JN.Authentication 1.2.0


     Simple Authentication implementation for ASP.NET Core.

     - Basic Authentication Scheme
     - API Key Custom Authentication Scheme
   

Install-Package JN.Authentication -Version 1.2.0
dotnet add package JN.Authentication --version 1.2.0
<PackageReference Include="JN.Authentication" Version="1.2.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add JN.Authentication --version 1.2.0
The NuGet Team does not provide support for this client. Please contact its maintainers for support.

JN.Authentication

Simple Authentication implementation for ASP.NET Core.

  • Basic Authentication Scheme
  • API Key Custom Authentication Scheme

Install

Download the package from NuGet:

Install-Package JN.Authentication

Usage

First, you must add one (or both) authentication scheme to the application pipeline:

public void ConfigureServices(IServiceCollection services)
{
    // Basic authentication 
    services.AddAuthentication(BasicAuthenticationDefaults.AuthenticationScheme)
      .AddBasic(options =>
      {
          options.Realm = "api";
          options.LogInformation = true; //optional, default is false;
          options.HttpPostMethodOnly = false;
          options.HeaderEncoding = Encoding.UTF8; //optional, default is UTF8;
          options.ChallengeResponse = ValidationService.ChallengeResponse;
      });

    // validation service
    services.AddSingleton<IBasicValidationService, BasicValidationService>();

    // ApiKey authentication
    services.AddAuthentication(ApiKeyAuthenticationDefaults.AuthenticationScheme)
      .AddApiKey(options =>
      {
          options.LogInformation = true;
          options.HttpPostMethodOnly = false;
          options.AcceptsQueryString = true;
          options.HeaderName = "ApiKey";
          options.ChallengeResponse = ValidationService.ChallengeResponse;
      });

    // validation service
    services.AddSingleton<IApiKeyValidationService, ApiKeyValidationService>();

}

ChallengeResponse is a delegate called before a 401 response is sent to the client. It can be used to change the response. You can see an example here.

IBasicValidationService and IApiKeyValidationService should have an implementation where the access details are validated (for example by querying a database).

An implementation for ValidateUser of interface IBasicValidationService could be something like the following:

public async Task<ValidationResult> ValidateUser(string username, string password, string resourceName)
{
    var user = await GetFromDB(username, password, resourceName);

    if (user != null)
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.GivenName, user.FullName),
            new Claim(ClaimTypes.Name, username),
            new Claim(ClaimTypes.Email, user.Email),
            new Claim("IsAdmin", user.IsAdmin),
            new Claim(ClaimTypes.Role, user.Roles)
        };

        var res = new ValidationResult
        {
            Success = true,
            Claims = claims
        };

        return res;
    }

    return new ValidationResult
    {
        Success = false,
        ErrorDescription = "Invalid User",
        ErrorCode = -1
    };
}

On your controllers add the Authorize atribute and choose the Authentication Scheme ("Basic" or "ApiKey")

[Route("api/[controller]")]
[Authorize(AuthenticationSchemes = "Basic", Policy = "IsAdminPolicy")]
[ApiController]

public class BasicAuthSchemeTestController : ControllerBase
{
   // Your code here
}

Options

Both authentication schemes allows to:

  • LogInformation: log information using a logging provider
  • HttpPostMethodOnly: allows only POST requests

Basic allows to specify a Realm and HeaderEncoding.

ApiKey authentication allows to change the HeaderName (default is "ApiKey") and can also accept the key in the query string (AcceptsQueryString)

JN.Authentication

Simple Authentication implementation for ASP.NET Core.

  • Basic Authentication Scheme
  • API Key Custom Authentication Scheme

Install

Download the package from NuGet:

Install-Package JN.Authentication

Usage

First, you must add one (or both) authentication scheme to the application pipeline:

public void ConfigureServices(IServiceCollection services)
{
    // Basic authentication 
    services.AddAuthentication(BasicAuthenticationDefaults.AuthenticationScheme)
      .AddBasic(options =>
      {
          options.Realm = "api";
          options.LogInformation = true; //optional, default is false;
          options.HttpPostMethodOnly = false;
          options.HeaderEncoding = Encoding.UTF8; //optional, default is UTF8;
          options.ChallengeResponse = ValidationService.ChallengeResponse;
      });

    // validation service
    services.AddSingleton<IBasicValidationService, BasicValidationService>();

    // ApiKey authentication
    services.AddAuthentication(ApiKeyAuthenticationDefaults.AuthenticationScheme)
      .AddApiKey(options =>
      {
          options.LogInformation = true;
          options.HttpPostMethodOnly = false;
          options.AcceptsQueryString = true;
          options.HeaderName = "ApiKey";
          options.ChallengeResponse = ValidationService.ChallengeResponse;
      });

    // validation service
    services.AddSingleton<IApiKeyValidationService, ApiKeyValidationService>();

}

ChallengeResponse is a delegate called before a 401 response is sent to the client. It can be used to change the response. You can see an example here.

IBasicValidationService and IApiKeyValidationService should have an implementation where the access details are validated (for example by querying a database).

An implementation for ValidateUser of interface IBasicValidationService could be something like the following:

public async Task<ValidationResult> ValidateUser(string username, string password, string resourceName)
{
    var user = await GetFromDB(username, password, resourceName);

    if (user != null)
    {
        var claims = new[]
        {
            new Claim(ClaimTypes.GivenName, user.FullName),
            new Claim(ClaimTypes.Name, username),
            new Claim(ClaimTypes.Email, user.Email),
            new Claim("IsAdmin", user.IsAdmin),
            new Claim(ClaimTypes.Role, user.Roles)
        };

        var res = new ValidationResult
        {
            Success = true,
            Claims = claims
        };

        return res;
    }

    return new ValidationResult
    {
        Success = false,
        ErrorDescription = "Invalid User",
        ErrorCode = -1
    };
}

On your controllers add the Authorize atribute and choose the Authentication Scheme ("Basic" or "ApiKey")

[Route("api/[controller]")]
[Authorize(AuthenticationSchemes = "Basic", Policy = "IsAdminPolicy")]
[ApiController]

public class BasicAuthSchemeTestController : ControllerBase
{
   // Your code here
}

Options

Both authentication schemes allows to:

  • LogInformation: log information using a logging provider
  • HttpPostMethodOnly: allows only POST requests

Basic allows to specify a Realm and HeaderEncoding.

ApiKey authentication allows to change the HeaderName (default is "ApiKey") and can also accept the key in the query string (AcceptsQueryString)

Release Notes


     Changes v1.2.0:

     - minor updates in logging error messages
     - added validation interfaces to use with DI
     - updated tests
   

GitHub repositories

This package is not used by any popular GitHub repositories.

Version History

Version Downloads Last updated
1.2.0 92 3/11/2020
1.0.1 178 3/24/2019
1.0.0 155 3/24/2019