1
2
3
4	public abstract class DbContext : 
  IdentityDbContext<User, Role, long>
{
}	

1
2
3
4	services.AddDbContext<DbContext>(options =>
{
    options.UseOpenIddict<long>();
});	

1
2
3	services.AddIdentity<User, Role>()
    .AddEntityFrameworkStores<DbContext>()
    .AddDefaultTokenProviders();	

1
2
3
4	services.AddAuthentication(options =>
{
    options.DefaultScheme = OAuthValidationDefaults.AuthenticationScheme;
}).AddOAuthValidation();	

1
2
3
4
5
6
7
8
9
10	services.Configure<IdentityOptions>(options =>
{
    // Password settings
    options.Password.RequireDigit = false;
     ....
 
    options.ClaimsIdentity.UserNameClaimType = OpenIdConnectConstants.Claims.Name;
    options.ClaimsIdentity.UserIdClaimType = OpenIdConnectConstants.Claims.Subject;
    options.ClaimsIdentity.RoleClaimType = OpenIdConnectConstants.Claims.Role;
});	

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25	services.AddOpenIddict()
 .AddCore(options =>
 {
  options.UseEntityFrameworkCore()
   .UseDbContext<TDbContext>()
   .ReplaceDefaultEntities<long>();
 })
 .AddServer(options =>
 {
  // nécessaire pour enregistrer les types OpenIddict
  options.UseMvc();
 
  // les scopes définis
  options.RegisterScopes(
   OpenIdConnectConstants.Scopes.OpenId,
   OpenIdConnectConstants.Scopes.OfflineAccess);
 
  // le endpoint de connexion
  options.EnableTokenEndpoint("/connect/token");
 
  // permettre de se connecter en ressource owned grant..
  options.AllowPasswordFlow();
 
  // options.AcceptAnonymousClients();
 });	

1
2
3
4	[Authorize(
 AuthenticationSchemes = OAuthValidationDefaults.AuthenticationScheme, 
 Roles = "ADMIN")]
public ActionResult ActionWithAdminAuthorize(){}	

1	OpenIddictConstants.Permissions.GrantTypes.ClientCredentials	

1
2
3
4
5
6
7	public async Task<IActionResult> 
  ExchangeAsync([FromBody] OpenIdConnectRequest request)
{
  if (!request.IsClientCredentialsGrantType()){
    return;
  }
}	

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22	// on créé une identité connecté via OpenId Connect.
var identity = 
  new ClaimsIdentity(OpenIdConnectServerDefaults.AuthenticationScheme);
var claimsPrincipal = new ClaimsPrincipal(identity);
 
// On ajoute le claim subject obligatoire
identity.AddClaim(
 
  new Claim(OpenIdConnectConstants.Claims.Subject, request.ClientId));
 
// Creation du ticket d'authentification
var ticket = new AuthenticationTicket(
    claimsPrincipal,
    new AuthenticationProperties(),
    OpenIdConnectServerDefaults.AuthenticationScheme);
 
// Application des scopes
ticket.SetScopes(request.GetScopes()));
return SignIn(
  ticket.Principal, 
  ticket.Properties, 
  ticket.AuthenticationScheme);	

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17	internal static async Task Main(string[] args)
{
    var config = new ConfigurationBuilder()
        .AddCommandLine(args)
        .Build();
    var clientIdGeneratorConfig = config.Get<MaConfig>();
        ...
}
 
public class MaConfig
{
    public string ClientId { get; set; }
    public string ClientSecret { get; set; }
    public string DisplayName { get; set; }
    public string RedirectUrl { get; set; }
    public string SqlConnectionString { get; set; }
}	

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15	var inMemoryConfig = new Dictionary<string, string>
{
    {"ConnectionStrings:DefaultConnection", connectionString}
};
var configuration = new ConfigurationBuilder()
     .AddInMemoryCollection(inMemoryConfig)
     .Build();
 
 var webHost = WebHost.CreateDefaultBuilder()
     .UseStartup<StartupDeMonApi>()
     .UseConfiguration(configuration)
     .Build();
 
 // démarrage de l'API
 await webHost.StartAsync();	

1
2
3	using (var serviceScope = webHost.Services.CreateScope())
{
}	

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19	var manager = serviceScope.ServiceProvider
  .GetRequiredService<
  OpenIddictApplicationManager<OpenIddictApplication<long>>>();
 
var descriptor = new OpenIddictApplicationDescriptor
{
    ClientId = myConfig.ClientId,
    ClientSecret = myConfig.ClientSecret,
    DisplayName = myConfig.DisplayName,
    Permissions =
    {
        OpenIddictConstants.Permissions.Endpoints.Token,
        OpenIddictConstants.Permissions.GrantTypes.Password,
        OpenIddictConstants.Permissions.Scopes.Email,
        OpenIddictConstants.Permissions.Scopes.Profile,
    }
};
 
await manager.CreateAsync(descriptor);	

1
2
3
4	--ClientId=Kikou
--ClientSecret=Lol
--DisplayName="Une application"
--SqlConnectionString="Server=tcp:deded;Initial Catalog=dev;Persist Security Info=False;User ID=inwink-sql-admin;Password=dededed;MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=True;Connection Timeout=30;"	

1
2
3
4
5
6	GET /authorize?
    response_type=code
    &client_id=monClientId
    &redirect_uri=https%3A%2F%2Furl.callback%2Fcb
    &scope=openid%20profile
    &state=kikouLolMdr	

1
2
3	In order to avoid these issues, Clients SHOULD NOT use the implicit
 grant and any other response type causing the authorization server to
 issue an access token in the authorization response.	

1
2
3
4
5
6
7	GET /authorize?
    response_type=token
    &client_id=monClientId
    &redirect_uri=https%3A%2F%2Furl.callback%2Fcb
    &scope=openid%20profile
    &state=kikouLolMdr
  Host: infinitesquare.com	

1
2
3
4
5
6	GET /authorize?
    grant_type=password
    &client_id=monClientId
    &scope=openid%20profile
    &username=jonathan
    &password=motDePasse	

1
2
3
4
5
6	GET /authorize?
    grant_type=client_credentials
    &client_id=monClientId
    &scope=openid%20profile
    &client_id=jonathan
    &client_secret=motDePasse	

1
2
3
4
5
6
7
8
9
10
11
12
13	services.AddOpenIddict()
.AddCore(
    options =>
    {
     // configuration du cœur
    })
.AddServer(
    options =>
   {
   // autres configurations du serveur ici
   var thumbprint = Configuration["OpenIdConnect:Thumbprint"];
     options.AddSigningCertificate(thumbprint);
    });	

1
2
3
4
5
6
7	openssl 
    x509 
    -noout 
    -fingerprint 
    -sha1 
    -inform pem 
    -in votreCertificat.crt	

1
2
3
4
5
6	openssl 
    pkcs12 
    -export 
    -out votreArchive.pfx 
    -inkey cotreClefPrivee.key 
    -in votreCertificat.crt