diff --git a/docs/en/Modules/OpenIddict.md b/docs/en/Modules/OpenIddict.md index 7d7e898eee..ed25147be2 100644 --- a/docs/en/Modules/OpenIddict.md +++ b/docs/en/Modules/OpenIddict.md @@ -150,42 +150,22 @@ https://documentation.openiddict.com https://github.com/openiddict/openiddict-core#resources -### Token encryption +### Disable AccessToken Encryption -https://documentation.openiddict.com/configuration/encryption-and-signing-credentials.html - -> By default, OpenIddict enforces encryption for all the token types it supports. While this enforcement cannot be disabled for authorization codes, refresh tokens and device codes for security reasons, it can be relaxed for access tokens when integration with third-party APIs/resource servers is desired. Access token encryption can also be disabled if the resource servers receiving the access tokens don't fully support JSON Web Encryption. +ABP disables the `access token encryption` by default for compatibility, you can manually enable it if needed. ```cs -PreConfigure(builder => +public override void PreConfigureServices(ServiceConfigurationContext context) { - builder.DisableAccessTokenEncryption(); -}); -``` - -An example of using `SecurityKey` - -> In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - -```cs -// In OpenIddict Server -PreConfigure(builder => -{ - builder.AddSigningKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78"))); - builder.AddEncryptionKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80"))); -}); - -//In Client AddJwtBearer -builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) - .AddJwtBearer(options => + PreConfigure(builder => { - //Other configuration - - options.TokenValidationParameters.IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78")); - options.TokenValidationParameters.TokenDecryptionKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80")); + builder.Configure(options => options.DisableAccessTokenEncryption = false); }); +} ``` +https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption + ### PKCE diff --git a/modules/openiddict/app/OpenIddict.Demo.API/Program.cs b/modules/openiddict/app/OpenIddict.Demo.API/Program.cs index 6218c5b9f7..9fe034cecf 100644 --- a/modules/openiddict/app/OpenIddict.Demo.API/Program.cs +++ b/modules/openiddict/app/OpenIddict.Demo.API/Program.cs @@ -18,10 +18,6 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) { options.Authority = "https://localhost:44301"; options.Audience = "AbpAPIResource"; - - // See OpenIddictServerModule`s PreConfigureServices method. - options.TokenValidationParameters.IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78")); - options.TokenValidationParameters.TokenDecryptionKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80")); }); var app = builder.Build(); diff --git a/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml b/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml index 1d2feb2a8d..d2f8710862 100644 --- a/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml +++ b/modules/openiddict/app/OpenIddict.Demo.Client.Mvc/Pages/Index.cshtml @@ -30,14 +30,37 @@ request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", await HttpContext.GetTokenAsync("access_token")); var response = await client.SendAsync(request); - response.EnsureSuccessStatusCode(); + + + + @{ + var apiResponse = response.StatusCode.ToString(); + if (response.IsSuccessStatusCode) + { + apiResponse = JsonSerializer.Serialize(JsonDocument.Parse(await response.Content.ReadAsStringAsync()), new JsonSerializerOptions + { + WriteIndented = true + }); + } + } + @apiResponse; + + + request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:44301/api/claims"); + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", await HttpContext.GetTokenAsync("access_token")); + + response = await client.SendAsync(request); @{ - var apiResponse = JsonSerializer.Serialize(JsonDocument.Parse(await response.Content.ReadAsStringAsync()), new JsonSerializerOptions + apiResponse = response.StatusCode.ToString(); + if (response.IsSuccessStatusCode) { - WriteIndented = true - }); + apiResponse = JsonSerializer.Serialize(JsonDocument.Parse(await response.Content.ReadAsStringAsync()), new JsonSerializerOptions + { + WriteIndented = true + }); + } } @apiResponse; diff --git a/modules/openiddict/app/OpenIddict.Demo.Server/Controllers/ClaimsController.cs b/modules/openiddict/app/OpenIddict.Demo.Server/Controllers/ClaimsController.cs new file mode 100644 index 0000000000..49597709b9 --- /dev/null +++ b/modules/openiddict/app/OpenIddict.Demo.Server/Controllers/ClaimsController.cs @@ -0,0 +1,16 @@ +using Microsoft.AspNetCore.Authorization; +using Microsoft.AspNetCore.Mvc; + +namespace OpenIddict.Demo.Server.Controllers; + +[ApiController] +[Authorize] +[Route("api/claims")] +public class ClaimsController : Controller +{ + [HttpGet] + public JsonResult Get() + { + return Json(User.Claims.Select(x => new {Type = x.Type, Value = x.Value})); + } +} diff --git a/modules/openiddict/app/OpenIddict.Demo.Server/OpenIddictServerModule.cs b/modules/openiddict/app/OpenIddict.Demo.Server/OpenIddictServerModule.cs index 616b3ef0c7..a2509f8576 100644 --- a/modules/openiddict/app/OpenIddict.Demo.Server/OpenIddictServerModule.cs +++ b/modules/openiddict/app/OpenIddict.Demo.Server/OpenIddictServerModule.cs @@ -1,10 +1,7 @@ -using System.Text; +using System.Security.Cryptography; +using System.Security.Cryptography.X509Certificates; using