Ticket #459 : Update documentation

habarthierry-hue · habarthierry-hue · commit 61910115b205 · 2023-03-20T22:42:22.000+01:00
diff --git a/README.md b/README.md
@@ -72,16 +72,16 @@ cd ..
 dotnet sln add ./src/IdServer/IdServer.csproj
 ```
 
-Run the `IdServer` project, it must listens on the url `http://localhost:5001`.
+Run the `IdServer` project, it must listens on the url `https://localhost:5001`.
 
 ```
 cd src/IdServer
-dotnet run --urls=http://localhost:5001
+dotnet run --urls=https://localhost:5001
 ```
 
 The IdentityServer is now ready to be used. 
 
-By default, there is one administrator account configured. It is possible to access to his profile by navigating to the url `http://localhost:5001` and authenticate with the following credentials :
+By default, there is one administrator account configured. It is possible to access to his profile by navigating to the url `https://localhost:5001/master` and authenticate with the following credentials :
 * Login : administrator
 * Password : password
 
diff --git a/docs/documentation/auditing/adminui.md b/docs/documentation/auditing/adminui.md
@@ -0,0 +1,26 @@
+# Auditing Screen
+
+In the Administration UI, there is one Auditing Screen.
+It can be used to monitor the events.
+
+![Monitoring](images/monitoring-1.png)
+
+Following events are present :
+* AuthorizationFailureEvent
+* AuthenticationSuccessEvent
+* ClientAuthenticationFailureEvent
+* ClientAuthenticationSuccessEvent
+* ClientRegisteredFailureEvent
+* ClientRegisteredSuccessEvent
+* ConsentGrantedEvent
+* ConsentRevokedEvent
+* TokenIntrospectionFailureEvent
+* TokenIntrospectionSuccessEvent
+* TokenIssuedFailureEvent
+* TokenIssuedSuccessEvent
+* TokenRevokedFailureEvent
+* TokenRevokedSuccessEvent
+* UserInfoFailureEvent
+* UserInfoSuccessEvent
+* UserLoginSuccessEvent
+* UserLogoutSuccessEvent
diff --git a/docs/documentation/auditing/images/monitoring-1.png b/docs/documentation/auditing/images/monitoring-1.png
diff --git a/docs/documentation/gettingstarted/images/IdentityServerWebsite-2.png b/docs/documentation/gettingstarted/images/IdentityServerWebsite-2.png
diff --git a/docs/documentation/gettingstarted/index.md b/docs/documentation/gettingstarted/index.md
@@ -49,16 +49,16 @@ cd ..
 dotnet sln add ./src/IdServer/IdServer.csproj
 ```
 
-Run the `IdServer` project, it must listens on the url `http://localhost:5001`.
+Run the `IdServer` project, it must listens on the url `https://localhost:5001`.
 
 ```
 cd src/IdServer
-dotnet run --urls=http://localhost:5001
+dotnet run --urls=https://localhost:5001
 ```
 
 The IdentityServer is now ready to be used. 
 
-By default, there is one administrator account configured. It is possible to access to his profile by navigating to the url `http://localhost:5001` and authenticate with the following credentials :
+By default, there is one administrator account configured. It is possible to access to his profile by navigating to the url `https://localhost:5001/master` and authenticate with the following credentials :
 * Login : administrator
 * Password : password
 
