DEV Community

Secure Open API (Swagger) calls with Azure Active Directory

Christos Matskas on July 21, 2021

We have talked about secure web apps and APIs many times here. In this blog post we'll examine how to secure Swashbuckle (.NET's version of Open AP...
Collapse
 
abombdotcom profile image
ABombDotCom

Kudos and thanks @christosmatskas ! This did just what I needed.

Collapse
 
eduardomb08 profile image
Eduardo Monteiro de Barros

Can't get this to work either. First tried setting up the App Registrations myself. Then used the provided notebook on a test tenant where I have admin rights. Nonetheless, I ended up with the same error:

Image description

Any help would be greatly appreciated!

PS: Also tried the Discord link and got a "Invite Invalid" error.

Thanks and Best Regards,

Eduardo

Collapse
 
eduardomb08 profile image
Eduardo Monteiro de Barros • Edited

Hi,

I was able to get it working, but I had to use a different port. For some reason, if I use port 5001 I get the error showed above. I can repeatedly change the port on the project's config to make it work or break it.

Neither port 5001 or any other port that I use to get it to work seem to be necessary to be listed under the App Registration's Authentication tab.

I just can't figure out:
1) Isn't the redirect URL required to be listed in the Authentication tab, under Single-page application? Could it be that because I'm using localhost the port is ignored?

2) What could be causing it not to work for a specific port?

Collapse
 
eduardomb08 profile image
Eduardo Monteiro de Barros

Hi again,

I wanted to share this in case anyone else is having the same problem. After comparing the Authorize URLs from port 5001 with any other port, I noticed the former was missing the code_challenge attributes and the sso_reload attribute.

After poking around some more, I started suspecting some cache issue could be taking place. So, I decided to open the Swagger UI page in an Incognito tab using port 5001 (the one that was breaking the authentication).

Voilà! It worked.

Best to all!

Collapse
 
herecomeslappy profile image
Lappy

All this can be achieved using only one single application not the two.

You create one Single Page App on Azure AD. You create a scope in that app. Make roles and assign them to your users. They you just put the same app Id for both OpenIdClientId and ClientId and so it can use the same app to authenticate as well as the API can use it.

Collapse
 
chrisworledge profile image
Chris Wobble

The startup/appsettings code looks fine, but the Azure AD setup is a bit mysterious

Not sure what the comment about the interactive notebook means, but I can configure an OpenAPI Client with a redirect uri of api/swagger/index. Not sure about the scopes though.... or Select the tokens you would like to be issued by the authorization endpoint:
Access tokens (used for implicit flows)
ID tokens (used for implicit and hybrid flows)

Collapse
 
christosmatskas profile image
Christos Matskas

Hi Chris, thanks for the comment. The .NET Interactive Notebook sets up 2 App Registrations. One of them is used by the API to validate incoming tokens and scopes. The second one is used by the Swagger UI to acquire an Access Token and call the API endpoints. Please note that we don't use and encourage against implicit flows at all times. The current implementation uses Auth Code with PKCE. Ping us if you have any questions

Collapse
 
hatvanis profile image
hatvanis

Hi,
Could you help me, please, why I get this error message: AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app ...

Collapse
 
pinkesh6834 profile image
Pinkesh Patel

@christosmatskas Great article, out of the curiosity why you are not passing secret in swagger?

Collapse
 
skanvk15 profile image
skanvk15

@christosmatskas: Thanks for the detailed article. I am unable to get this to work when API is using AD B2C. I updated the urls to this:
Authorization URL: MYB2CDOMAIN.b2clogin.com/MYB2CDOMA...
Token URL: MYB2CDOMAIN.b2clogin.com/MYB2CDOMA...
But getting this error:
AADB2C90182: The supplied code_verifier does not match associated code_challenge.
Any ideas on how to get this to work with B2C?

Collapse
 
alfetta159 profile image
Daniel R. Przybylski

Well done! The GitHub repo was very helpful.