Securing Microservices in AspNetCore World(netcore5)

Explore ASP.NET Core microservices with a jobs API and MVC client. Users login or register to apply for jobs, with data flowing via messaging to the job applicant microservice.

Implement oauth2 and openid connect with identityserver4 to secure microservices, build a centralized authorization server with aspnetcore identity and entity framework, and deploy containerized apps with tye.

Identify tools and prerequisites for securing microservices in ASP.NET Core, including Visual Studio 2019, Docker Desktop, RabbitMQ messaging technology, and .NET 5 SDK, and reference a prior course.

Implement token-based security with a centralized authority that issues and validates tokens for authentication and authorization, enabling clients and web APIs across microservices.

Explore how OpenID Connect and OAuth 2.0 secure apps by unifying authentication and API access, with tokens from the authorization server for the resource owner, client, and resource server.

Explore client types in secured microservices, distinguishing confidential clients that store credentials on the server from public clients that run in the browser, such as JavaScript and mobile apps.

Explore essential OAuth2 and OpenID Connect end-points like /authorize, /token, /revocation, /userinfo, and /endsession, and compare authorization code with PKCE to the implicit flow.

Explore protocols for securing web APIs and applications, including OAuth2 and OpenID Connect, the IdentityServer4 library, endpoints, flows, actors, delegated authorization, and PKCE.

Analyze the jwt structure, header, payload, and signature encoded as base64url; header specifies token type; payload carries claims such as sub and admin; sign with secret or key pair.

Create a blank ASP.NET Core auth server, configure IdentityServer4 with in-memory resources and a client, add test users, and enable resource owner password and client credentials grants, later PKCE flow.

Demonstrate obtaining a token from an identity server using the resource owner password grant via postman, detailing client credentials, user credentials, and the bearer token with expires_in and openid scope.

Add identity server UI to the authorization server by integrating IdentityServer4 UI, configure MVC with views and controllers, and enable static files and routing to support login and logout flows.

Create a secured jobs api microservice with authorization to protect endpoints. Store jobs in a SQL Server database via Entity Framework Core and expose get all and get by id.

Designs and develops the jobsapi microservice, configuring appsettings and launchsettings for Kestrel server. Sets up mssql docker container, dependency injection, migrations, and seeding through tye.yaml and config classes.

Automate database migrations and seed data for the jobs API by calling Data.Initialise with the jobs context during startup.

Spin up the msr square server docker container using the tye tool to deploy the jobs api microservices, configure the database server, ports, and environment variables.

Link the authorization server and web api by registering api resources and scopes, attach scopes to clients, and protect the jobs api with bearer tokens and authentication.

Perform a client credentials grant flow to obtain a token from the authorization server via Postman, then access the protected jobs API with a bearer token and verify responses.

Inspect token claims to determine API authorization, validating the access token from the authorization server and comparing client credentials and password grant type to reveal additional claims.

Develop a confidential mvc web client that consumes the jobs api using a general http client, interface-driven, with json serialization and dependency injection.

Register dependencies in the DI container, inject the job service into the home controller, and fetch jobs from the Web API asynchronously to render them on the index page.

Test the jobs API by toggling the authorization attribute and observe that requests without an access token fail, while authorized calls succeed.

Implement authentication and authorization for mvc web client using the authorization code flow, directing to the authorization server with client id, redirect_uri, and nonce to obtain OpenID and profile scopes.

Explore the authorization code flow for securing a web client in ASP.NET Core, detailing steps from login and user consent to token exchange, token usage, and API validation.

Configure the authorization server to recognize the MVC web client using the authorization code flow with redirect URIs, identity resources, scopes, and a hashed secret, and enable consent for transparency.

Configure the MVC client for authorization code flow by wiring cookie authentication, OpenID Connect, and token storage in startup, noting PKCE will be enabled later and enforcing authorization on actions.

Test the MVC web client security by starting the authorization server, signing in as a test user, approving consent, and inspecting the resulting tokens, claims, and cookie properties.

this lecture explains securing the mvc web client with pkce, showing how code challenges and verifiers prevent authorization code theft and how to enable pkce in the client configuration.

Implement a new OAuth controller in the MVC client, add login and logout actions with redirects, toggle login/logout links in the layout, and enable automatic redirect to home after sign-out.

Configure OpenID Connect to retrieve and map additional claims, shown on the privacy page, without bloating the ID token; ensure sub remains the name identifier, and use claims for authorization.

Learn role-based authorization in an ASP.NET Core MVC app by adding a role claim, defining a roles identity resource and scope, and restricting the privacy page to the admin role.

Secure an MVC web client and Jobs API using the authorization code flow with PKCE, implementing scope-based access and role-based authorization across microservices.

Migrate identity server configuration from in-memory to a database using entity framework core, with two stores and startup migrations to seed clients, identity resources, API scopes, and API resources.

Move site users from memory to a database using ASP.NET Core Identity, create a custom user with first name, last name, and address, and seed admin and visitor roles.