diff --git a/docs/documentation/idserver/confidentialclientciba.md b/docs/documentation/idserver/confidentialclientciba.md
@@ -0,0 +1,3 @@
+# Confidential Client uses CIBA
+
+TODO
diff --git a/docs/documentation/idserver/images/m2m-1.png b/docs/documentation/idserver/images/m2m-1.png
diff --git a/docs/documentation/idserver/images/protectserversideapp-1.png b/docs/documentation/idserver/images/protectserversideapp-1.png
diff --git a/docs/documentation/idserver/images/protectserversideapp-2.png b/docs/documentation/idserver/images/protectserversideapp-2.png
diff --git a/docs/documentation/idserver/images/realm-1.png b/docs/documentation/idserver/images/realm-1.png
diff --git a/docs/documentation/idserver/images/realm-2.png b/docs/documentation/idserver/images/realm-2.png
diff --git a/docs/documentation/idserver/images/spa-1.png b/docs/documentation/idserver/images/spa-1.png
diff --git a/docs/documentation/idserver/protectrestapi.md b/docs/documentation/idserver/protectrestapi.md
@@ -74,7 +74,7 @@ builder.Services.AddAuthentication(options =>
 })
     .AddJwtBearer(options =>
     {
-        options.Authority = "http://localhost:5001";
+        options.Authority = "https://localhost:5001/master";
         options.RequireHttpsMetadata = false;
         options.TokenValidationParameters = new TokenValidationParameters
         {
@@ -84,7 +84,7 @@ builder.Services.AddAuthentication(options =>
             },
             ValidIssuers = new List<string>
             {
-                "http://localhost:5001"
+                "https://localhost:5001/master"
             }
         };
     });
diff --git a/docs/documentation/idserver/protectserversideapp.md b/docs/documentation/idserver/protectserversideapp.md
@@ -66,7 +66,7 @@ builder.Services.AddAuthentication(options =>
     {
         options.SignInScheme = "Cookies";
         options.ResponseType = "code";
-        options.Authority = "http://localhost:5001";
+        options.Authority = "https://localhost:5001/master";
         options.RequireHttpsMetadata = false;
         options.ClientId = "protectedServersideApp";
         options.ClientSecret = "password";
diff --git a/docs/documentation/idserver/protectserversideappfapicompliant.md b/docs/documentation/idserver/protectserversideappfapicompliant.md
@@ -0,0 +1,3 @@
+# Protect server-side application compliant with FAPI using ASP.NET CORE
+
+TODO
diff --git a/docs/documentation/idserver/protectspa.md b/docs/documentation/idserver/protectspa.md
@@ -72,7 +72,7 @@ export class AppModule { }
 import { AuthConfig } from 'angular-oauth2-oidc';
 
 export const authCodeFlowConfig: AuthConfig = {
-  issuer: 'http://localhost:5001',
+  issuer: 'https://localhost:5001/master',
   redirectUri: window.location.origin,
   clientId: 'protectedSpa',
   responseType: 'code',
diff --git a/docs/documentation/idserver/realm.md b/docs/documentation/idserver/realm.md
@@ -0,0 +1,24 @@
+# Realm
+
+A Realm is a space where you can manage Clients, Scopes, Users, Identity Providers and Certificate Authorities.
+Realms are isolated from one another, but the same resource can be located in one or more Realm.
+
+By default, there is one configured `master` realm.
+
+In the Administration UI, a realm can easily be added. Click on `Active realm : master` and click on the button `Add realm`.
+
+![Realm Popup](images/realm-1.png)
+
+You will be redirected to a page, fill-in the form like this and click on the button `Add` to create a `test` realm.
+
+![Add Realm](images/realm-2.png)
+
+`test` realm is now ready to be used. there are two OPENID configurations endpoints :
+* master : [https://localhost:5001/master/.well-known/openid-configuration](https://localhost:5001/master/.well-known/openid-configuration).
+* test: [https://localhost:5001/test/.well-known/openid-configuration](https://localhost:5001/test/.well-known/openid-configuration).
+
+You can authenticate to both `realm` separately with the same `administrator` user.
+* Browse the URL [https://localhost:5001/master](https://localhost:5001/master), authenticate as an administrator : login : `administrator`, password : `password`.
+* Browse the URL [https://localhost:5001/test](https://localhost:5001/test), authenticate with the same credentials.
+
+The user has two active sessions in two different `realm`.
diff --git a/docs/documentation/idserver/requestingtoken.md b/docs/documentation/idserver/requestingtoken.md
@@ -70,7 +70,7 @@ using (var httpClient = new HttpClient())
         { "client_secret", "password" },
         { "scope", "read" }
     };
-    var tokenResponse = httpClient.PostAsync("http://localhost:5001/token", new FormUrlEncodedContent(form)).Result;
+    var tokenResponse = httpClient.PostAsync("https://localhost:5001/master/token", new FormUrlEncodedContent(form)).Result;
     var json = tokenResponse.Content.ReadAsStringAsync().Result;
     System.Console.WriteLine(json);
 }
diff --git a/docs/documentation/toc.yml b/docs/documentation/toc.yml
@@ -1,5 +1,7 @@
 - name: Getting Started
   href: gettingstarted/index.md
+- name: Realm
+  href: idserver/realm.md
 - name: Identity Server
   items:
    - name: Persistence
@@ -14,5 +16,15 @@
      href: idserver/protectrestapi.md
    - name: Requesting token
      href: idserver/requestingtoken.md
+   - name: FAPI
+     items:
+      - name: Protect Server-Side application compliant with FAPI using ASP.NET CORE
+        href: idserver/protectserversideappfapicompliant.md
+      - name: Confidential client use Back Channel Authentication (CIBA)
+        href: idserver/confidentialclientciba.md
+- name: Audit
+  items:
+   - name: Monitoring
+     href: auditing/adminui.md
 - name: Certifications
   href: certifications/index.md
diff --git a/samples/ProjectSPA/src/Website/ClientApp/src/app/auth-config.ts b/samples/ProjectSPA/src/Website/ClientApp/src/app/auth-config.ts
@@ -1,13 +1,10 @@
 import { AuthConfig } from 'angular-oauth2-oidc';
 
