Secure .Net Microservices with IdentityServer4 OAuth2,OpenID

Learn to build an Asp.Net Web API as an API resource in a microservice architecture, starting with a Movies API performing CRUD on in-memory relational data protected by Identity Server.

Open Visual Studio and create a new blank solution named SecureMicroservices, then add a project and prepare the application for development.

Create a movies api by scaffolding an api controller with actions using Entity Framework Core, wiring the movies api context and the connection string in startup to perform CRUD operations.

Configure an in-memory database for the entity framework core MoviesAPIContext to replace the real database, enabling quick testing and avoiding sql exceptions during movie retrieval.

Seed an in-memory database with entity framework core by updating the movie entity and creating a seed class and context, then seed initial data at startup via program.cs.

Test the movies API using Postman by performing get, post, put, and delete operations. Save the Postman collection for future testing.

Build Identity Server4 authentication microservices for a centralized, standalone authentication layer in a .NET core architecture, integrating the movies.api project and implementing OpenId Connect and OAuth2.

Create an IdentityServer4 ASP.NET web application from scratch by starting with an empty ASP.NET Core project, configuring launch settings, and running on port 5005.

Install the IdentityServer4 NuGet package and configure startup.cs with dependency injection and middleware to turn the app into an identity server, noting early configuration errors.

Configure IdentityServer4 with in-memory clients, resources, scopes, and test users, then run the server and verify the OpenID Connect discovery document and endpoints.

Explain how IdentityServer4 uses clients, API resources, API scopes, and test users with in-memory configurations and the role of identity resources and developer signing credentials.

Protect Movies.API resources with IdentityServer4 and JWT tokens using OAuth 2.0. Generate a JWT token via client_credentials and use it to secure Movies.API resources.

Learn how to obtain an access token from Identity Server using the client credentials grant type, configure a movie client, and test token responses via Postman.

Secure the movies API with jwt bearer token authentication by configuring AddAuthentication, token validation, and IdentityServer authority, then enable authentication and authorization middleware and apply the authorize attribute.

Demonstrates claim-based authentication with client ID restriction by inspecting user claims via an identity controller, obtaining bearer tokens, and enforcing a client ID policy in a .NET microservices API.

Build the MVC client application for consuming an API resource, the Movies.Client ASP.NET MVC project, and align its architecture to consume the protected Movies.API alongside Identity Server.

Create an ASP.NET Core MVC web client for the movies client microservice to consume a protected web API, configure HTTPS and port settings, and run the app.

Add a movie model class to the MVC client by creating it in the models folder, copying properties from the API project, and aligning the namespaces.

Refactor the movies client MVC app to consume the movies.api via a new API services layer. Implement IMovieApiService and MovieApiService with mock data and wire them in startup.

Learn to add an interactive IdentityServer4 UI for user credential entry within the authorization server, explore the architecture for client login operations, and set the stage for coding login experience.

Register MVC controllers and views, enable static files, and configure IdentityServer4 pipelines with routing and endpoints that map the home index to the default controller, including authorization middleware.

Update the identity server configuration by adding an interactive MVC client, define identity resources, and register test users to enable login via OpenID Connect with OpenID and profile scopes.

Integrate IdentityServer4 with the Movies.Client MVC app using OpenID Connect to authorize the movie page, redirect login to IdentityServer UI, and return a token to continue app operations.

Configure an OpenID Connect authentication layer for the movies mvc client, enabling login via IdentityServer and protecting the movies page with cookie-based authentication and OpenID Connect.

Protect the movies page by adding authorize to the movie controller and enforcing login via OpenID Connect with identity server, then run the app to retrieve and log the token.

Run a multi-project setup to discover OpenID Connect from an MVC client, opening the identity server login window and initiating the authorization flow, and review tokens and claims.

Add a logout button to the client layout, enabling sign out from identityserver4 via openid connect and cookie authentication, with the button shown only when the user is authenticated.

Consume protected Movie API resources from the Movies.Client project using HttpClientFactory, obtain a token from Identity Server with client credentials, and call the protected API validated by the server.

Obtain a token from the identity server using the identity model, then call the protected movies API with a bearer token and deserialize the response into a movie list.

Develop a delegating http handler to obtain a token from identity server with client credentials, attach it as a bearer token using http client factory, and call protected movies api.

Develop and integrate full crud operations for the movies api by consuming http calls with token authentication, extending the mvc app to create, update, delete, and get by id.

Learn how hybrid flow blends front-channel and back-channel token delivery in OpenId Connect, using authorization code, implicit, and hybrid flows via the authorization and token endpoints.

Implement hybrid flow in identity server to obtain a single token by combining OpenID Connect scopes, enabling the MVC interactive client to access Movie API resources with one token.

Refactor token retrieval to reuse the OpenID Connect token via IHttpContextAccessor, eliminating extra identity server requests and using GetTokenAsync to access the movies API and OpenID Connect token.

Log in with OpenID Connect on hybrid flow and extend claim-based authorization, verifying access tokens and client IDs to access the protected movies API.

Learn claim-based authorization with Identity Server to secure the Movies.Client MVC and Movies.API using OpenID Connect and OAuth, exploring hybrid flow and role-based access control.

Configure predefined test users with email and address claims in identity server to test authentication in secure .NET microservices, using Alice and Bob as example users.

Create role-based claims to enable role-based authorization by assigning Alice as user and Bob as admin, defining a role identity resource, and configuring client scopes to expose role claims.

Extend the identity server by adding a roles scope and mapping role claims to the MVC client for role-based authorization, and verify tokens via login and token inspection.

Develop an admin page that retrieves user info from identity server using an access token, maps claims to a view model, and renders them in a naive HTML view.

Develop an access denied page as an assignment for securing IdentityServer4-based microservices, implementing role-based access for unauthorized requests, and submit your GitHub link for review.