KeycloakAuth 1.0.44-alpha-gc43f7ab31f

What is this?

KeycloakAuth is a package that provides AICORE authentication services to ASP.NET APIs.

How to use

Add this like to program.cs before builder.Build():

builder.Services.AddAICOREAuthentication();

And this line before app.Run():

app.UseAICOREAuthentication();

And add a block in appsettings somewhere like this with the auth server URL and list of valid realms:

"KeycloakSetting": {
    "AuthServerUrl": "https://auth.aicore.ca/",
    "CustomerRootUrl": "https://aicoreio.coredata.ca/Customer/CustomerManager/GetCustomerRoot",
    "KeycloakRealmList": [ "coredata", "imeccore", "medlior" ]
}

(CustomerRootURL is only necessary when using AuthUtilService)

By default, this will apply mandatory authentication to every controller, meaning that all endpoints will require a valid Bearer token to be provided in the Authorization header in order to be called. To restrict endpoints to only users with certain realm roles, create a policy section somewhere in appsettings:

"AuthorizationPolicies": [
    {
        "Policy": "FileRead",
        "Roles": [
            {
                "RequireRealmRole": [ "file_read" ]
            }
        ]
    },
    {
        "Policy": "FileReadWrite",
        "Roles": [
            {
                "RequireRealmRole": [ "file_read" ]
            },
            {
                "RequireRealmRole": [ "file_write" ]
            }
        ]
    }
]

And then use the policy in a decorator on any endpoint like this:

[Route("Upload")]
[HttpPost]
[AuthService("FileReadWrite")]
public async Task<IActionResult> Upload(IFormFile UploadedFile, IFormCollection data) { ... }

To completely remove the authentication from an endpoint:

[Unauthenticated]
[HttpGet]
[Route("schema/{*path}")]
public async Task<IActionResult> GetSchema(string path) { ... }

!! NOTE !! Please keep in mind that a policy like this:

{
    "Policy": "FileReadOrWrite",
    "Roles": [
        {
            "RequireRealmRole": [ "file_read", "file_write" ]
        }
    ]
}

Will allow a user through if they have either file_read OR file_write.

AuthUtilService

AuthUtilService can be scope-injected into any class where an HTTP context is present:

public FilesController(ILogger<FilesController> logger, IConfiguration configuration, IHostEnvironment env, AuthUtilService auth_util)
{
    _logger = logger;
    Configuration = configuration;
    environment = env;
    _auth_util = auth_util;
}

And is then used for these functions:

_auth_util.CanWriteToFile(path) - Returns true if the authenticated user is allowed to write to a given path, file does not need to exist yet

_auth_util.CanReadFromFile(path) - Returns true if the authenticated user is allowed to read from a given path