Identity Server 4

When we want to configure the identity server, we can start from the quickstart template and make the changes there. This quickstart provides all the interactions that we need, and sometimes more then we need. But we need to inject our data and this usually comes from the database. You can get the quickstart fromRead more

Security should be an integral part of any development project. Each API request should come with some sort authentication credentials which must be validated on the server for each and every request. The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource ownerRead more

A scope is a role that defines access to various information or code sections. There are two kinds scopes and in Identity Server they are defined as : Identity Scopes Api Resource Scopes Scopes define the access information target for which that the client can request. When requesting an identity resource scope then you willRead more

Refresh tokens contain the information required to obtain a new access_token or Id Token They are subjected to strict storage requirements to ensure that they are not leaked Since they do not expires, you should consider revoking them if security issues arise You can get a refresh token if you are using the following flows:Read more

Flows The following diagrams describe the authorization flow based on the response_type and optionally the scope (if it includes the openid scope). The pictures and information are described in details in the following material: https://medium.com/@darutk/diagrams-of-all-the-openid-connect-flows-6968e3990660 response_type = code The request is an authorization code flow. If openid is included in the scope then an IDRead more

GrantTypes In Identity Server each client must define what it “grants”, what information does it allow, thus determining what flow is suitable for it. A Code type is an authorization flow, meaning that it allows an authorization code from the Authorization EndPoint, and an access token from the Token endpoint To assign a grant typeRead more

IdentityServer4 – Part 1 – The protocols Oauth 2.0 is an open standard authorization protocol that is being developed by IETF OAuth Working Group. The protocol defines (doesn’t implement) standardized methods to securely authorize web, mobile and desktop applications. OpenIDConnect – is a layer on top of Oauth2 which merely extends this protocol by addingRead more