Which is the best way to use OKTA SSO, for my asp.net MVC web application(C#) and I need to integrate outlook to my web application where I need to access user address book(Outlook).
I am starting on a new web API and I want to use ASP.NET Core 3.0. I also want to authorize callers to my API using JWTs and Azure AD as the Identity Provider.
I have set up many ASP.NET Core 2.x web APIs using JWTs and Azure AD that have worked just fine, however, when I try the same methods using ASP.NET Core 3.0 I get a 401 every time I try to access the API.
In my ASP.NET Core 2.2 web API, in Startup.cs I have the following in the ConfigureServices method;
// Add Azure AD OAUTH2.0 Authentication Services
services.AddAuthentication(sharedOptions =>
{
sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddAzureAdBearer(options => Configuration.Bind("AzureAd", options));
And I have an AzureAd section in my appsettings.json file that have values for...
"AzureAd": {
"Instance": "https://login.microsoftonline.com/",
"Domain": "mydomain.com",
"TenantId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", //<-- Directory ID for mydomain.com
"ClientId": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" //<-- Application ID of web API as a registered application in mydomain.com domain
},
Then in Startup.cs --> Configure method, I have ...
app.UseAuthentication();
app.UseMvc();
And finally, I decorate my API controller with...
[Authorize]
And this all works just fine for ASP.NET Core 2.2.
However, after creating a new project for an ASP.NET Core 3.0 Web API, and trying to implement the same techniques, I always get an HTTP 401 status code.
I realize the ASP.NET Core 3.0 was just released and I have to assume that the issue is related to changes in the way Core 3.0 operates, but I am having difficulty finding a solution.
Update 10/2/19
I test my APIs using Postman. In Postman, I make a POST to Azure AD with the correct values needed to obtain the access token from Azure AD. I copy that valid token to the Authorization header in a GET request to my API.
If I set my API to ASP.NET Core 2.2 and run it, then test the API using Postman as described above, my API authorizes the request and returns the correct data in the GET request's response.
If I change the API to ASP.NET Core 3.0 and try it again, I always get an HTTP 401.
The issue has to be a difference between how ASP.NET Core 3.0 handles JWT authorization and how ASP.NET Core 2.2 does it.
I have an Angular 5 application which uses a REST API for its back-end process. And other is pure ASP.NET Core MVC application.
Both have their own AccountController. I have to make an integration in a way that the Angular application has to call the ASP.NET MVC application. When it calls the ASP.NET MVC application, it has to login to that application and returns the Razor page. From this point, user will access the ASP.NET MVC application.
Both the applications have their own databases. But the user details will be stored in both applications.
My question is, how to achieve this?
If any article or documentation is available, it would be helpful if you share it.
I'm trying to search for an answer since yesterday and until now no luck unfortunately.
We have a WebApi backend with frontEnd written in Angular2.
Authentication is created with the use of JWT Tokens.
So basically user makes a call to WebApi and obtains the Authentication token that stores some other info like Roles in Claims.
In the same project there are other things we'd like to include with very limited functionality so there is no need to separate them to another project like: small MVC app, HangFire, Elmah etc.
How can we authorize those apps ? Is it possible to use the JWT token obtained from WebApi ? If I understand correctly MVC and WebApi exist in different contexts.
where we can use MVC Turbine?how can we implement this with ASP.NET MVC?
Read all the information here:
working with MVC Turbine for asp.net MVC