DEV Community

Build your own OAuth 2.0 Server and OpenId Connect Provider in ASP.NET Core 6.0

Mohammed Ahmed Hussien on October 28, 2022

Update 20, April 2023 This article is out of date because I added more functionality to this OAuth server, so to be more updated I suggest download...

Read full post

Svetelak • Jan 27 '23

Hi, could I ask for some advice? I'm starting with OAuth and I downloaded your server project and I'm trying to connect a test (client) application to it. After starting the OAuth server and the Client, the login screen appears correctly if I am not logged in. After logging in, it redirects to the url where I have the client application (sample: https://localhost:7285/signin-oidc?response_type=code&state=CfDJ8Ecxanf86J1JnZZYH7c8PDzfq9Skgyu5iPZeW31rddOYS-I9c2n8jR...), but this error SecurityTokenException: Unable to validate is displayed the 'id_token', no suitable ISecurityTokenValidator was found for: ''.".
If I edit the url (localhost:7285/), the application is logged in.
I couldn't get to the root cause. Can I ask you for some advice?
Thank you very much Lubos

Mohammed Ahmed Hussien • Jan 29 '23 • Edited

Hi, sure, can you show me the configuration that you have been make at the client level.

Be sure to remove these lines of codes from the client application.

options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = false,
                SignatureValidator = delegate(string token, TokenValidationParameters validationParameters)
                {
                    var jwt = new JwtSecurityToken(token);
                    return jwt;
                },
            };

Because the source code in the GitHub repo now is support the key validator

Svetelak • Jan 29 '23

Hi, I already tried to remove options.TokenValidationParameters from the client according to your advice... but the result is still the same. Both in the Bl@zor project and in the MVC project. I'm sending a command.

Svetelak • Jan 29 '23

Hi, thank you very much for your response. I am sending a link to the entire project, where I try and test it
dcfreenet.info/0_test/TestOpenAuth...
My goal will be client applications in Bl@zor
And thank you for adding to your answer. I will try what you wrote.

Svetelak • Jan 29 '23

So I tried to remove the given code but the result was the same :-(

Mohammed Ahmed Hussien • Jan 29 '23

Let me check your source code

Svetelak • Jan 29 '23

Thanks for the reply, so I'm sending the link to github.
github.com/Svetelak/OAuthServerTes...

Mohammed Ahmed Hussien • Feb 1 '23

Sorry for late to response, yeah there is a bug, the bug is that the user is not logged-in and in the GenerateToken method like so

  if (!clientCodeChecker.Subject.Identity.IsAuthenticated)
                    // I have to inform the caller to redirect the user to the login page
                    return new TokenResponse { Error = ErrorTypeEnum.InvalidGrant.GetEnumDescription() };

I will fix that this weekend.

Svetelak • Feb 5 '23

Super thank you very much. As soon as it's ok, I'll test :-)
Thank you so much

Mohammed Ahmed Hussien • Feb 8 '23

Hi, the bug is fixed, you can try now from your side.
I try it with Balzor app it's working.
this is the fixed commit:
github.com/Shoogn/OAuth20Server/co...

Svetelak • Feb 8 '23

I tried it and it works! Thank you very much, perfect job

Tamás Varga • May 6 '23

Hi, I tried to change the RSA xml to a new one generated by:

using var rsa = new RSACryptoServiceProvider(2048);
var xml = rsa.ToXmlString(true);

When I try to login with my client I get "Signature validation failed. Token does not have a kid. Keys tried: 'System.Text.StringBuilder'".

Should I change anything else, or the generated key is wrong? The original works fine.

Tamás Varga • May 7 '23

Found it. I had to replace "n" and "kid" values in jwks.json under wwwroot folder to the Modulus of the new RSA XML.

Mohammed Ahmed Hussien • May 10 '23

Glad to here that, and if you want to change the entire directory, you can navigate to the DiscoveryEndpointController object there is an Action Method named Jwk you will find the current patch assigned to wwwroot folder from there you can provide your preferred path

mperudirectio • Jun 8 '23 • Edited

Hello, just following the first steps of the tutorial.
when i start the two applications the ~/.well-known/openid-configuration endpoint it's not fired. Could it be because I'm working on an api project and not mvc? thanks!

This is the starup config of the client (registered in my oauth server project)

builder.Services.AddAuthentication(config =>
{
    config.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    config.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme,  options =>
{
    // OAuth Server Port
    options.Authority = "https://localhost:7039";

    options.ClientId = "directiofadlrs";
    options.ClientSecret = "123456789";
    options.ResponseType = "code";
    options.CallbackPath = "/signin-oidc";
    options.SaveTokens = true;

    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = false,
        SignatureValidator = (string token, TokenValidationParameters _) => new JwtSecurityToken(token),
    };
});

SOLVED
I forgot to decorate the Client controller with the [Authorize] attribute!

Naseer Ahmad • Jun 11 '23 • Edited

Hi,
Many thanks for sharing your application. I have executed both (client & server) applications successfully but when I deployed on the server. it shown shared error while return from server. Please help me, I am struck.