Microsoft.EntityFrameworkCore; -using Microsoft.IdentityModel.Tokens; -using OpenIddict.Abstractions; using OpenIddict.Demo.Server.EntityFrameworkCore; -using OpenIddict.Server.AspNetCore; -using OpenIddict.Validation.AspNetCore; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; @@ -81,12 +78,32 @@ public class OpenIddictServerModule : AbpModule { public override void PreConfigureServices(ServiceConfigurationContext context) { + PreConfigure(options => + { + //https://documentation.openiddict.com/configuration/encryption-and-signing-credentials.html + options.AddDevelopmentEncryptionAndSigningCertificate = false; + }); + PreConfigure(builder => { - //https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption //https://documentation.openiddict.com/configuration/encryption-and-signing-credentials.html - builder.AddSigningKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78"))); - builder.AddEncryptionKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80"))); + using (var algorithm = RSA.Create(keySizeInBits: 2048)) + { + var subject = new X500DistinguishedName("CN=Fabrikam Encryption Certificate"); + var request = new CertificateRequest(subject, algorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1); + request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, critical: true)); + var certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(2)); + builder.AddSigningCertificate(certificate); + } + + using (var algorithm = RSA.Create(keySizeInBits: 2048)) + { + var subject = new X500DistinguishedName("CN=Fabrikam Signing Certificate"); + var request = new CertificateRequest(subject, algorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1); + request.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.KeyEncipherment, critical: true)); + var certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(2)); + builder.AddEncryptionCertificate(certificate); + } }); PreConfigure(options => @@ -110,18 +127,6 @@ public class OpenIddictServerModule : AbpModule public override void ConfigureServices(ServiceConfigurationContext context) { - context.Services.ConfigureApplicationCookie(options => - { - options.ForwardDefaultSelector = ctx => ctx.Request.Path.StartsWithSegments("/api") - ? OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme - : null; - }); - - Configure(options => - { - options.AddDevelopmentEncryptionAndSigningCertificate = false; - }); - context.Services.AddAbpDbContext(options => { options.AddDefaultRepositories(includeAllEntities: true); diff --git a/modules/openiddict/app/OpenIddict.Demo.Server/Program.cs b/modules/openiddict/app/OpenIddict.Demo.Server/Program.cs index 3bfc26a9a3..bee5baa950 100644 --- a/modules/openiddict/app/OpenIddict.Demo.Server/Program.cs +++ b/modules/openiddict/app/OpenIddict.Demo.Server/Program.cs @@ -27,20 +27,6 @@ builder.Services.Configure(options => options.Languages.Add(new LanguageInfo("zh-Hant", "zh-Hant", "繁體中文")); }); -// Use Microsoft.AspNetCore.Authentication.JwtBearer instead of OpenIddict.Validation.AspNetCore -// builder.Services.AddAuthentication() -// .AddJwtBearer(options => -// { -// options.Authority = "https://localhost:44301"; -// options.Audience = "AbpAPIResource"; -// -// options.MapInboundClaims = false; -// -// // See OpenIddictServerModule`s PreConfigureServices method. -// options.TokenValidationParameters.IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78")); -// options.TokenValidationParameters.TokenDecryptionKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80")); -// }); - await builder.AddApplicationAsync(); var app = builder.Build(); @@ -70,6 +56,7 @@ app.UseCors(); //app.UseJwtTokenMiddleware(); app.UseAuthentication(); +app.UseAbpOpenIddictValidation(); app.UseMultiTenancy(); app.UseAuthorization(); diff --git a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Jwt/JwtTokenMiddleware.cs b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Microsoft/AspNetCore/Builder/ApplicationBuilderAbpOpenIddictMiddlewareExtension.cs similarity index 58% rename from modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Jwt/JwtTokenMiddleware.cs rename to modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Microsoft/AspNetCore/Builder/ApplicationBuilderAbpOpenIddictMiddlewareExtension.cs index f0f2efb33e..7d8be5570b 100644 --- a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Jwt/JwtTokenMiddleware.cs +++ b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Microsoft/AspNetCore/Builder/ApplicationBuilderAbpOpenIddictMiddlewareExtension.cs @@ -1,13 +1,11 @@ using Microsoft.AspNetCore.Authentication; -using Microsoft.AspNetCore.Builder; +using OpenIddict.Validation.AspNetCore; -namespace Volo.Abp.OpenIddict.Jwt; +namespace Microsoft.AspNetCore.Builder; -//TODO: Should we move this to another package..? - -public static class JwtTokenMiddleware +public static class ApplicationBuilderAbpOpenIddictMiddlewareExtension { - public static IApplicationBuilder UseJwtTokenMiddleware(this IApplicationBuilder app, string schema = "Bearer") + public static IApplicationBuilder UseAbpOpenIddictValidation(this IApplicationBuilder app, string schema = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme) { return app.Use(async (ctx, next) => { diff --git a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictAspNetCoreModule.cs b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictAspNetCoreModule.cs index 8e103f92fa..e8196627ce 100644 --- a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictAspNetCoreModule.cs +++ b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictAspNetCoreModule.cs @@ -104,6 +104,8 @@ public class AbpOpenIddictAspNetCoreModule : AbpModule .AddDevelopmentSigningCertificate(); } + builder.DisableAccessTokenEncryption(); + var wildcardDomainsOptions = services.ExecutePreConfiguredActions(); if (wildcardDomainsOptions.EnableWildcardDomainSupport) { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyCompanyName.MyProjectName.Blazor.Server.Mongo.csproj b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyCompanyName.MyProjectName.Blazor.Server.Mongo.csproj index dc5971eb3c..0a7e7306cd 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyCompanyName.MyProjectName.Blazor.Server.Mongo.csproj +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyCompanyName.MyProjectName.Blazor.Server.Mongo.csproj @@ -18,7 +18,6 @@ - diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyProjectNameModule.cs b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyProjectNameModule.cs index c987e5dff6..952bdc1818 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyProjectNameModule.cs +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/MyProjectNameModule.cs @@ -7,7 +7,6 @@ using MyCompanyName.MyProjectName.Menus; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Components.Server.BasicTheme; using Volo.Abp.AspNetCore.Components.Server.BasicTheme.Bundling; using Volo.Abp.AspNetCore.Components.Web.Theming.Routing; @@ -20,7 +19,6 @@ using Volo.Abp.AspNetCore.Serilog; using Volo.Abp.AuditLogging.MongoDB; using Volo.Abp.Autofac; using Volo.Abp.AutoMapper; -using Volo.Abp.MongoDB; using Volo.Abp.FeatureManagement; using Volo.Abp.FeatureManagement.Blazor.Server; using Volo.Abp.FeatureManagement.MongoDB; @@ -57,7 +55,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpAutofacModule), typeof(AbpAutoMapperModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), typeof(AbpAspNetCoreComponentsServerBasicThemeModule), @@ -117,13 +114,6 @@ public class MyProjectNameModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -150,7 +140,6 @@ public class MyProjectNameModule : AbpModule ConfigureAutoApiControllers(); ConfigureBlazorise(context); ConfigureRouter(context); - ConfigureAuthentication(context, configuration); ConfigureMongoDB(context); } @@ -189,17 +178,6 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureAuthentication(ServiceConfigurationContext context, IConfiguration configuration) - { - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureLocalizationServices() { Configure(options => @@ -338,7 +316,7 @@ public class MyProjectNameModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (IsMultiTenant) { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/appsettings.json b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/appsettings.json index e08d35f224..7872199c7e 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/appsettings.json +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server.Mongo/appsettings.json @@ -6,10 +6,6 @@ "ConnectionStrings": { "Default": "mongodb://localhost:27017/MyProjectName", }, - "AuthServer": { - "Authority": "https://localhost:44300", - "RequireHttpsMetadata": "false" - }, "StringEncryption": { "DefaultPassPhrase": "gsKnGZ041HLL4IM8" } diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj index 9c350d2ad2..ee53dbd329 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj @@ -18,7 +18,6 @@ - diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameModule.cs b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameModule.cs index b9c8dca8f0..bb820f293c 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameModule.cs +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameModule.cs @@ -7,7 +7,6 @@ using MyCompanyName.MyProjectName.Menus; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Components.Server.BasicTheme; using Volo.Abp.AspNetCore.Components.Server.BasicTheme.Bundling; using Volo.Abp.AspNetCore.Components.Web.Theming.Routing; @@ -58,7 +57,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpAutoMapperModule), typeof(AbpEntityFrameworkCoreSqlServerModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), typeof(AbpAspNetCoreComponentsServerBasicThemeModule), @@ -118,13 +116,6 @@ public class MyProjectNameModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -151,7 +142,6 @@ public class MyProjectNameModule : AbpModule ConfigureAutoApiControllers(); ConfigureBlazorise(context); ConfigureRouter(context); - ConfigureAuthentication(context, configuration); ConfigureEfCore(context); } @@ -190,17 +180,6 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureAuthentication(ServiceConfigurationContext context, IConfiguration configuration) - { - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureLocalizationServices() { Configure(options => @@ -346,7 +325,7 @@ public class MyProjectNameModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (IsMultiTenant) { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/appsettings.json b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/appsettings.json index cc9e8226f2..250ecde40e 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/appsettings.json +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Blazor.Server/appsettings.json @@ -6,10 +6,6 @@ "ConnectionStrings": { "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName;Trusted_Connection=True" }, - "AuthServer": { - "Authority": "https://localhost:44300", - "RequireHttpsMetadata": "false" - }, "StringEncryption": { "DefaultPassPhrase": "gsKnGZ041HLL4IM8" } diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyCompanyName.MyProjectName.Host.Mongo.csproj b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyCompanyName.MyProjectName.Host.Mongo.csproj index 6262e3f303..5fe0542a78 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyCompanyName.MyProjectName.Host.Mongo.csproj +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyCompanyName.MyProjectName.Host.Mongo.csproj @@ -17,7 +17,6 @@ - diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyProjectNameModule.cs b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyProjectNameModule.cs index 6a9474af7b..3add01a618 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyProjectNameModule.cs +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/MyProjectNameModule.cs @@ -7,7 +7,6 @@ using StackExchange.Redis; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.MultiTenancy; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.Localization; @@ -55,7 +54,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpCachingStackExchangeRedisModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), // Account module packages @@ -108,13 +106,6 @@ public class MyProjectNameModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -135,11 +126,10 @@ public class MyProjectNameModule : AbpModule ConfigureMultiTenancy(); ConfigureUrls(configuration); ConfigureAutoMapper(context); - ConfigureSwagger(context.Services); + ConfigureSwagger(context.Services, configuration); ConfigureAutoApiControllers(); ConfigureVirtualFiles(hostingEnvironment); ConfigureLocalization(); - ConfigureAuthentication(context.Services, configuration); ConfigureCors(context, configuration); ConfigureDataProtection(context, configuration, hostingEnvironment); ConfigureMongoDB(context); @@ -176,17 +166,6 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureAuthentication(IServiceCollection services, IConfiguration configuration) - { - services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureLocalization() { Configure(options => @@ -246,16 +225,20 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureSwagger(IServiceCollection services) + private void ConfigureSwagger(IServiceCollection services, IConfiguration configuration) { - services.AddAbpSwaggerGen( + services.AddAbpSwaggerGenWithOAuth( + configuration["AuthServer:Authority"], + new Dictionary + { + {"MyProjectName", "MyProjectName API"} + }, options => { options.SwaggerDoc("v1", new OpenApiInfo { Title = "MyProjectName API", Version = "v1" }); options.DocInclusionPredicate((docName, description) => true); options.CustomSchemaIds(type => type.FullName); - } - ); + }); } private void ConfigureAutoMapper(ServiceConfigurationContext context) @@ -341,7 +324,7 @@ public class MyProjectNameModule : AbpModule app.UseRouting(); app.UseCors(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (IsMultiTenant) { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/appsettings.json b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/appsettings.json index a63bc0eeb8..b4db7dbf0a 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/appsettings.json +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host.Mongo/appsettings.json @@ -11,14 +11,14 @@ "Redis": { "Configuration": "127.0.0.1" }, + "StringEncryption": { + "DefaultPassPhrase": "gsKnGZ041HLL4IM8" + }, "AuthServer": { "Authority": "https://localhost:44300", - "RequireHttpsMetadata": "false", + "RequireHttpsMetadata": "true", "SwaggerClientId": "MyProjectName_Swagger" }, - "StringEncryption": { - "DefaultPassPhrase": "gsKnGZ041HLL4IM8" - }, "OpenIddict": { "Applications": { "MyProjectName_App": { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyCompanyName.MyProjectName.Host.csproj b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyCompanyName.MyProjectName.Host.csproj index 1d92ee3dcd..16b58578c9 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyCompanyName.MyProjectName.Host.csproj +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyCompanyName.MyProjectName.Host.csproj @@ -17,7 +17,6 @@ - diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyProjectNameModule.cs b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyProjectNameModule.cs index bc3a0eea8e..6884b712c6 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyProjectNameModule.cs +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/MyProjectNameModule.cs @@ -7,7 +7,6 @@ using StackExchange.Redis; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.MultiTenancy; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.Localization; @@ -57,7 +56,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpEntityFrameworkCoreSqlServerModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), // Account module packages @@ -110,13 +108,6 @@ public class MyProjectNameModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -137,11 +128,10 @@ public class MyProjectNameModule : AbpModule ConfigureMultiTenancy(); ConfigureUrls(configuration); ConfigureAutoMapper(context); - ConfigureSwagger(context.Services); + ConfigureSwagger(context.Services, configuration); ConfigureAutoApiControllers(); ConfigureVirtualFiles(hostingEnvironment); ConfigureLocalization(); - ConfigureAuthentication(context.Services, configuration); ConfigureCors(context, configuration); ConfigureDataProtection(context, configuration, hostingEnvironment); ConfigureEfCore(context); @@ -178,17 +168,6 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureAuthentication(IServiceCollection services, IConfiguration configuration) - { - services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureLocalization() { Configure(options => @@ -248,16 +227,20 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureSwagger(IServiceCollection services) + private void ConfigureSwagger(IServiceCollection services, IConfiguration configuration) { - services.AddAbpSwaggerGen( + services.AddAbpSwaggerGenWithOAuth( + configuration["AuthServer:Authority"], + new Dictionary + { + {"MyProjectName", "MyProjectName API"} + }, options => { options.SwaggerDoc("v1", new OpenApiInfo { Title = "MyProjectName API", Version = "v1" }); options.DocInclusionPredicate((docName, description) => true); options.CustomSchemaIds(type => type.FullName); - } - ); + }); } private void ConfigureAutoMapper(ServiceConfigurationContext context) @@ -350,7 +333,7 @@ public class MyProjectNameModule : AbpModule app.UseRouting(); app.UseCors(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (IsMultiTenant) { @@ -364,6 +347,10 @@ public class MyProjectNameModule : AbpModule app.UseAbpSwaggerUI(options => { options.SwaggerEndpoint("/swagger/v1/swagger.json", "MyProjectName API"); + + var configuration = context.GetConfiguration(); + options.OAuthClientId(configuration["AuthServer:SwaggerClientId"]); + options.OAuthScopes("MyProjectName"); }); app.UseAuditing(); diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/appsettings.json b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/appsettings.json index 6c9d002cc6..c35a5736a1 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/appsettings.json +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Host/appsettings.json @@ -11,14 +11,14 @@ "Redis": { "Configuration": "127.0.0.1" }, + "StringEncryption": { + "DefaultPassPhrase": "gsKnGZ041HLL4IM8" + }, "AuthServer": { "Authority": "https://localhost:44300", - "RequireHttpsMetadata": "false", + "RequireHttpsMetadata": "true", "SwaggerClientId": "MyProjectName_Swagger" }, - "StringEncryption": { - "DefaultPassPhrase": "gsKnGZ041HLL4IM8" - }, "OpenIddict": { "Applications": { "MyProjectName_App": { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyCompanyName.MyProjectName.Mvc.Mongo.csproj b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyCompanyName.MyProjectName.Mvc.Mongo.csproj index 1c770c1fe4..acc37e1b83 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyCompanyName.MyProjectName.Mvc.Mongo.csproj +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyCompanyName.MyProjectName.Mvc.Mongo.csproj @@ -16,7 +16,6 @@ - diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyProjectNameModule.cs b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyProjectNameModule.cs index 7a0d97014a..d293761f02 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyProjectNameModule.cs +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/MyProjectNameModule.cs @@ -5,7 +5,6 @@ using MyCompanyName.MyProjectName.Menus; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.Localization; using Volo.Abp.AspNetCore.Mvc.UI.Bundling; @@ -52,7 +51,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpAutofacModule), typeof(AbpAutoMapperModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), @@ -110,13 +108,6 @@ public class MyProjectNameModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -142,7 +133,6 @@ public class MyProjectNameModule : AbpModule ConfigureAutoApiControllers(); ConfigureVirtualFiles(hostingEnvironment); ConfigureLocalization(); - ConfigureAuthentication(context.Services, configuration); ConfigureMongoDB(context); } @@ -176,17 +166,6 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureAuthentication(IServiceCollection services, IConfiguration configuration) - { - services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureLocalization() { Configure(options => @@ -314,7 +293,7 @@ public class MyProjectNameModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (IsMultiTenant) { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/appsettings.json b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/appsettings.json index 97ad461966..f64cfd6c90 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/appsettings.json +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc.Mongo/appsettings.json @@ -5,10 +5,6 @@ "ConnectionStrings": { "Default": "mongodb://localhost:27017/MyProjectName" }, - "AuthServer": { - "Authority": "https://localhost:44300", - "RequireHttpsMetadata": "false" - }, "StringEncryption": { "DefaultPassPhrase": "gsKnGZ041HLL4IM8" } diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyCompanyName.MyProjectName.Mvc.csproj b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyCompanyName.MyProjectName.Mvc.csproj index f73e132e84..1d584562a0 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyCompanyName.MyProjectName.Mvc.csproj +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyCompanyName.MyProjectName.Mvc.csproj @@ -16,7 +16,6 @@ - diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyProjectNameModule.cs b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyProjectNameModule.cs index 7f7a7a4da9..e4c878921e 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyProjectNameModule.cs +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/MyProjectNameModule.cs @@ -5,7 +5,6 @@ using MyCompanyName.MyProjectName.Menus; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.Localization; using Volo.Abp.AspNetCore.Mvc.UI.Bundling; @@ -54,7 +53,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpAutoMapperModule), typeof(AbpEntityFrameworkCoreSqlServerModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), @@ -112,13 +110,6 @@ public class MyProjectNameModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -144,7 +135,6 @@ public class MyProjectNameModule : AbpModule ConfigureAutoApiControllers(); ConfigureVirtualFiles(hostingEnvironment); ConfigureLocalization(); - ConfigureAuthentication(context.Services, configuration); ConfigureEfCore(context); } @@ -179,17 +169,6 @@ public class MyProjectNameModule : AbpModule }); } - private void ConfigureAuthentication(IServiceCollection services, IConfiguration configuration) - { - services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureLocalization() { Configure(options => @@ -323,7 +302,7 @@ public class MyProjectNameModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (IsMultiTenant) { diff --git a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/appsettings.json b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/appsettings.json index 74bc952883..4d95841d08 100644 --- a/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/appsettings.json +++ b/templates/app-nolayers/aspnet-core/MyCompanyName.MyProjectName.Mvc/appsettings.json @@ -5,10 +5,6 @@ "ConnectionStrings": { "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName;Trusted_Connection=True" }, - "AuthServer": { - "Authority": "https://localhost:44300", - "RequireHttpsMetadata": "false" - }, "StringEncryption": { "DefaultPassPhrase": "gsKnGZ041HLL4IM8" } diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs index 05ea1c90ea..225033259f 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs @@ -48,13 +48,6 @@ public class MyProjectNameAuthServerModule : AbpModule { public override void PreConfigureServices(ServiceConfigurationContext context) { - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj index e1295a33c7..299bec9d66 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyCompanyName.MyProjectName.Blazor.Server.csproj @@ -26,7 +26,6 @@ - diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameBlazorModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameBlazorModule.cs index a01ea41953..4c4ad943ad 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameBlazorModule.cs +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Blazor.Server/MyProjectNameBlazorModule.cs @@ -1,4 +1,3 @@ -using System; using System.IO; using Blazorise.Bootstrap5; using Blazorise.Icons.FontAwesome; @@ -14,7 +13,6 @@ using MyCompanyName.MyProjectName.Localization; using MyCompanyName.MyProjectName.MultiTenancy; using Volo.Abp; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Components.Server.BasicTheme; using Volo.Abp.AspNetCore.Components.Server.BasicTheme.Bundling; using Volo.Abp.AspNetCore.Components.Web.Theming.Routing; @@ -50,7 +48,6 @@ namespace MyCompanyName.MyProjectName.Blazor.Server; typeof(AbpAspNetCoreMvcUiBasicThemeModule), typeof(AbpAutofacModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpAccountWebOpenIddictModule), typeof(AbpAspNetCoreComponentsServerBasicThemeModule), @@ -74,13 +71,6 @@ public class MyProjectNameBlazorModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -99,7 +89,6 @@ public class MyProjectNameBlazorModule : AbpModule ConfigureUrls(configuration); ConfigureBundles(); - ConfigureAuthentication(context, configuration); ConfigureAutoMapper(); ConfigureVirtualFileSystem(hostingEnvironment); ConfigureLocalizationServices(); @@ -145,17 +134,6 @@ public class MyProjectNameBlazorModule : AbpModule }); } - private void ConfigureAuthentication(ServiceConfigurationContext context, IConfiguration configuration) - { - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureVirtualFileSystem(IWebHostEnvironment hostingEnvironment) { if (hostingEnvironment.IsDevelopment()) @@ -283,7 +261,7 @@ public class MyProjectNameBlazorModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (MultiTenancyConsts.IsEnabled) { diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json index 4b7a8f4029..5131851809 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json @@ -12,7 +12,7 @@ "Authority": "https://localhost:44301", "RequireHttpsMetadata": "true", "SwaggerClientId": "MyProjectName_Swagger" -}, + }, "StringEncryption": { "DefaultPassPhrase": "gsKnGZ041HLL4IM8" } diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyCompanyName.MyProjectName.HttpApi.HostWithIds.csproj b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyCompanyName.MyProjectName.HttpApi.HostWithIds.csproj index 7dd3166a17..0049c0b35b 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyCompanyName.MyProjectName.HttpApi.HostWithIds.csproj +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyCompanyName.MyProjectName.HttpApi.HostWithIds.csproj @@ -15,7 +15,6 @@ - diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs index fc8211ee43..428290c240 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs @@ -2,14 +2,11 @@ using System; using System.Collections.Generic; using System.IO; using System.Linq; -using System.Net.Http; -using System.Text; using Microsoft.AspNetCore.Builder; using Microsoft.AspNetCore.Cors; using