04. PART 3 IdentityServer4 ASP.NET Core Identity

You can find the project here.

Test data

In order to start playing with the IdentityServer4, later on, we must populate test config and user data into our database tables. Without it, we can’t start using the IdentityServer4. Changes are pretty straight forward and require adding the seed data in code and adding a setting in appsettings. When seeding is enabled the application will start, create the database, run the migrations to create both IdentityServer4 and ASP.NET Core Identity tables and populate the test data for configuration (resources and clients) and user data (users and claims).

Add test configuration and users

I will continue with the “Quickstart” solution from the previous tutorial. Open the solution and navigate to the “Data” folder. Create a new subfolder called “Seed”. Add two new classes, “Config.cs” and “Users.cs”.

// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.


using IdentityServer4;
using IdentityServer4.Models;
using System.Collections.Generic;

namespace IdentityServer.Data.Seed
{
    public static class Config
    {
        public static IEnumerable<IdentityResource> GetIdentityResources()
        {
            return new List<IdentityResource>
            {
                new IdentityResources.OpenId(),
                new IdentityResources.Profile(),
            };
        }

        public static IEnumerable<ApiResource> GetApis()
        {
            return new List<ApiResource>
            {
                new ApiResource("web_api", "My Web API")
            };
        }

        public static IEnumerable<Client> GetClients()
        {
            return new List<Client>
            {
                new Client
                {
                    ClientId = "client",

                    // no interactive user, use the clientid/secret for authentication
                    AllowedGrantTypes = GrantTypes.ClientCredentials,

                    // secret for authentication
                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },

                    // scopes that client has access to
                    AllowedScopes = { "web_api" }
                },
                // resource owner password grant client
                new Client
                {
                    ClientId = "ro.client",
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,

                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },
                    AllowedScopes = { "web_api" }
                },
                // OpenID Connect hybrid flow client (MVC)
                new Client
                {
                    ClientId = "mvc",
                    ClientName = "MVC Client",
                    AllowedGrantTypes = GrantTypes.Hybrid,

                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },

                    RedirectUris           = { "http://localhost:5002/signin-oidc" },
                    PostLogoutRedirectUris = { "http://localhost:5002/signout-callback-oidc" },

                    AllowedScopes =
                    {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        "web_api"
                    },

                    AllowOfflineAccess = true
                },
                // JavaScript Client
                new Client
                {
                    ClientId = "js",
                    ClientName = "JavaScript Client",
                    AllowedGrantTypes = GrantTypes.Code,
                    RequirePkce = true,
                    RequireClientSecret = false,

                    RedirectUris =           { "http://localhost:5003/callback.html" },
                    PostLogoutRedirectUris = { "http://localhost:5003/index.html" },
                    AllowedCorsOrigins =     { "http://localhost:5003" },

                    AllowedScopes =
                    {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        "web_api"
                    }
                }
            };
        }
    }
}

“Users.cs” code:

// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.


using System;
using System.Linq;
using System.Security.Claims;
using IdentityModel;
using IdentityServer.Models;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;

namespace IdentityServer.Data.Seed
{
    public class Users
    {
        public static void EnsureSeedData(string connectionString)
        {
            var services = new ServiceCollection();
            services.AddDbContext<IdentityDbContext>(options =>
               options.UseSqlServer(connectionString));

            services.AddIdentity<ApplicationUser, IdentityRole>()
                .AddEntityFrameworkStores<IdentityDbContext>()
                .AddDefaultTokenProviders();

            using (var serviceProvider = services.BuildServiceProvider())
            {
                using (var scope = serviceProvider.GetRequiredService<IServiceScopeFactory>().CreateScope())
                {
                    var context = scope.ServiceProvider.GetService<IdentityDbContext>();
                    context.Database.Migrate();

                    var userMgr = scope.ServiceProvider.GetRequiredService<UserManager<ApplicationUser>>();
                    var alice = userMgr.FindByNameAsync("alice").Result;
                    if (alice == null)
                    {
                        alice = new ApplicationUser
                        {
                            UserName = "alice",
                            Email = "AliceSmith@email.com",
                            EmailConfirmed = true
                        };
                        var result = userMgr.CreateAsync(alice, "My long 123$ password").Result;
                        if (!result.Succeeded)
                        {
                            throw new Exception(result.Errors.First().Description);
                        }