Please response urgently

Naseer Ahmad • Jun 11 '23

@mohammedahmed Please guide about it

Mohammed Ahmed Hussien • Jun 29 '23

Can you share the Auth Server App and Client app through github link

Faisal Shahzad • Jun 11 '23 • Edited

Thanks for the post. I'm need to have the similar solution and I'm using your example in our case. I have created two different domains client and server on the windows server 2019. Test is successfully authenticating the request but while calling back the following URL getting error page. Anyone can help?

Following is the callback URL

https://<client domain>/signin-oidc?response_type=code&state=CfDJ8ECkv9oAtGxNm2CqZXor7SUGMwvQj3_9ANUG193arlR7-OOacaFoYMP50c6IdSD7YdSfHHQgOIeLbrBDuDgdW60l1Lm8Ulcu6w6nI0_QOcqi-OR_v-wCXFw44RUJG0xibVecc06tB2QXQjlrACUd8aGG61eQJCs0GBnAItLP4Zn06tMb1M1n3jPXXagHh2QX7Bic2M4BgFqkRcoWxOyfDX2-9Lhht4MxIi-xRZ3w8dDUy0F2QiNvz-bakvWd3vfjEge66sUWXG-T-MkS8zep7ralR3rUstMqoxwgz7NOvJGbkkpi6fYL5F0amhYdstrC4_4npohGgEzUiKSxqsAPi6Key0D9uKOQnDl7tpHoLRPG5AXBsDdID11QUGVqIZPVmQ&code=fsYat7bISln_lWnKYxrP-4gAHcxs7U_9tq1fArrIWLA

Mohammed Ahmed Hussien • Jun 29 '23

Hi, you can not call this url direc because the auth server generate the code foe one time and also the client generate the state for one time as well.

Nicholas Poh • Mar 22 '23 • Edited

I'm testing out your Authorization Server from github and I can successfully login through it, which either resulted in creating a new account or log in to at my side. However when I tried to link exiting account on my side to your Authorization Server (via myserver/Identity/Account/Manage/E...), I'm getting the following exception on the Authorization Server,

System.Security.Cryptography.CryptographicException: 'The payload was invalid. For more information go to aka.ms/dataprotectionwarning'

If I ignore the exception, the Authorization Server's login page will be shown and upon entering the credential, the exception occurs again. On my side, the debug log shows,

Request starting HTTP/2 GET https://localhost:44329/signin-oidc?response_type=code&state=CfD...
AuthenticationScheme: Identity.External signed in.
Request finished HTTP/2 GET https://localhost:44329/signin-oidc?response_type=code&state=CfD... - - - 302 0 - 44.9488ms
Request starting HTTP/2 GET localhost:44329/Identity/Account/M... - -
Exception thrown: 'System.Security.Cryptography.CryptographicException' in Microsoft.AspNetCore.DataProtection.dll
Identity.Application was not authenticated. Failure message: Unprotect ticket failed

Any advice?

Nicholas Poh • Mar 23 '23

Issue resolved. We cannot use the same hostname for both the client and the server even when the ports are different. I tried with different hostnames and it works.

Mohammed Ahmed Hussien • Mar 30 '23 • Edited

I'm very glad you know about this point, and you fix the problem

kdudley21 • Jan 18

Would then allow me to use SSO with the Authorization Server ? Where If I Log In With ClientID 2 I can then go to the homecontroller for lets say ClientID 3 and it will know I already logged in with ClientID 2 ?

Melchor • Nov 16 '23

How to change InMemory Client Store to dynamic

Melchor • Oct 18 '23

Hi got this error message after login: SecurityTokenInvalidIssuerException: IDX10211: Unable to validate issuer. The 'issuer' parameter is null or whitespace

leedonhyun • Oct 31 '23

builder.Services.Configure(configServices.GetSection("OAuthOptions"));
-->
builder.Services.Configure(configServices.GetSection("OAuthOption"));

hebatps • Jan 17

i have same error, any update ?

Antonio Faletar • Oct 11 '23

@mohammedahmed , I see that you are using a local SQL server database. You didn't provide the db, right?

Mohammed Ahmed Hussien • Oct 11 '23

Yeah, you can run the migration script
Update-Database

Melchor • Nov 10 '23

How to change InMemory to a database the OAuthOption

kdudley21 • Jan 15

Where is the Update-Database migration script located ?

Juan Carlos Estrella • Sep 10 '23

How can I implement the cliente credentials flow?

Mohammed Ahmed Hussien • Sep 12 '23

Hey, now it's implemented, give it a try!

Juan Carlos Estrella • Sep 13 '23

Oh, nice, thanks

Mohammed Ahmed Hussien • Sep 10 '23

It's very easy, all you have to do is to call the token endpoint directly.

Jakub Pernica • Jun 13 '23

Do I understand it correctly that this doesn't implement generating the refresh_token and retrieving it? Are you planning on implementing it?

Mohammed Ahmed Hussien • Jun 29 '23

Hi, yeah there no refresh_token support at this time, but Im going to put it in my plan next month

Ahmed Anwar • Feb 24 '23

When we will get the next post

Mohammed Ahmed Hussien • Mar 6 '23

Stay tuned!

soure_repository • Feb 16 '23 • Edited

Hi, dear,
could i get the client app?

iBanafa • Oct 31 '22

i guess we're in business

Andile Shongwe • Jan 22

After receiving the access token I get the folowing error. Could you please assist?
DataError: The JWK "alg" member was inconsistent with that specified by the Web Crypto call.