Microsoft.Extensions.Configuration; using Microsoft.Extensions.DependencyInjection; using Microsoft.Extensions.Hosting; -using Microsoft.IdentityModel.Tokens; using MyCompanyName.MyProjectName.EntityFrameworkCore; using MyCompanyName.MyProjectName.MultiTenancy; using Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic; @@ -17,7 +14,6 @@ using Microsoft.OpenApi.Models; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.MultiTenancy; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.UI.Bundling; @@ -27,7 +23,6 @@ using Volo.Abp.AspNetCore.Serilog; using Volo.Abp.Autofac; using Volo.Abp.Localization; using Volo.Abp.Modularity; -using Volo.Abp.OpenIddict; using Volo.Abp.Swashbuckle; using Volo.Abp.UI.Navigation.Urls; using Volo.Abp.VirtualFileSystem; @@ -41,7 +36,6 @@ namespace MyCompanyName.MyProjectName; typeof(MyProjectNameApplicationModule), typeof(MyProjectNameEntityFrameworkCoreModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAccountWebOpenIddictModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpSwashbuckleModule) @@ -50,13 +44,6 @@ public class MyProjectNameHttpApiHostModule : AbpModule { public override void PreConfigureServices(ServiceConfigurationContext context) { - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -76,7 +63,6 @@ public class MyProjectNameHttpApiHostModule : AbpModule ConfigureBundles(); ConfigureUrls(configuration); ConfigureConventionalControllers(); - ConfigureAuthentication(context, configuration); ConfigureLocalization(); ConfigureVirtualFileSystem(context); ConfigureCors(context, configuration); @@ -138,23 +124,6 @@ public class MyProjectNameHttpApiHostModule : AbpModule }); } - private void ConfigureAuthentication(ServiceConfigurationContext context, IConfiguration configuration) - { - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - options.BackchannelHttpHandler = new HttpClientHandler - { - ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator - }; - - options.MapInboundClaims = false; - }); - } - private static void ConfigureSwaggerServices(ServiceConfigurationContext context, IConfiguration configuration) { context.Services.AddAbpSwaggerGenWithOAuth( @@ -241,7 +210,7 @@ public class MyProjectNameHttpApiHostModule : AbpModule app.UseRouting(); app.UseCors(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (MultiTenancyConsts.IsEnabled) { diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyCompanyName.MyProjectName.Web.csproj b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyCompanyName.MyProjectName.Web.csproj index daecf98955..8bedd81ba4 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyCompanyName.MyProjectName.Web.csproj +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyCompanyName.MyProjectName.Web.csproj @@ -42,7 +42,6 @@ - diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs index 82e7a4b7bd..22e6446be7 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs @@ -12,7 +12,6 @@ using MyCompanyName.MyProjectName.Web.Menus; using Microsoft.OpenApi.Models; using Volo.Abp; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.Localization; using Volo.Abp.AspNetCore.Mvc.UI; @@ -49,7 +48,6 @@ namespace MyCompanyName.MyProjectName.Web; typeof(AbpSettingManagementWebModule), typeof(AbpAccountWebModule), typeof(AbpAspNetCoreMvcUiBasicThemeModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpTenantManagementWebModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpSwashbuckleModule) @@ -78,7 +76,6 @@ public class MyProjectNameWebModule : AbpModule ConfigureUrls(configuration); ConfigureBundles(); - ConfigureAuthentication(context, configuration); ConfigureAutoMapper(); ConfigureVirtualFileSystem(hostingEnvironment); ConfigureLocalizationServices(); @@ -109,17 +106,6 @@ public class MyProjectNameWebModule : AbpModule }); } - private void ConfigureAuthentication(ServiceConfigurationContext context, IConfiguration configuration) - { - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - } - private void ConfigureAutoMapper() { Configure(options => @@ -231,7 +217,6 @@ public class MyProjectNameWebModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); if (MultiTenancyConsts.IsEnabled) { diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json index cf1965742b..aa65a91573 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json @@ -5,10 +5,6 @@ "ConnectionStrings": { "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName;Trusted_Connection=True" }, - "AuthServer": { - "Authority": "https://localhost:44303", - "RequireHttpsMetadata": "false" - }, "StringEncryption": { "DefaultPassPhrase": "gsKnGZ041HLL4IM8" } diff --git a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyCompanyName.MyProjectName.AuthServer.csproj b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyCompanyName.MyProjectName.AuthServer.csproj index 237ce701f9..d1052473bb 100644 --- a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyCompanyName.MyProjectName.AuthServer.csproj +++ b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyCompanyName.MyProjectName.AuthServer.csproj @@ -17,7 +17,6 @@ all runtime; build; native; contentfiles; analyzers - diff --git a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs index 831eb154bd..520b4b98de 100644 --- a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs +++ b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/MyProjectNameAuthServerModule.cs @@ -13,7 +13,6 @@ using Microsoft.OpenApi.Models; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Mvc; using