I am working on an infrastructure project and I think I could use some guidance; I've poured over the docs and seem to be a bit lost. My project is set up as follows.
I have a server (API) that is connected to a MySQL database via EntityFramework. This server has an instance of IdentityServer4 as well as a number of consumable endpoints. Connecting to this server will be a desktop app and several mobile apps. These apps will connect to the server and authorize via a ResourceOwnerPassword grant. (This part seems to work.)
The part I'm confused about: I also have an MVC web server (Web) that should be able to access the same endpoints via AJAX/CORS. This server is a separate assembly and does not have the IdentityServer4 package. I would like to have a dedicated webpage (/login) that should allow the user to enter a username/password/Remember Me checkbox. The form should then submit a model to the client via a HttpPost request, which then will send the data to API which should authenticate against the database, and on success, issue an authorization cookie (Session/persistent based on RememberMe box) which Web can then consume to authorize the user and pull claims from. The cookie would also be used to access endpoints in API that require authentication.
Currently, I can use Postman to send a request to API which returns two cookies: idsrv.session, and .AspNetCore.Identity.Application.
Are there any issues with this infrastructure as I have envisioned it? How should I recognize and consume the cookie using Asp.NET Identity (i.e. so I can access User.Context from a Razor Page)
The following is from my Config file from Web:
public void ConfigureServices(IServiceCollection services) {
services.Configure<CookiePolicyOptions>(options => {
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
options.CheckConsentNeeded = context => false;
options.MinimumSameSitePolicy = SameSiteMode.None;
});
services.AddMvc()
.SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
services.AddAuthentication(o => {
o.DefaultScheme = "Cookies";
o.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", o => {
o.Authority = Configuration["Authority"];
o.RequireHttpsMetadata = false;
o.ClientId = Configuration["ClientId"];
o.ClientSecret = Configuration["ClientSecret"];
o.ResponseType = "code";
o.SaveTokens = true;
});
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env) {
if(env.IsDevelopment()) {
app.UseDeveloperExceptionPage();
}
else {
app.UseExceptionHandler("/Home/Error");
app.UseHsts();
}
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseAuthentication();
app.UseMvc(routes => {
routes.MapRoute(
name: "default",
template: "{controller=Home}/{action=Index}/{id?}");
});
}
