MSDN Documentation

Configure ASP.NET Core IdentityServer

This section guides you through the essential configuration steps for ASP.NET Core IdentityServer. Proper configuration is crucial for enabling secure authentication and authorization within your applications.

Prerequisites

• A working ASP.NET Core project.
• IdentityServer4 NuGet package installed.

1. Add IdentityServer Services to the DI Container

In your Startup.cs (or Program.cs for .NET 6+ Minimal APIs), configure the IdentityServer services. This typically involves calling the AddIdentityServer() extension method.

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllersWithViews();

    services.AddIdentityServer()
        .AddInMemoryClients(Config.Clients) // Example: In-memory clients
        .AddInMemoryIdentityResources(Config.IdentityResources) // Example: In-memory identity resources
        .AddInMemoryApiScopes(Config.ApiScopes) // Example: In-memory API scopes
        .AddInMemoryApiResources(Config.ApiResources) // Example: In-memory API resources
        .AddAspNetIdentity<ApplicationUser>(); // If using ASP.NET Core Identity
        // .AddDeveloperSigningCredential(); // For development purposes
}
            

2. Configure the IdentityServer Middleware

In your Configure() method, ensure the IdentityServer middleware is correctly placed in the pipeline. It should typically be configured after the authentication middleware and before endpoints that require authorization.

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Home/Error");
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseStaticFiles();

    app.UseRouting();

    app.UseIdentityServer(); // Enable IdentityServer endpoints
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllerRoute(
            name: "default",
            pattern: "{controller=Home}/{action=Index}/{id?}");
    });
}
            

3. Define Clients, Resources, and Scopes

IdentityServer relies on the definition of clients (applications consuming your identity services) and resources (APIs and identity information). These are often defined in a separate configuration class, such as Config.cs.

Example Config.cs

using IdentityServer4.Models;
using System.Collections.Generic;

public static class Config
{
    public static IEnumerable<IdentityResource> IdentityResources =>
        new List<IdentityResource>
        {
            new IdentityResources.OpenId(),
            new IdentityResources.Profile(),
        };

    public static IEnumerable<ApiScope> ApiScopes =>
        new List<ApiScope>
        {
            new ApiScope("read", "Reads your data"),
            new ApiScope("write", "Writes your data")
        };

    public static IEnumerable<ApiResource> ApiResources =>
        new List<ApiResource>
        {
            new ApiResource("myapi", "My API")
            {
                Scopes = { "read", "write" },
                ApiSecrets = { new Secret("secret".Sha256()) }
            }
        };

    public static IEnumerable<Client> Clients =>
        new List<Client>
        {
            // Client for a JavaScript application
            new Client
            {
                ClientId = "js",
                ClientName = "JavaScript Client",
                AllowedGrantTypes = GrantTypes.Code,
                RedirectUris = { "http://localhost:5003/callback" },
                PostLogoutRedirectUris = { "http://localhost:5003/post-logout-callback" },
                AllowedCorsOrigins = { "http://localhost:5003" },

                AllowedScopes = { "openid", "profile", "api1" }
            }
        };
}
            

4. Configure HTTPS

IdentityServer requires HTTPS for secure communication. Ensure your development environment is configured for HTTPS (e.g., using Kestrel's default certificate).

Key Configuration Elements

• Clients: Define which applications are allowed to request tokens.
• Identity Resources: Define the user claims that can be requested (e.g., name, email).
• API Resources: Define the APIs that IdentityServer will protect.
• Scopes: Define the permissions that clients can request for APIs.

By following these steps, you establish a foundational configuration for your ASP.NET Core IdentityServer, enabling it to manage authentication and authorization effectively.