IdentityServer4 authenticate each client separately

Daniil Doronkin

I use two different clients. The IdentityServer4 provides API protections and log in form. Can I configure clients to avoid single sign on. I mean that even if I logged in the first client I need to log in the second client too.

My ID4 configuration:

internal static IEnumerable<Client> GetClients(IEnumerable<RegisteredClient> clients)
{
    return clients.Select(x =>
    {
        var scopes = x.AllowedScopes.ToList();
        scopes.Add(IdentityServerConstants.StandardScopes.OpenId);
        scopes.Add(IdentityServerConstants.StandardScopes.Profile);
        scopes.Add(IdentityServerConstants.StandardScopes.OfflineAccess);

        var client = new Client
        {
            ClientId = x.Id,
            ClientName = x.Name,
            AllowedGrantTypes = GrantTypes.Hybrid,

            RequireConsent = false,

            RefreshTokenExpiration = TokenExpiration.Sliding,
            RefreshTokenUsage = TokenUsage.ReUse,

            ClientSecrets = {new Secret(x.Secret.Sha256())},
            RedirectUris = new[] {$"{x.Url}/signin-oidc"},
            PostLogoutRedirectUris = new[] {$"{x.Url}/signout-callback-oidc"},

            UpdateAccessTokenClaimsOnRefresh = true,

            AllowAccessTokensViaBrowser = true,
            AllowedScopes = scopes,
            AllowedCorsOrigins = {x.Url},
            AllowOfflineAccess = true
        };

        return client;
    });
}

All client have the same register code (Maybe it is a problem):

const string oidcScheme = "oidc";
const string coockieScheme = CookieAuthenticationDefaults.AuthenticationScheme;

services.AddAuthentication(options =>
{
    options.DefaultScheme = coockieScheme;
    options.DefaultChallengeScheme = oidcScheme;
})
    .AddCookie(coockieScheme)
    .AddOpenIdConnect(oidcScheme, options =>
    {
        options.SignInScheme = coockieScheme;

        options.Authority = identitySettings.Authority;
        options.RequireHttpsMetadata = false;

        options.ClientId = identitySettings.Id;
        options.ClientSecret = identitySettings.Secret;

        options.ResponseType = "code id_token";

        options.Scope.Add("offline_access");
        foreach (var scope in identitySettings.Scopes)
        {
            options.Scope.Add(scope);
        }

        options.GetClaimsFromUserInfoEndpoint = true;
        options.SaveTokens = true;
    });

any help will be useful.

m3n7alsnak3

As long as you are in the same browser session, and your apps are having the same authority (are using the same Identity Server) this will not work.

I'll explain you why - once you log in from the first client, Identity Server creates a cookie (with all the relevant data needed in it).

Now comes the second client - the authority (the Identity Server) is the same that has issued the cookie. So Identity Server recognizes your session, sees that you are already authenticated and redirects you to the second client, without asking for credentials.

After all, this is the idea of Identity Server:

IdentityServer4 is an OpenID Connect and OAuth 2.0 framework for ASP.NET Core 2.

It enables the following features in your applications:

Authentication as a Service

Centralized login logic and workflow for all of your applications (web, native, mobile, services). IdentityServer is an officially certified implementation of OpenID Connect.

Single Sign-on / Sign-out

Single sign-on (and out) over multiple application types.

and more....

This is from the official documentation.

You have to either go for different authorities (Identity Server instances) for each client, or re-think is Identity Server the right solution for you in this case.

NOT RECOMMENDED

I'm not recommending this, because it kind of overrides the SSO idea of Identity Server, however if you still want to do it then - you can achieve what you want if you override the IProfileService. There is a method public Task IsActiveAsync(IsActiveContext context) and this context has a property IsActive which determines if the current principal is active in the current client.

You can try and implement some custom logic here, and based on the user ID (context.Subject.GetSubjectId()) and the client id (context.Client.ClientId) to determine if the user is already logged in this client or not.

EDIT

After your comment - this is something that doesn't come OOTB from Identity Server (if I can say it like this), but luckily you have an option.

Policy based authorization per client. Like this, your user can authenticate against Identity Server (and all of its clients), but only the specific clients will authorize him. You can treat this policies as a custom authorize attribute (more or less).

