diff --git a/src/Services/Identity/Identity.API/Configuration/Config.cs b/src/Services/Identity/Identity.API/Configuration/Config.cs index 9c799ca68..24fd399f6 100644 --- a/src/Services/Identity/Identity.API/Configuration/Config.cs +++ b/src/Services/Identity/Identity.API/Configuration/Config.cs @@ -1,31 +1,30 @@ using IdentityServer4.Models; using Microsoft.Extensions.Options; using System.Collections.Generic; +using IdentityServer4; namespace Identity.API.Configuration { public class Config { - // scopes define the resources in your system - public static IEnumerable GetScopes() + // ApiResources define the apis in your system + public static IEnumerable GetApis() { - return new List + return new List { - //Authentication OpenId uses this scopes; - StandardScopes.OpenId, - StandardScopes.Profile, + new ApiResource("orders", "Orders Service"), + new ApiResource("basket", "Basket Service") + }; + } - //Each api we want to securice; - new Scope - { - Name = "orders", - Description = "Orders Service" - }, - new Scope - { - Name = "basket", - Description = "Basket Service" - } + // Identity resources are data like user ID, name, or email address of a user + // see: http://docs.identityserver.io/en/release/configuration/resources.html + public static IEnumerable GetResources() + { + return new List + { + new IdentityResources.OpenId(), + new IdentityResources.Profile() }; } @@ -47,8 +46,8 @@ namespace Identity.API.Configuration AllowedCorsOrigins = { $"{clientsUrl["Spa"]}" }, AllowedScopes = { - StandardScopes.OpenId.Name, - StandardScopes.Profile.Name, + IdentityServerConstants.StandardScopes.OpenId, + IdentityServerConstants.StandardScopes.Profile, "orders", "basket" } @@ -65,8 +64,8 @@ namespace Identity.API.Configuration AllowedCorsOrigins = { "http://eshopxamarin" }, AllowedScopes = { - StandardScopes.OpenId.Name, - StandardScopes.Profile.Name, + IdentityServerConstants.StandardScopes.OpenId, + IdentityServerConstants.StandardScopes.Profile, "orders", "basket" } @@ -82,6 +81,7 @@ namespace Identity.API.Configuration ClientUri = $"{clientsUrl["Mvc"]}", // public uri of the client AllowedGrantTypes = GrantTypes.Hybrid, RequireConsent = false, + AllowOfflineAccess = true, RedirectUris = new List { $"{clientsUrl["Mvc"]}/signin-oidc", @@ -96,9 +96,9 @@ namespace Identity.API.Configuration }, AllowedScopes = new List { - StandardScopes.OpenId.Name, - StandardScopes.Profile.Name, - StandardScopes.OfflineAccess.Name, + IdentityServerConstants.StandardScopes.OpenId, + IdentityServerConstants.StandardScopes.Profile, + IdentityServerConstants.StandardScopes.OfflineAccess, "orders", "basket", }, diff --git a/src/Services/Identity/Identity.API/Controllers/AccountController.cs b/src/Services/Identity/Identity.API/Controllers/AccountController.cs index c4747602f..641f39522 100644 --- a/src/Services/Identity/Identity.API/Controllers/AccountController.cs +++ b/src/Services/Identity/Identity.API/Controllers/AccountController.cs @@ -5,7 +5,6 @@ using IdentityModel; using IdentityServer4.Quickstart.UI.Models; using IdentityServer4.Services; -using IdentityServer4.Services.InMemory; using Microsoft.AspNetCore.Http.Authentication; using Microsoft.AspNetCore.Mvc; using System; diff --git a/src/Services/Identity/Identity.API/Controllers/ConsentController.cs b/src/Services/Identity/Identity.API/Controllers/ConsentController.cs index ab954f779..a5687dd31 100644 --- a/src/Services/Identity/Identity.API/Controllers/ConsentController.cs +++ b/src/Services/Identity/Identity.API/Controllers/ConsentController.cs @@ -22,7 +22,7 @@ namespace IdentityServer4.Quickstart.UI.Controllers { private readonly ILogger _logger; private readonly IClientStore _clientStore; - private readonly IScopeStore _scopeStore; + private readonly IResourceStore _resourceStore; private readonly IIdentityServerInteractionService _interaction; @@ -30,12 +30,12 @@ namespace IdentityServer4.Quickstart.UI.Controllers ILogger logger, IIdentityServerInteractionService interaction, IClientStore clientStore, - IScopeStore scopeStore) + IResourceStore resourceStore) { _logger = logger; _interaction = interaction; _clientStore = clientStore; - _scopeStore = scopeStore; + _resourceStore = resourceStore; } /// @@ -120,10 +120,10 @@ namespace IdentityServer4.Quickstart.UI.Controllers var client = await _clientStore.FindEnabledClientByIdAsync(request.ClientId); if (client != null) { - var scopes = await _scopeStore.FindEnabledScopesAsync(request.ScopesRequested); - if (scopes != null && scopes.Any()) + var resources = await _resourceStore.FindEnabledResourcesByScopeAsync(request.ScopesRequested); + if (resources != null && (resources.IdentityResources.Any() || resources.ApiResources.Any())) { - return new ConsentViewModel(model, returnUrl, request, client, scopes); + return new ConsentViewModel(model, returnUrl, request, client, resources); } else { diff --git a/src/Services/Identity/Identity.API/Identity.API.csproj b/src/Services/Identity/Identity.API/Identity.API.csproj index 2a1198cec..043595232 100644 --- a/src/Services/Identity/Identity.API/Identity.API.csproj +++ b/src/Services/Identity/Identity.API/Identity.API.csproj @@ -41,8 +41,8 @@ All - - + + diff --git a/src/Services/Identity/Identity.API/Models/AccountViewModels/ConsentViewModel.cs b/src/Services/Identity/Identity.API/Models/AccountViewModels/ConsentViewModel.cs index 07124587c..e0df65555 100644 --- a/src/Services/Identity/Identity.API/Models/AccountViewModels/ConsentViewModel.cs +++ b/src/Services/Identity/Identity.API/Models/AccountViewModels/ConsentViewModel.cs @@ -10,7 +10,7 @@ namespace Identity.API.Models.AccountViewModels { public class ConsentViewModel : ConsentInputModel { - public ConsentViewModel(ConsentInputModel model, string returnUrl, AuthorizationRequest request, Client client, IEnumerable scopes) + public ConsentViewModel(ConsentInputModel model, string returnUrl, AuthorizationRequest request, Client client, Resources resources) { RememberConsent = model?.RememberConsent ?? true; ScopesConsented = model?.ScopesConsented ?? Enumerable.Empty(); @@ -22,8 +22,8 @@ namespace Identity.API.Models.AccountViewModels ClientLogoUrl = client.LogoUri; AllowRememberConsent = client.AllowRememberConsent; - IdentityScopes = scopes.Where(x => x.Type == ScopeType.Identity).Select(x => new ScopeViewModel(x, ScopesConsented.Contains(x.Name) || model == null)).ToArray(); - ResourceScopes = scopes.Where(x => x.Type == ScopeType.Resource).Select(x => new ScopeViewModel(x, ScopesConsented.Contains(x.Name) || model == null)).ToArray(); + IdentityScopes = resources.IdentityResources.Select(x => new ScopeViewModel(x, ScopesConsented.Contains(x.Name) || model == null)).ToArray(); + ResourceScopes = resources.ApiResources.SelectMany(x => x.Scopes).Select(x => new ScopeViewModel(x, ScopesConsented.Contains(x.Name) || model == null)).ToArray(); } public string ClientName { get; set; } @@ -47,6 +47,16 @@ namespace Identity.API.Models.AccountViewModels Checked = check || scope.Required; } + public ScopeViewModel(IdentityResource identity, bool check) + { + Name = identity.Name; + DisplayName = identity.DisplayName; + Description = identity.Description; + Emphasize = identity.Emphasize; + Required = identity.Required; + Checked = check || identity.Required; + } + public string Name { get; set; } public string DisplayName { get; set; } public string Description { get; set; } diff --git a/src/Services/Identity/Identity.API/Startup.cs b/src/Services/Identity/Identity.API/Startup.cs index a58b5a6d9..862b93914 100644 --- a/src/Services/Identity/Identity.API/Startup.cs +++ b/src/Services/Identity/Identity.API/Startup.cs @@ -77,7 +77,8 @@ namespace eShopOnContainers.Identity // Adds IdentityServer services.AddIdentityServer(x => x.IssuerUri = "null") .AddSigningCredential(Certificate.Get()) - .AddInMemoryScopes(Config.GetScopes()) + .AddInMemoryApiResources(Config.GetApis()) + .AddInMemoryIdentityResources(Config.GetResources()) .AddInMemoryClients(Config.GetClients(clientUrls)) .AddAspNetIdentity() .Services.AddTransient(); diff --git a/src/Web/WebMVC/Startup.cs b/src/Web/WebMVC/Startup.cs index aaba855d0..fef0b4b68 100644 --- a/src/Web/WebMVC/Startup.cs +++ b/src/Web/WebMVC/Startup.cs @@ -112,15 +112,10 @@ namespace Microsoft.eShopOnContainers.WebMVC ResponseType = "code id_token", SaveTokens = true, GetClaimsFromUserInfoEndpoint = true, - RequireHttpsMetadata = false, + RequireHttpsMetadata = false, + Scope = { "openid", "profile", "orders", "basket" } }; - oidcOptions.Scope.Clear(); - oidcOptions.Scope.Add("openid"); - oidcOptions.Scope.Add("profile"); - oidcOptions.Scope.Add("orders"); - oidcOptions.Scope.Add("basket"); - //Wait untill identity service is ready on compose. app.UseOpenIdConnectAuthentication(oidcOptions);