Commit 86bb3341 authored by Eric Dieckman's avatar Eric Dieckman
Browse files

Add JWT bearer

parent a4b22751

src/api/Program.cs

+53 −11
Original line number Diff line number Diff line
@@ -10,6 +10,10 @@ using Cals.Visor.Application; 
using Cals.Visor.Application.Identity;

using Cals.Visor.Infrastructure;

using Hellang.Middleware.ProblemDetails;

using Microsoft.AspNetCore.Authentication.JwtBearer;

using Microsoft.AspNetCore.Authorization;

using Microsoft.IdentityModel.Tokens;

using Microsoft.OpenApi.Models;

using Quartz;



#pragma warning disable SA1005
@@ -19,17 +23,49 @@ var builder = WebApplication.CreateBuilder(args); 


ConfigureAzureKeyVault(builder);



//builder.Services

//    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)

//    .AddJwtBearer(options =>

builder.Services

    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)

    .AddJwtBearer(options =>

    {

        options.Authority = builder.Configuration["Jwt:Authority"];

        options.Audience = builder.Configuration["Jwt:Audience"];



        // Optional: enable automatic metadata refresh

        options.MetadataAddress = $"{options.Authority}/.well-known/openid-configuration";



        options.TokenValidationParameters = new TokenValidationParameters

        {

            ValidateAudience = true,

            ValidateIssuer = true

        };



        // Optional event logging for debugging

        options.Events = new JwtBearerEvents

        {

            OnAuthenticationFailed = context =>

            {

                Console.WriteLine($"JWT authentication failed: {context.Exception.Message}");

                return Task.CompletedTask;

            },

            OnTokenValidated = context =>

            {

                Console.WriteLine($"JWT token valid for: {context.Principal?.Identity?.Name}");

                return Task.CompletedTask;

            }

        };



        //options.Events = new JwtBearerEvents

        //{

//        options.Authority = "https://login.wisc.edu";

//        options.Audience = "cals_wra";

//        options.TokenValidationParameters = new TokenValidationParameters

        //    OnTokenValidated = context =>

        //    {

//            ValidateAudience = true,

//            ValidateIssuer = true

//        };

        //        ClaimsIdentity identity = (ClaimsIdentity)context.Principal!.Identity!;

        //        var token = context.SecurityToken.RawData;

        //        identity.AddClaim(new Claim("access_token", token));

        //        return Task.CompletedTask;

        //    }

        //}

    });



// Enable lowercase routes for controllers

builder.Services.AddRouting(options =>

{
@@ -54,6 +90,12 @@ builder.Services.AddCors(options => 
    });

});



// Global Authorization Policy

builder.Services.AddAuthorizationBuilder()

    // Global Authorization Policy

    .SetFallbackPolicy(new AuthorizationPolicyBuilder()

    .RequireAuthenticatedUser()

    .Build());



builder.Services.AddControllers();

src/api/appsettings.json

+9 −11
Original line number Diff line number Diff line
@@ -8,12 +8,15 @@ 
  "ConnectionStrings": {

    "visor": ""

  },

  "AppConfig": {

    "Branding": "CALS VISOR",

    "JWTSecret": "",

    "Groups": {

      "SysAdmin": "uw:domain:cals.wisc.edu:it:sysadmin"

    }

  "AllowedOrigins": [

    "http://localhost:5001",

    "http://localhost:5011",

    "https://visor.it.cals.wisc.edu",

    "https://staging.visor.it.cals.wisc.edu"

  ],

  "Jwt": {

    "Authority": "https://login.wisc.edu",

    "Audience": "https://login.wisc.edu"

  },

  "EmailSettings": {

    "MailServer": "smtp.wiscmail.wisc.edu",
@@ -22,11 +25,6 @@ 
    "Sender": "it_apps@cals.wisc.edu",

    "SysAdminEmail": "it_apps@cals.wisc.edu"

  },

  "APIClients": {

    "IdentityAPI": {

      "BaseUrl": ""

    }

  },

  "Azure": {

    "KeyVault": {

      "Endpoint": "",