                        result = userMgr.AddClaimsAsync(alice, new Claim[]{
                        new Claim(JwtClaimTypes.Name, "Alice Smith"),
                        new Claim(JwtClaimTypes.GivenName, "Alice"),
                        new Claim(JwtClaimTypes.FamilyName, "Smith"),
                        new Claim(JwtClaimTypes.Email, "AliceSmith@email.com"),
                        new Claim(JwtClaimTypes.EmailVerified, "true", ClaimValueTypes.Boolean),
                        new Claim(JwtClaimTypes.WebSite, "http://alice.com"),
                        new Claim(JwtClaimTypes.Address, @"{ 'street_address': 'One Hacker Way', 'locality': 'Heidelberg', 'postal_code': 69118, 'country': 'Germany' }", IdentityServer4.IdentityServerConstants.ClaimValueTypes.Json)
                    }).Result;
                        if (!result.Succeeded)
                        {
                            throw new Exception(result.Errors.First().Description);
                        }
                        Console.WriteLine("alice created");
                    }
                    else
                    {
                        Console.WriteLine("alice already exists");
                    }

                    var bob = userMgr.FindByNameAsync("bob").Result;
                    if (bob == null)
                    {
                        bob = new ApplicationUser
                        {
                            UserName = "bob",
                            Email = "BobSmith@email.com",
                            EmailConfirmed = true
                        };
                        var result = userMgr.CreateAsync(bob, "My long 123$ password").Result;
                        if (!result.Succeeded)
                        {
                            throw new Exception(result.Errors.First().Description);
                        }

                        result = userMgr.AddClaimsAsync(bob, new Claim[]{
                        new Claim(JwtClaimTypes.Name, "Bob Smith"),
                        new Claim(JwtClaimTypes.GivenName, "Bob"),
                        new Claim(JwtClaimTypes.FamilyName, "Smith"),
                        new Claim(JwtClaimTypes.Email, "BobSmith@email.com"),
                        new Claim(JwtClaimTypes.EmailVerified, "true", ClaimValueTypes.Boolean),
                        new Claim(JwtClaimTypes.WebSite, "http://bob.com"),
                        new Claim(JwtClaimTypes.Address, @"{ 'street_address': 'One Hacker Way', 'locality': 'Heidelberg', 'postal_code': 69118, 'country': 'Germany' }", IdentityServer4.IdentityServerConstants.ClaimValueTypes.Json),
                        new Claim("location", "somewhere")
                    }).Result;
                        if (!result.Succeeded)
                        {
                            throw new Exception(result.Errors.First().Description);
                        }
                        Console.WriteLine("bob created");
                    }
                    else
                    {
                        Console.WriteLine("bob already exists");
                    }
                }
            }
        }
    }
}

Modify appsettings.json

We will add new section to “appsettings.json” config file. “Seed” boolean value will enable or disable the data seeding process on application startup. Modify the “appsettings.json” like so:

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=(localdb)\\MSSQLLocalDB;Database=IdentityServerQuickstart;Trusted_Connection=True;MultipleActiveResultSets=true"
  },
  "Data": {
    "Seed": false
  }
}

