Aspnetcore Authentication

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication(options =>{    options.DefaultScheme = "Cookies";    options.DefaultChallengeScheme = "oidc";}).AddCookie("Cookies", options =>{    options.Cookie.Name = "myapp";    options.Cookie.SameSite = SameSiteMode.Lax;    options.ExpireTimeSpan = TimeSpan.FromHours(8);    options.SlidingExpiration = true;}).AddOpenIdConnect("oidc", options =>{    options.Authority = "https://identity.example.com";    options.ClientId = "web.app";    options.ClientSecret = "secret";    options.ResponseType = "code"; // Authorization code flow
    // Map scopes to request    options.Scope.Clear();    options.Scope.Add("openid");    options.Scope.Add("profile");    options.Scope.Add("email");    options.Scope.Add("api1");    options.Scope.Add("offline_access"); // For refresh tokens
    // Save tokens in the authentication cookie    options.SaveTokens = true;
    // Disable Microsoft's JWT claim type mapping    options.MapInboundClaims = false;
    // Where to get additional user claims    options.GetClaimsFromUserInfoEndpoint = true;
    options.TokenValidationParameters = new TokenValidationParameters    {        NameClaimType = "name",        RoleClaimType = "role"    };});
var app = builder.Build();app.UseAuthentication();app.UseAuthorization();

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication("Bearer")    .AddJwtBearer("Bearer", options =>    {        options.Authority = "https://identity.example.com";        options.Audience = "catalog-api"; // Must match ApiResource name
        options.MapInboundClaims = false; // Must be included
        options.TokenValidationParameters = new TokenValidationParameters        {            ValidateAudience = true,            ValidAudience = "catalog-api",            NameClaimType = "name",            RoleClaimType = "role"        };    });
builder.Services.AddAuthorization();
var app = builder.Build();app.UseAuthentication();app.UseAuthorization();
// Protect endpointsapp.MapGet("/products", () => Results.Ok())    .RequireAuthorization();

options.TokenValidationParameters = new TokenValidationParameters{    ValidateAudience = true,    ValidAudiences = new[] { "catalog-api", "shared-api" }};

builder.Services.AddAuthentication("Bearer")    .AddOAuth2Introspection("Bearer", options =>    {        options.Authority = "https://identity.example.com";        options.ClientId = "catalog-api";        options.ClientSecret = "api-secret";    });

builder.Services.AddAuthentication("Bearer")    .AddJwtBearer("Bearer", options =>    {        options.Authority = "https://identity.example.com";        options.MapInboundClaims = false;
        // The Duende JWT handler can forward to introspection for reference tokens        options.ForwardDefaultSelector = Selector.ForwardReferenceToken("introspection");    })    .AddOAuth2Introspection("introspection", options =>    {        options.Authority = "https://identity.example.com";        options.ClientId = "catalog-api";        options.ClientSecret = "api-secret";    });

builder.Services.AddAuthentication(options =>{    // Used for [Authorize] attribute and User.Identity    options.DefaultScheme = "Cookies";
    // Used when authentication is required (401 → redirect to login)    options.DefaultChallengeScheme = "oidc";
    // Used when access is denied (403)    options.DefaultForbidScheme = "oidc";
    // Used when signing in (setting the cookie after OIDC callback)    options.DefaultSignInScheme = "Cookies";
    // Used when signing out    options.DefaultSignOutScheme = "oidc";});

// ✅ On the OIDC handleroptions.MapInboundClaims = false;
// ✅ On the JWT Bearer handleroptions.MapInboundClaims = false;
// ✅ Then tell ASP.NET Core which claims to use for Name and Roleoptions.TokenValidationParameters = new TokenValidationParameters{    NameClaimType = "name", // Strongly recommended to use "name"    RoleClaimType = "role"  // Strongly recommended to use "role"};

.AddOpenIdConnect("oidc", options =>{    // ... other options ...
    options.Events = new OpenIdConnectEvents    {        // Customize the authorize request (e.g., add acr_values)        OnRedirectToIdentityProvider = context =>        {            context.ProtocolMessage.AcrValues = "tenant:myorg";            return Task.CompletedTask;        },
        // Handle tokens after successful authentication        OnTokenValidated = context =>        {            // Add custom claims to the identity            var identity = context.Principal!.Identity as ClaimsIdentity;            identity?.AddClaim(new Claim("app_version", "2.0"));            return Task.CompletedTask;        },
        // Handle sign-out redirect        OnRedirectToIdentityProviderForSignOut = context =>        {            // Customize the logout redirect            return Task.CompletedTask;        },
        // Handle failures        OnRemoteFailure = context =>        {            context.HandleResponse();            context.Response.Redirect("/error?message=" +                Uri.EscapeDataString(context.Failure?.Message ?? "Unknown error"));            return Task.CompletedTask;        }    };});

// In a Razor Page or Controllerapp.MapGet("/logout", async (HttpContext ctx) =>{    // Signs out of both the cookie and IdentityServer    await ctx.SignOutAsync("Cookies");    await ctx.SignOutAsync("oidc");});

