We have talked about secure web apps and APIs many times here. In this blog post we'll examine how to secure Swashbuckle (.NET's version of Open AP...
For further actions, you may consider blocking this person and/or reporting abuse
Kudos and thanks @christosmatskas ! This did just what I needed.
Can't get this to work either. First tried setting up the App Registrations myself. Then used the provided notebook on a test tenant where I have admin rights. Nonetheless, I ended up with the same error:
Any help would be greatly appreciated!
PS: Also tried the Discord link and got a "Invite Invalid" error.
Thanks and Best Regards,
Eduardo
Hi,
I was able to get it working, but I had to use a different port. For some reason, if I use port 5001 I get the error showed above. I can repeatedly change the port on the project's config to make it work or break it.
Neither port 5001 or any other port that I use to get it to work seem to be necessary to be listed under the App Registration's Authentication tab.
I just can't figure out:
1) Isn't the redirect URL required to be listed in the Authentication tab, under Single-page application? Could it be that because I'm using localhost the port is ignored?
2) What could be causing it not to work for a specific port?
Hi again,
I wanted to share this in case anyone else is having the same problem. After comparing the Authorize URLs from port 5001 with any other port, I noticed the former was missing the code_challenge attributes and the sso_reload attribute.
After poking around some more, I started suspecting some cache issue could be taking place. So, I decided to open the Swagger UI page in an Incognito tab using port 5001 (the one that was breaking the authentication).
Voilà! It worked.
Best to all!
All this can be achieved using only one single application not the two.
You create one Single Page App on Azure AD. You create a scope in that app. Make roles and assign them to your users. They you just put the same app Id for both OpenIdClientId and ClientId and so it can use the same app to authenticate as well as the API can use it.
The startup/appsettings code looks fine, but the Azure AD setup is a bit mysterious
Not sure what the comment about the interactive notebook means, but I can configure an OpenAPI Client with a redirect uri of api/swagger/index. Not sure about the scopes though.... or Select the tokens you would like to be issued by the authorization endpoint:
Access tokens (used for implicit flows)
ID tokens (used for implicit and hybrid flows)
Hi Chris, thanks for the comment. The .NET Interactive Notebook sets up 2 App Registrations. One of them is used by the API to validate incoming tokens and scopes. The second one is used by the Swagger UI to acquire an Access Token and call the API endpoints. Please note that we don't use and encourage against implicit flows at all times. The current implementation uses Auth Code with PKCE. Ping us if you have any questions
Hi,
Could you help me, please, why I get this error message: AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app ...
@christosmatskas Great article, out of the curiosity why you are not passing secret in swagger?
@christosmatskas: Thanks for the detailed article. I am unable to get this to work when API is using AD B2C. I updated the urls to this:
Authorization URL: MYB2CDOMAIN.b2clogin.com/MYB2CDOMA...
Token URL: MYB2CDOMAIN.b2clogin.com/MYB2CDOMA...
But getting this error:
AADB2C90182: The supplied code_verifier does not match associated code_challenge.
Any ideas on how to get this to work with B2C?
Well done! The GitHub repo was very helpful.