Authorization and Authentication

[adamtrip]

I've been exploring .NET Aspire, focusing on its authorization and authentication aspects within the microservice architecture in the past few days. My background is in monolithic applications, so I'm adapting my knowledge to this new environment.

To implement authorization and authentication, I've modeled my codebase on the eShopLite sample, creating three projects in my solution:

1. AuthService
2. AuthService.Db
3. AuthService.DbManager

In both AuthService and AuthService.DbManager, I've configured services as follows:

builder.Services.AddIdentity<IdentityUser, IdentityRole>()
    .AddEntityFrameworkStores<AuthServiceDbContext>()
    .AddDefaultTokenProviders();

...

builder.Services.AddAuthentication();
builder.Services.AddAuthorization();

...

app.UseAuthentication();
app.UseAuthorization();

On AuthService.Db just the DbContext as per usual for Identity:

public class AuthServiceDbContext : IdentityDbContext<IdentityUser>
{
    public AuthServiceDbContext(DbContextOptions<AuthServiceDbContext> options)
        :base(options)
    {
        
    }
}

So my main question(s) are:

1. Service Linking: How do I effectively link authorization across all services? Should I generate a JWT Token and validate it in all projects using something like this?

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})

// Adding Jwt Bearer
.AddJwtBearer(options =>
{
    options.SaveToken = true;
    options.RequireHttpsMetadata = false;
    options.TokenValidationParameters = new TokenValidationParameters()
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidAudience = configuration["JWT:ValidAudience"],
        ValidIssuer = configuration["JWT:ValidIssuer"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["JWT:Secret"]))
    };
});

2. Aspire Features: Are there any specific features or upcoming updates in .NET Aspire that simplify this process?
3. Project Configuration: Is it standard practice to define AddIdentity, AddAuthorization, and AddAuthentication in each project within this microservices architecture?

Sorry for the long post but I'm quite new to the microservice architecture and .NET Aspire is being my door into this world.

Any feedback is appreciated and if you read this far, you're a legend.

Thanks in advance to all!

[nickna]

Bump
It'd be great to see a recommended pattern for identity with Aspire.

[davidfowl]

Aspire Features: Are there any specific features or upcoming updates in .NET Aspire that simplify this process?

There’s nothing aspire provides for auth out of the box to make it easier and it’s out of scope for the initial release.

There’s an issue for supporting a keycloak resource in the box but it unlikely to happen as nobody is driving it actively. It would be worth learn about

Project Configuration: Is it standard practice to define AddIdentity, AddAuthorization, and AddAuthentication in each project within this microservices architecture?

This is really an ASP.NET Core question, there’s no aspire involved here. You need to call these if you’re going to configure auth.

it might be worthwhile to do this eshop workshop based on aspire that we just taught. The 3rd module has an entire section on auth and setting up keycloak .

https://github.com/dotnet-presentations/eshop-app-workshop/tree/main/labs/3-Add-Identity

[HardikFefar]

Is there a way to add authentication or authorization to the aspire dashboard?
We want to restrict the users from accessing the dashboard publicly.

[rithinch]

@HardikFefar - did you get the aspire dashboard deployed into the production environment? if so, how?

The last I checked in the issues there wasn't a clean way to have the dashboard up and running in a separate container in the cloud for production metrics, not sure if its possible at this point in time. 🫤

[davidfowl]

It's being worked on. We'll expose support for configuring an OIDC server (which you need to have). No plan for local accounts as part of the initial release.

[HardikFefar]

Not in production as of now but we are planning to have it adapted in the existing architecture

[drewnoakes]

#3033 started this, and there's ongoing work in this area so keep an eye out over the next while. The dashboard's README.md explains the options available. Note that the details will change a little in the next weeks as we add more options and sanitize the options for consistency, but it should be enough to get started.