 export const authCodeFlowConfig: AuthConfig = {
-  issuer: 'http://localhost:5001/master',
+  issuer: 'https://localhost:5001/master',
   redirectUri: window.location.origin,
-  silentRefreshRedirectUri: window.location.origin + '/silent-refresh.html',
   clientId: 'protectedSpa',
   responseType: 'code',
   scope: 'openid profile',
-  showDebugInformation: true,
-  strictDiscoveryDocumentValidation: false,
-  sessionChecksEnabled: true,
+  showDebugInformation: true
 };
diff --git a/samples/ProtectRESTApiJWT/src/ShopApi/Program.cs b/samples/ProtectRESTApiJWT/src/ShopApi/Program.cs
@@ -16,7 +16,7 @@
 })
     .AddJwtBearer(options =>
     {
-        options.Authority = "http://localhost:5001/master";
+        options.Authority = "https://localhost:5001/master";
         options.RequireHttpsMetadata = false;
         options.TokenValidationParameters = new TokenValidationParameters
         {
@@ -26,7 +26,7 @@
             },
             ValidIssuers = new List<string>
             {
-                "http://localhost:5001/master"
+                "https://localhost:5001/master"
             }
         };
     });
diff --git a/samples/ProtectWebsiteServerside/src/Website/Program.cs b/samples/ProtectWebsiteServerside/src/Website/Program.cs
@@ -15,7 +15,7 @@
     {
         options.SignInScheme = "Cookies";
         options.ResponseType = "code";
-        options.Authority = "http://localhost:5001/master";
+        options.Authority = "https://localhost:5001/master";
         options.RequireHttpsMetadata = false;
         options.ClientId = "protectedServersideApp";
         options.ClientSecret = "password";
diff --git a/samples/RequestAccessTokenM2M/src/ConsoleApp/Program.cs b/samples/RequestAccessTokenM2M/src/ConsoleApp/Program.cs
@@ -7,7 +7,7 @@
         { "client_secret", "password" },
         { "scope", "read" }
     };
-    var tokenResponse = httpClient.PostAsync("http://localhost:5001/master/token", new FormUrlEncodedContent(form)).Result;
+    var tokenResponse = httpClient.PostAsync("https://localhost:5001/master/token", new FormUrlEncodedContent(form)).Result;
     var json = tokenResponse.Content.ReadAsStringAsync().Result;
     System.Console.WriteLine(json);
 }
diff --git a/src/IdServer/SimpleIdServer.IdServer/Api/Authorization/ResponseModes/FormPostJwtResponseModeHandler.cs b/src/IdServer/SimpleIdServer.IdServer/Api/Authorization/ResponseModes/FormPostJwtResponseModeHandler.cs
@@ -28,7 +28,7 @@ public void Handle(HandlerContext context, RedirectURLAuthorizationResponse auth
             {
                 { AuthorizationResponseParameters.RedirectUrl, authorizationResponse.RedirectUrl }
             };
-            var issuer = context.GetIssuer();
+            var issuer = context.Request.IssuerName;
             var redirectUrl = $"{issuer}/{Constants.EndPoints.Form}{queryBuilder.ToQueryString()}";
             httpContext.Response.Redirect(redirectUrl);
         }
diff --git a/src/IdServer/SimpleIdServer.IdServer/Api/Authorization/ResponseModes/FormPostResponseModeHandler.cs b/src/IdServer/SimpleIdServer.IdServer/Api/Authorization/ResponseModes/FormPostResponseModeHandler.cs
@@ -19,7 +19,7 @@ public void Handle(HandlerContext context, RedirectURLAuthorizationResponse auth
             {
                 { "redirect_url", authorizationResponse.RedirectUrl }
             };
-            var issuer = context.GetIssuer();
+            var issuer = context.Request.IssuerName;
             var redirectUrl = $"{issuer}/{Constants.EndPoints.Form}{queryBuilder.ToQueryString()}";
             httpContext.Response.Redirect(redirectUrl);            
         }

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+# Confidential Client uses CIBA`
	`2`	`+`
	`3`	`+TODO`