JWT Token Tokens with ASP.NET 3 Identifier

Question

Based on the wonderful example of Sean Luttin in https://stackoverflow.com/a/166268/2128/ , I was able to use this code to generate and consume carrier tokens. Minor changes were in getting the latest packages:

"dependencies": { "Microsoft.AspNet.Authentication.JwtBearer": "1.0.0-rc1-final", "AspNet.Security.OpenIdConnect.Server": "1.0.0-beta4" } 

Although the code is a great start, it is not a complete solution that fully integrates w / ASP.NET Identity. I changed the AuthorizationProvider class as follows:

 public override Task GrantResourceOwnerCredentials( GrantResourceOwnerCredentialsContext context) { var user = _userManager.FindByNameAsync(context.UserName).Result; if (user == null) { context.Rejected("The user name or password is incorrect."); } else { var signInManager = context.HttpContext.RequestServices .GetRequiredService<SignInManager<ApplicationUser>>(); if (signInManager.CanSignInAsync(user).Result && _userManager.CheckPasswordAsync(user, context.Password).Result) { var principal = signInManager.CreateUserPrincipalAsync(user).Result; //To avoid leaking confidential data, AspNet.Security.OpenIdConnect.Server //refuses to serialize the claims that don't explicitly specify a destination. foreach (var claim in principal.Claims) claim.WithDestination("token id_token"); context.Validated(principal); } else context.Rejected("The user name or password is incorrect."); } return Task.FromResult(0); } 

I am using CreateUserPrincipalAsync to create a ClaimsPrincipal for the Validated method. Is there a better way to integrate w / ASP.NET Identity?

Answer 1

Your implementation looks great, 3 minor notes:

• You should use async/await to avoid blocking .Result calls.
• You should consider using brute force countermeasures as required by the OAuth2 specification: https://tools.ietf.org/html/rfc6749#section-4.3.2 . This is something that you can easily do with Identity 3, as it offers built-in support for "locking."
• You must remember that this implementation will result in the serialization of all claims (even user claims) related to the user, which may include sensitive data.

The last two points are softened in OpenIddict (the whole new experimental OIDC server that uses AspNet.Security.OpenIdConnect.Server internally), so feel free to take a look at its default implementation: https://github.com/openiddict/core/blob/ dev / src / OpenIddict.Core / OpenIddictProvider.cs # L353 .