Here is what you can do to increase the security in your api services. In this article I will show the barebones needed to be set up to protect an Api using ClientCredentials grant type and IdentityServer4 ✨ IdentityServer project: This project has only 2 files: Startup.cs Program.cs This is a default generate project usingRead more
When we want to configure the identity server, we can start from the quickstart template and make the changes there. This quickstart provides all the interactions that we need, and sometimes more then we need. But we need to inject our data and this usually comes from the database. You can get the quickstart fromRead more
Security should be an integral part of any development project. Each API request should come with some sort authentication credentials which must be validated on the server for each and every request. The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource ownerRead more
A scope is a role that defines access to various information or code sections. There are two kinds scopes and in Identity Server they are defined as : Identity Scopes Api Resource Scopes Scopes define the access information target for which that the client can request. When requesting an identity resource scope then you willRead more
What are refresh tokens? Refresh tokens are means to grant an application access to a protected resource when the access token expires. Refresh tokens contain the information required to obtain a new access_token or Id Token They are subjected to strict storage requirements to ensure that they are not leaked Since they do not expires,Read more
Flows The following diagrams describe the authorization flow based on the response_type and optionally the scope (if it includes the openid scope). The pictures and information are described in details in the following material: https://medium.com/@darutk/diagrams-of-all-the-openid-connect-flows-6968e3990660 response_type = code The request is an authorization code flow. If openid is included in the scope then an IDRead more
GrantTypes Authorization flows (improperly called grants by various authors) represent cycles that are not directly managed by the framework but are a result of the use of the authorization endpoint and token endpoint. These flows are derived by 2 main factors: the response_type and the grant_type. The response_type targets the authorization endpoint, meaning that thatRead more
IdentityServer4 – Part 1 – The protocols Oauth 2.0 is an open standard authorization protocol that is being developed by IETF OAuth Working Group. The protocol defines (doesn’t implement) standardized methods to securely authorize web, mobile and desktop applications. OpenIDConnect – is a layer on top of Oauth2 which merely extends this protocol by addingRead more