Like this, a user will receive unauthorized in clients, where he.. is not authorized. Hope that this clears the thing and helps :)

この記事はインターネットから収集されたものであり、転載の際にはソースを示してください。

侵害の場合は、連絡してください[email protected]

編集
0

コメントを追加

0

関連記事

分類Dev

角度10'oidc-client '/ IdentityServer4 .netCore 3.1

分類Dev

IdentityServer4がclient_をクレームに追加する

分類Dev

ASP.Net Core - IdentityServer4 client credentials authorization not working

分類Dev

IdentityServer4 IExtensionGrantValidator

分類Dev

Calculate the variance for each element in the sample separately

分類Dev

Is it possile to deploy each module separately in GAE

分類Dev

oidc-client-jsがIdentityServer4からクレームを正しく取得していません

分類Dev

異なるドメインのoidc-clientとidentityServer4でサインインする

分類Dev

ベアラートークンを生成したclient_idを取得する方法は?(.NetCore2.1、IdentityServer4)

分類Dev

IdentityServer4 IdentityServer3.AccessTokenValidation

分類Dev

IdentityServer4管理UI

分類Dev

IdentityServer4 AddSigningCredentials with Certificate

分類Dev

Is it possible to set "worker_prefetch_multiplier" for each queue separately in Celery?

分類Dev

How to write and save each line separately on a txt file?

分類Dev

Regex: split a string on whitespace + each special character to be included separately

分類Dev

How to style each list item background of the wordpress navigation separately

分類Dev

xbox.client.authenticateのSSLエラー

分類Dev

Authenticate on client side, How to protect my Java Rest API now?

分類Dev

IdentityServer4:Client_CredentialGranttypeのクライアントプリンシパルにカスタムデフォルトクレームを追加

分類Dev

IdentityServer4では、client_credentials認証で要求されたスコープとして「*」を使用できますか?

分類Dev

Access Channels in ANTLR 4 and Parse them separately

分類Dev

.NET Core IdentityとIdentityServer4

分類Dev

IdentityServer4のAddTemporarySigningCredentialとAddSigningCredential

分類Dev

How to Configure login UI for IdentityServer4?

分類Dev

User Registration Process with IdentityServer4

分類Dev

IdentityServer4 PersistedGrantDbContext&ConfigurationDbContext

分類Dev

IdentityServer4 AddSignerCredentialsRSAの例

分類Dev

IdentityServer4 AddSignerCredentials RSA example

分類Dev

IdentityServer4 with Windows authentication and custom claims

Related 関連記事

  1. 1

    角度10'oidc-client '/ IdentityServer4 .netCore 3.1

  2. 2

    IdentityServer4がclient_をクレームに追加する

  3. 3

    ASP.Net Core - IdentityServer4 client credentials authorization not working

  4. 4

    IdentityServer4 IExtensionGrantValidator

  5. 5

    Calculate the variance for each element in the sample separately

  6. 6

    Is it possile to deploy each module separately in GAE

  7. 7

    oidc-client-jsがIdentityServer4からクレームを正しく取得していません

  8. 8

    異なるドメインのoidc-clientとidentityServer4でサインインする

  9. 9

    ベアラートークンを生成したclient_idを取得する方法は?(.NetCore2.1、IdentityServer4)

  10. 10

    IdentityServer4 IdentityServer3.AccessTokenValidation

  11. 11

    IdentityServer4管理UI

  12. 12

    IdentityServer4 AddSigningCredentials with Certificate

  13. 13

    Is it possible to set "worker_prefetch_multiplier" for each queue separately in Celery?

  14. 14

    How to write and save each line separately on a txt file?

  15. 15

    Regex: split a string on whitespace + each special character to be included separately

  16. 16

    How to style each list item background of the wordpress navigation separately

  17. 17

    xbox.client.authenticateのSSLエラー

  18. 18

    Authenticate on client side, How to protect my Java Rest API now?

  19. 19

    IdentityServer4:Client_CredentialGranttypeのクライアントプリンシパルにカスタムデフォルトクレームを追加

  20. 20

    IdentityServer4では、client_credentials認証で要求されたスコープとして「*」を使用できますか?

  21. 21

    Access Channels in ANTLR 4 and Parse them separately

  22. 22

    .NET Core IdentityとIdentityServer4

  23. 23

    IdentityServer4のAddTemporarySigningCredentialとAddSigningCredential

  24. 24

    How to Configure login UI for IdentityServer4?

  25. 25

    User Registration Process with IdentityServer4

  26. 26

    IdentityServer4 PersistedGrantDbContext&ConfigurationDbContext

  27. 27

    IdentityServer4 AddSignerCredentialsRSAの例

  28. 28

    IdentityServer4 AddSignerCredentials RSA example

  29. 29

    IdentityServer4 with Windows authentication and custom claims

ホットタグ

アーカイブ