// In a controller or middlewarevar accessToken = await HttpContext.GetTokenAsync("access_token");var refreshToken = await HttpContext.GetTokenAsync("refresh_token");var idToken = await HttpContext.GetTokenAsync("id_token");var expiresAt = await HttpContext.GetTokenAsync("expires_at");
// Use the access token to call an APIhttpClient.SetBearerToken(accessToken);

var clientCert = X509CertificateLoader.LoadPkcs12(File.ReadAllBytes("client.p12"), "password");
.AddOpenIdConnect("oidc", options =>{    options.Authority = "https://identity.example.com";    options.ClientId = "mtls.client";    // no ClientSecret — the certificate authenticates the client    options.ResponseType = "code";    options.MapInboundClaims = false;    options.SaveTokens = true;
    options.BackchannelHttpHandler = new SocketsHttpHandler    {        SslOptions = new SslClientAuthenticationOptions        {            ClientCertificates = new X509CertificateCollection { clientCert }        }    };});

public sealed class MtlsConfigurationManager : IConfigurationManager<OpenIdConnectConfiguration>{    private readonly ConfigurationManager<OpenIdConnectConfiguration> _inner;
    public MtlsConfigurationManager(ConfigurationManager<OpenIdConnectConfiguration> inner)        => _inner = inner;
    public async Task<OpenIdConnectConfiguration> GetConfigurationAsync(CancellationToken ct)    {        var config = await _inner.GetConfigurationAsync(ct);
        if (config.AdditionalData.TryGetValue("mtls_endpoint_aliases", out var raw)            && raw is JsonElement aliases)        {            config.TokenEndpoint                      = aliases.GetProperty("token_endpoint").GetString();            config.IntrospectionEndpoint              = aliases.GetProperty("introspection_endpoint").GetString();            config.DeviceAuthorizationEndpoint        = aliases.GetProperty("device_authorization_endpoint").GetString();            // .NET 9+ auto-uses PAR when advertised — rewrite it too, or the handler            // pushes to the non-mTLS PAR endpoint and the certificate binding is lost            config.PushedAuthorizationRequestEndpoint = aliases.GetProperty("pushed_authorization_request_endpoint").GetString();            // revocation has no strongly-typed slot — keep the mTLS value in AdditionalData            config.AdditionalData["revocation_endpoint"] = aliases.GetProperty("revocation_endpoint").GetString();        }
        return config;    }
    public void RequestRefresh() => _inner.RequestRefresh();}
// Wire it onto the handler.AddOpenIdConnect("oidc", options =>{    // ... options from Step 1 ...    options.ConfigurationManager = new MtlsConfigurationManager(        new ConfigurationManager<OpenIdConnectConfiguration>(            $"{options.Authority}/.well-known/openid-configuration",            new OpenIdConnectConfigurationRetriever(),            new HttpDocumentRetriever { RequireHttps = true }));});

// ❌ WRONG — Claims have XML URIs, User.FindFirst("sub") returns null.AddOpenIdConnect("oidc", options =>{    options.Authority = "https://identity.example.com";    // MapInboundClaims defaults to true});
// ✅ CORRECT.AddOpenIdConnect("oidc", options =>{    options.Authority = "https://identity.example.com";    options.MapInboundClaims = false;});

// ❌ WRONG — Authorization middleware can't see the authenticated userapp.UseAuthorization();app.UseAuthentication(); // Too late!
// ✅ CORRECT — Authentication must come firstapp.UseAuthentication();app.UseAuthorization();

// ❌ WRONG — Default scopes (openid, profile) are already addedoptions.Scope.Add("openid");   // Duplicate!options.Scope.Add("profile");  // Duplicate!options.Scope.Add("api1");
// ✅ CORRECT — Clear defaults firstoptions.Scope.Clear();options.Scope.Add("openid");options.Scope.Add("profile");options.Scope.Add("api1");

// ✅ Solution 1: Use a server-side ITicketStore to move auth ticket out of the cookie.// Implement ITicketStore backed by IDistributedCache (e.g., Redis), then register it:builder.Services.AddStackExchangeRedisCache(options =>{    options.Configuration = "localhost:6379";});builder.Services.AddSingleton<ITicketStore, RedisTicketStore>(); // your ITicketStore impl
.AddCookie("Cookies", options =>{    // Wire the ITicketStore so the cookie only holds a session key, not the full ticket    options.SessionStore = app.Services.GetRequiredService<ITicketStore>();});// Note: ITicketStore is in Microsoft.AspNetCore.Authentication.Cookies namespace.// There is no built-in DistributedSessionStore class — you must implement ITicketStore.
// ✅ Solution 2: Filter claims stored in the cookie.AddOpenIdConnect("oidc", options =>{    options.ClaimActions.DeleteClaims("sid", "idp", "auth_time", "amr");});
// ✅ Solution 3: Use Duende IdentityServer server-side sessions

// ✅ Check SameSite settings.AddCookie("Cookies", options =>{    options.Cookie.SameSite = SameSiteMode.Lax; // Not Strict for OIDC callbacks    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;});