>
        </NotAuthorizedContent>
        <AuthorizingContent>
            <h1>Authentication in progress</h1>
            <p>Only visible while authentication is in progress.</p>
        </AuthorizingContent>
    </Router>
</CascadingAuthenticationState>

The example above specifies also the content that will be injected by the router in the @body part of a page that requires athorization through the @attribute [Authorize] when there is a pending authentication or the user is not authorized.

Authorization server callbacks

The interaction with the authorization server can be made through a popup window or performing a redirect.

The library already contains the default html pages used by the popup window callbacks and the callback page components for the redirect interaction type and their default URIs are automatically configured specifying the baseUri in the dependency injection.

For preview8 the router can't load page components from a razor class library so the folling components must be added to the application in order to use the redirect interaction type:

@page "/oidc/callbacks/authentication-redirect"
@using Sotsera.Blazor.Oidc.CallbackPages

<AuthenticationRedirect />
@page "/oidc/callbacks/logout-redirect"
@using Sotsera.Blazor.Oidc.CallbackPages

<LogoutRedirect />

Usage

The IUserManager interface provides the access the the OidcUser class and its profile claims and exposes the methods BeginAuthenticationAsync and BeginLogoutAsync for initiating a flow to the server using the interaction type specified during the initial configuration. Both methods configuration parameters can be overridden during the call.

This is an example Login/Logout component:

@inject Sotsera.Blazor.Oidc.IUserManager UserManager
<AuthorizeView>
    <Authorized>
        <span class="mr-3">
            Hello, @context.User.Identity.Name!
        </span>
        <button type="button" class="btn btn-primary mr-1" @onclick="LogoutPopup">
            Log out (popup)
        </button>
        <button type="button" class="btn btn-primary" @onclick="LogoutRedirect">
            Log out (redirect)
        </button>
    </Authorized>
    <NotAuthorized>
        <button type="button" class="btn btn-primary mr-1" @onclick="LoginPopup">
            Log in (popup)
        </button>
        <button type="button" class="btn btn-primary" @onclick="LoginRedirect">
            Log in (redirect)
        </button>
    </NotAuthorized>
</AuthorizeView>

@code
{
    public async void LoginPopup() => await UserManager.BeginAuthenticationAsync();
    public async void LoginRedirect() => await UserManager.BeginAuthenticationAsync(p => p.WithRedirect());
    
    public async void LogoutPopup() => await UserManager.BeginLogoutAsync();
    public async void LogoutRedirect() => await UserManager.BeginLogoutAsync(p => p.WithRedirect());
}

Consuming an api

Inject in a component an instance of OidcHttpClient that has a Bearer authorization header already configured and use it for connecting to the APIs requiring the access token.

Configuration

The list of the configuration options will be documented here soon.

Credits

This library is based on oidc-client-js by Brock Allen & Dominick Baier licensed under the Apache License, Version 2.0.

License

Sotsera.Blazor.Oidc is licensed under Apache License, Version 2.0.

Product Versions
.NET net5.0 net5.0-windows net6.0 net6.0-android net6.0-ios net6.0-maccatalyst net6.0-macos net6.0-tvos net6.0-windows
.NET Core netcoreapp2.0 netcoreapp2.1 netcoreapp2.2 netcoreapp3.0 netcoreapp3.1
.NET Standard netstandard2.0 netstandard2.1
.NET Framework net461 net462 net463 net47 net471 net472 net48
MonoAndroid monoandroid
MonoMac monomac
MonoTouch monotouch
Tizen tizen40 tizen60
Xamarin.iOS xamarinios
Xamarin.Mac xamarinmac
Xamarin.TVOS xamarintvos
Xamarin.WatchOS xamarinwatchos
Compatible target framework(s)
Additional computed target framework(s)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last updated
1.0.0-alpha-8 2,893 2/27/2020
1.0.0-alpha-7 229 2/20/2020
1.0.0-alpha-6 474 1/8/2020
1.0.0-alpha-5 224 12/29/2019
1.0.0-alpha-4 205 12/5/2019
1.0.0-alpha-3 246 9/5/2019
1.0.0-alpha-2 227 8/28/2019
1.0.0-alpha-1 218 8/25/2019