Volo.Abp.AspNetCore.Mvc.UI.MultiTenancy; using Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic; @@ -77,7 +76,6 @@ namespace MyCompanyName.MyProjectName; typeof(AbpTenantManagementEntityFrameworkCoreModule), typeof(AbpTenantManagementApplicationModule), typeof(AbpTenantManagementHttpApiModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(MyProjectNameApplicationContractsModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpSwashbuckleModule) @@ -86,13 +84,6 @@ public class MyProjectNameAuthServerModule : AbpModule { public override void PreConfigureServices(ServiceConfigurationContext context) { - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -156,14 +147,6 @@ public class MyProjectNameAuthServerModule : AbpModule options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"]; }); - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = configuration["AuthServer:ApiName"]; - }); - Configure(options => { options.KeyPrefix = "MyProjectName:"; @@ -226,7 +209,7 @@ public class MyProjectNameAuthServerModule : AbpModule app.UseRouting(); app.UseCors(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (MultiTenancyConsts.IsEnabled) { diff --git a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/appsettings.json b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/appsettings.json index 70b1fa6216..47304e7fc6 100644 --- a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/appsettings.json +++ b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/appsettings.json @@ -10,11 +10,6 @@ "Redis": { "Configuration": "127.0.0.1" }, - "AuthServer": { - "Authority": "https://localhost:44301/", - "RequireHttpsMetadata": "false", - "ApiName": "MyProjectName" - }, "OpenIddict": { "Applications": { "MyProjectName_Web": { diff --git a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyCompanyName.MyProjectName.Blazor.Server.Host.csproj b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyCompanyName.MyProjectName.Blazor.Server.Host.csproj index b7b66f12ca..fcfd56b48b 100644 --- a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyCompanyName.MyProjectName.Blazor.Server.Host.csproj +++ b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyCompanyName.MyProjectName.Blazor.Server.Host.csproj @@ -25,7 +25,6 @@ - diff --git a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyProjectNameBlazorHostModule.cs b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyProjectNameBlazorHostModule.cs index 7dce65bbdb..97e9dfcae0 100644 --- a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyProjectNameBlazorHostModule.cs +++ b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/MyProjectNameBlazorHostModule.cs @@ -1,6 +1,5 @@ using System; using System.IO; -using System.Net.Http; using System.Threading.Tasks; using Blazorise.Bootstrap5; using Blazorise.Icons.FontAwesome; @@ -16,7 +15,6 @@ using MyCompanyName.MyProjectName.MultiTenancy; using Volo.Abp; using Volo.Abp.Account; using Volo.Abp.Account.Web; -using Volo.Abp.AspNetCore.Authentication.JwtBearer; using Volo.Abp.AspNetCore.Components.Server.BasicTheme; using Volo.Abp.AspNetCore.Components.Server.BasicTheme.Bundling; using Volo.Abp.AspNetCore.Components.Web.Theming.Routing; @@ -48,7 +46,6 @@ using Volo.Abp.Swashbuckle; using Volo.Abp.TenantManagement; using Volo.Abp.TenantManagement.Blazor.Server; using Volo.Abp.TenantManagement.EntityFrameworkCore; -using Volo.Abp.Threading; using Volo.Abp.UI.Navigation; using Volo.Abp.UI.Navigation.Urls; using Volo.Abp.VirtualFileSystem; @@ -62,7 +59,6 @@ namespace MyCompanyName.MyProjectName.Blazor.Server.Host; typeof(AbpAspNetCoreMvcUiBasicThemeModule), typeof(AbpAutofacModule), typeof(AbpSwashbuckleModule), - typeof(AbpAspNetCoreAuthenticationJwtBearerModule), typeof(AbpAspNetCoreSerilogModule), typeof(AbpAccountWebOpenIddictModule), typeof(AbpAccountApplicationModule), @@ -100,13 +96,6 @@ public class MyProjectNameBlazorHostModule : AbpModule ); }); - PreConfigure(builder => - { - // https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption - // In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing. - builder.DisableAccessTokenEncryption(); - }); - PreConfigure(builder => { builder.AddValidation(options => @@ -151,14 +140,6 @@ public class MyProjectNameBlazorHostModule : AbpModule ); }); - context.Services.AddAuthentication() - .AddJwtBearer(options => - { - options.Authority = configuration["AuthServer:Authority"]; - options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]); - options.Audience = "MyProjectName"; - }); - if (hostingEnvironment.IsDevelopment()) { Configure(options => @@ -253,7 +234,7 @@ public class MyProjectNameBlazorHostModule : AbpModule app.UseStaticFiles(); app.UseRouting(); app.UseAuthentication(); - app.UseJwtTokenMiddleware(); + app.UseAbpOpenIddictValidation(); if (MultiTenancyConsts.IsEnabled) { diff --git a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/appsettings.json b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/appsettings.json index 75f6e96512..53f04d8271 100644 --- a/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/appsettings.json +++ b/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.Blazor.Server.Host/appsettings.json @@ -5,9 +5,5 @@ }, "ConnectionStrings": { "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName_Unified;Trusted_Connection=True" - }, - "AuthServer": { - "Authority": "https://localhost:44304", - "RequireHttpsMetadata": "false" } }