You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/library/authentication/index.md
+31-10Lines changed: 31 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title : "Authentication - JWT"
3
3
description: "Adds the integration with JWT using an available authentication middleware and system components to validate and grant the access tokens."
4
4
lead: ""
5
5
date: 2023-05-13T15:40:19+02:00
6
-
lastmod: 2024-11-17T00:00:00+02:00
6
+
lastmod: 2024-11-30T00:00:00+02:00
7
7
draft: false
8
8
images: []
9
9
menu:
@@ -166,10 +166,35 @@ The default section name for the JWT settings is `jwt`. The following options ar
166
166
-`certificate` - Certificate used to issue or just validate the tokens (including private key or just the public one).
167
167
-`algorithm` - The algorithm used to sign the tokens.
168
168
-`issuer` - A party signing the tokens.
169
+
-`issuerSigningKey` - A key used to sign the tokens.
170
+
-`validIssuer` - An issuer that can use the access tokens.
171
+
-`authority` - The URL of the OpenId provider.
172
+
-`audience` - An audience that can use the access tokens.
173
+
-`challenge` - The challenge used to authenticate the user.
174
+
-`metadataAddress` - The URL of the OpenId provider metadata.
175
+
-`saveToken` - If true then the token will be saved in the authentication properties.
176
+
-`saveSigninToken` - If true then the token will be saved in the sign-in properties.
177
+
-`requireAudience` - If true then the audience defined in validAudience will be required.
178
+
-`requireHttpsMetadata` - If true then the metadata address will be required to use HTTPS.
179
+
-`requireExpirationTime` - If true then the expiration time will be required.
180
+
-`requireSignedTokens` - If true then the tokens will be required to be signed.
181
+
-`expiryMinutes` - How long the token will remain valid.
169
182
-`secretKey` - A secret key used to create the access tokens (instead of using the certificate).
170
183
-`expiry` - How long the token will remain valid.
171
184
-`validateLifetime` - If true then the lifetime defined in expiryMinutes will be validated.
172
185
-`validAudience` - An audience that can use the access tokens.
186
+
-`validAudiences` - A list of audiences that can use the access tokens.
187
+
-`validIssuer` - An issuer that can use the access tokens.
188
+
-`validIssuers` - A list of issuers that can use the access tokens.
189
+
-`validateActor` - If true then the actor will be validated.
190
+
-`validateIssuer` - If true then the issuer defined in validIssuer will be validated.
191
+
-`validateTokenReplay` - If true then the token replay will be validated.
192
+
-`validateIssuerSigningKey` - If true then the issuer signing key will be validated.
193
+
-`refreshOnIssuerKeyNotFound` - If true then the issuer key will be refreshed.
194
+
-`includeErrorDetails` - If true then the error details will be included.
195
+
-`authenticationType` - The type of the authentication.
196
+
-`nameClaimType` - The type of the name claim.
197
+
-`roleClaimType` - The type of the role claim.
173
198
-`validateAudience` - If true then the audience defined in validAudience will be validated.
174
199
175
200
## Settings
@@ -180,14 +205,8 @@ Use the following settings in the `appsettings.json` file according to your need
180
205
"jwt": {
181
206
"enabled": true,
182
207
"allowAnonymousEndpoints": [
183
-
"/api/health",
184
-
"/api/health/ready",
185
-
"/api/health/live",
186
-
"/api/health/alive",
187
-
"/api/health/healthz",
188
-
"/api/health/healthz/ready",
189
-
"/api/health/healthz/live",
190
-
"/api/health/healthz/alive"
208
+
"/api/healthz",
209
+
"/api/alive"
191
210
],
192
211
"certificate": {
193
212
"location": "certs/localhost.pfx",
@@ -204,6 +223,7 @@ Use the following settings in the `appsettings.json` file according to your need
Extend `IServiceCollection` with `AddGenocs(builder.Configuration)` that will get register the required services.
30
+
The builder is the entrypoint for the application builder. You can use the `Genocs.Core` builder to setup the application.
31
31
32
-
This is what you need to do in the `Program.cs` file.
32
+
There are two ways to setup the builder:
33
33
34
-
```csharp
35
-
// Create a new WebApplication
36
-
varbuilder=WebApplication.CreateBuilder(args);
34
+
1. Extend `WebApplicationBuilder` with `UseGenocs()`
37
35
38
-
// Get the services
39
-
varservices=builder.Services;
36
+
This is what you need to do in the `Program.cs` file.
40
37
41
-
// Setup the builder
42
-
services.AddGenocs(builder.Configuration);
43
-
```
38
+
```csharp
39
+
// Create a new WebApplication
40
+
varbuilder=WebApplication.CreateBuilder(args);
41
+
42
+
builder.AddGenocs();
43
+
44
+
... // Add other services
45
+
```
46
+
47
+
Thisoptionwillallowyoutobeabletointegrate [MicrosoftAspire](https://learn.microsoft.com/en-us/dotnet/aspire/) effortlessly, as well as, you can add the following services:
0 commit comments