Modify Startup.cs and Program.cs

We need to modify the startup process of the IdentityServer4 application to take seeding into consideration. What better place to do it than “Startup.cs” and “Program.cs”. In “Startup.cs” add the “InitializeDatabase” method like so:

private void InitializeDatabase(IApplicationBuilder app)
{
	using (var serviceScope = app.ApplicationServices.GetService<IServiceScopeFactory>().CreateScope())
	{
		serviceScope.ServiceProvider.GetRequiredService<PersistedGrantDbContext>().Database.Migrate();

		var context = serviceScope.ServiceProvider.GetRequiredService<ConfigurationDbContext>();
		context.Database.Migrate();
		if (!context.Clients.Any())
		{
			foreach (var client in Config.GetClients())
			{
				context.Clients.Add(client.ToEntity());
			}
			context.SaveChanges();
		}

		if (!context.IdentityResources.Any())
		{
			foreach (var resource in Config.GetIdentityResources())
			{
				context.IdentityResources.Add(resource.ToEntity());
			}
			context.SaveChanges();
		}

		if (!context.ApiResources.Any())
		{
			foreach (var resource in Config.GetApis())
			{
				context.ApiResources.Add(resource.ToEntity());
			}
			context.SaveChanges();
		}
	}
}

Now we need to modify the “Configure” method to invoke the “InitializeDatabase” method like so:

public void Configure(IApplicationBuilder app)
{
	// this will do the initial DB population
	bool seed = Configuration.GetSection("Data").GetValue<bool>("Seed");
	if (seed)
	{
		InitializeDatabase(app);
		throw new Exception("Seeding completed. Disable the seed flag in appsettings");
	}

	if (Environment.IsDevelopment())
	{
		app.UseDeveloperExceptionPage();
	}

	// uncomment if you want to support static files
	app.UseStaticFiles();

	app.UseIdentityServer();

	// uncomment, if you wan to add an MVC-based UI
	app.UseMvcWithDefaultRoute();
}

And last change for “Startup.cs” is to add the missing “using” directives

using System.Linq;
using IdentityServer.Data.Seed;
using IdentityServer4.EntityFramework.DbContexts;
using IdentityServer4.EntityFramework.Mappers;

In “Program.cs” we need to change the “Main” method like so:

public static void Main(string[] args)
{
	Console.Title = "IdentityServer4";

	var host = CreateWebHostBuilder(args).Build();

	var config = host.Services.GetRequiredService<IConfiguration>();
	bool seed = config.GetSection("Data").GetValue<bool>("Seed");
	if (seed)
	{
		var connectionString = config.GetConnectionString("DefaultConnection");
		Users.EnsureSeedData(connectionString);
	}

	host.Run();
}

And now add the missing “using” directives

using IdentityServer.Data.Seed;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;

Run the application to seed the data

Prior to running the IdentityServer4 with seeding enabled go ahead and drop the “IdentityServerQuickstart” database. Seeding will create the database, structure, and data.

Now enable the seeding in “appsettings.json” like so:

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=(localdb)\\MSSQLLocalDB;Database=IdentityServerQuickstart;Trusted_Connection=True;MultipleActiveResultSets=true"
  },
  "Data": {
    "Seed": true
  }
}

Run the IdentityServer4 and after a short while you should see an error like this:

The error message informs us that the seeding is completed and we need to disable seeding. Stop the IdentityServer4 and change “appsettings.json” like so:

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=(localdb)\\MSSQLLocalDB;Database=IdentityServerQuickstart;Trusted_Connection=True;MultipleActiveResultSets=true"
  },
  "Data": {
    "Seed": false
  }
}

Run the application to log in

Run the IdentityServer4 and navigate to http://localhost:5000/Account/Login

You should be able to login now with user “alice” and password “My long 123$ password”. After login, you should be redirected back to the IdentityServer4 home page with the name “Alice Smith” displayed in the upper left corner.

Explore the database

I encourage you to take a look at the “IdentityServerQuickstart” database. You will see it is re-created will all the tables, migrations and data. Explore the data in tables and compare it to data in “Users.cs” and “Config.cs” in the “Data/Seed” folder to learn how and where the data is stored. In the next tutorial we will take a look at the custom properties we can add to extend the “User” model.

You can find the project here.

Support

For direct assistance schedule a technical meeting with Ivan to talk about your requirements.
For a general overview of our services and a live demo schedule a meeting with Maja.