OpenIdConnect using okta widget #5763

14 Answer(s)

• 

  0

  maharatha created 6 years ago

  +1

  I have a madate to use Okta for authentication. @cmthomps can you share your code and also can you let me know how are you managing users and assigning them Tenants using Okta

  Save Cancel
• 

  0

  ismcagdas created 6 years ago

  Support Team

  Hi @cmthomps

  I think you need to configure your org’s Trusted Origins to include url of your AspNet Zero app, see https://developer.okta.com/code/javascript/okta_sign-in_widget#enabling-cross-origin-access

  Save Cancel
• 

  0

  cmthomps created 6 years ago

  Thanks @ismcagdas,

  Can I send you my source code to take a look at? I've set-up the cors stuff. It's literally driving me crazy. I have a test project that I am trying to use as a proof of concept. What is the best way to do that?

  Save Cancel
• 

  0

  ismcagdas created 6 years ago

  Support Team

  @cmthomps

  Just to be sure, have you configured it on okta side ?

  Save Cancel
• 

  0

  cmthomps created 6 years ago

  @ismcagdas - Yes, I've configured the application in Okta. I have an okta asp.net core example project that works. And, I have an AspNetZero proof of concept project that I have modified. I'm stuck at the moment.

  For the purposes of this proof of concept, I've modified the aspnetzero login page to render the Okta widget and I've modified the the account controller to handle the postback in the same way the okta example works.

  Save Cancel
• 

  0

  ismcagdas created 6 years ago

  Support Team

  Could you check this https://support.aspnetzero.com/QA/Questions/5773#answer-e8770448-1af0-3901-c258-39e98c3b7cd7 ?

  If it doesn't help, please send your project to [email protected] with the necessary information and we will check it for you.

  Thanks,

  Save Cancel
• 

  1

  cmthomps created 6 years ago

  I'm getting close.

  You're saying replace GetUserInfo in the method below with the method in the ticket you mentioned. The new method takes a "token" parameter. Where does that come from?

  private async Task<ExternalAuthUserInfo> GetExternalUserInfo(ExternalAuthenticateModel model)
          {
              var userInfo = await _externalAuthManager.GetUserInfo(model.AuthProvider, model.ProviderAccessCode);
              if (userInfo.ProviderKey != model.ProviderKey)
              {
                  throw new UserFriendlyException(L("CouldNotValidateExternalUser"));
              }
  
              return userInfo;
          }
  

  Save Cancel
• 

  0

  maharatha created 6 years ago

  @cmthomps I am currently trying to add custom claims to make the existing code work but I am struggling to get it right. If in the meantime you are able to use the custom code provided then let me know if it works.

  Save Cancel
• 

  0

  ismcagdas created 6 years ago

  Support Team

  Hi @cmthomps

  okta login page should redirect you back to ExternalAuthenticate action of TokenAuthController with the token parameter added to url.

  Save Cancel
• 

  2

  cmthomps created 6 years ago

  I finally figured this out. Just to be clear, I am replacing the default AspNetZero login experience with the Okta sign-in widget. (See screenshot). In addition to making changes to the login screen itself, I had to make the changes to the AuthConfigurer.cs and the AccountController.cs

  The change to the AccountController was basic. Just made a new method to handle the postback from the Okta Widget:

      [HttpPost]
      public ActionResult ExternalLoginOkta(string sessionToken = "")
      {
          string provider = "OpenIdConnect";
          var redirectUrl = Url.Action(
              "ExternalLoginCallback",
              "Account",
              new
              {
                  ReturnUrl = "/App",
                  authSchema = provider,
                  ss = ""
              });
  
          var properties = new AuthenticationProperties();
          //Note: the sessionToken is created by the Okta Widget and passed into this method.
          properties.Items.Add("sessionToken", sessionToken);
          properties.RedirectUri = redirectUrl;
  
          var challengeResponse = Challenge(properties, OktaDefaults.MvcAuthenticationScheme);
          return challengeResponse;
      }
  

  I had to do some surgery on the AuthConfigurer.cs class.  I added some event handler to OpenId to handle some apparent data either being in the incorrect place or missing from the data coming back from Okta.

      public static void Configure(IServiceCollection services, IConfiguration configuration)
      {
          var authenticationBuilder = services.AddAuthentication();
  
          //if (bool.Parse(configuration["Authentication:OpenId:IsEnabled"]))
          //{
          //    authenticationBuilder.AddOpenIdConnect(options =>
          //    {
          //        options.ClientId = configuration["Authentication:OpenId:ClientId"];
          //        options.Authority = configuration["Authentication:OpenId:Authority"];
          //        options.SignedOutRedirectUri = configuration["App:WebSiteRootAddress"] + "Account/Logout";
          //        options.ResponseType = OpenIdConnectResponseType.IdToken;
  
          //        var clientSecret = configuration["Authentication:OpenId:ClientSecret"];
          //        if (!clientSecret.IsNullOrEmpty())
          //        {
          //            options.ClientSecret = clientSecret;
          //        }
          //    });
          //}
  
          if (bool.Parse(configuration["Authentication:OpenId:IsEnabled"]))
          {
  
              authenticationBuilder.AddOpenIdConnect(oidcOptions =>
              {
  
  
  
                  oidcOptions.ClientId = configuration["Authentication:OpenId:ClientId"];
                  oidcOptions.Authority = configuration["Authentication:OpenId:Authority"];
                  oidcOptions.SignedOutRedirectUri = configuration["App:WebSiteRootAddress"] + "Account/Logout";
                  oidcOptions.ResponseType = OpenIdConnectResponseType.Code;
                  oidcOptions.GetClaimsFromUserInfoEndpoint = true;
  
  
                  oidcOptions.Scope.Add("openid");
                  oidcOptions.Scope.Add("profile");
                  oidcOptions.Scope.Add("email");
  
                  var clientSecret = configuration["Authentication:OpenId:ClientSecret"];
                  if (!clientSecret.IsNullOrEmpty())
                  {
                      oidcOptions.ClientSecret = clientSecret;
                  }
  
  
                  oidcOptions.Events = new OpenIdConnectEvents()
                  {
                      //TODO This was the trick to get the Okta widget to work.
                      OnRedirectToIdentityProvider = context =>
                      {
                          // Add Okta sessionToken to provide custom login
                          if (context.Properties.Items.TryGetValue("sessionToken", out var sessionToken))
                          {
                              if (!string.IsNullOrEmpty(sessionToken))
                              {
                                  context.ProtocolMessage.SetParameter("sessionToken", sessionToken);
                              }
                          }
                          return Task.CompletedTask;
                      },
                      //TODO This is the only way i can get OpenId to work.
                      OnTicketReceived = context =>
                      {
                          if(!context.Properties.Items.ContainsKey("LoginProvider"))
                          {
                              //For some reason, the LoginProvider isn't being returned when using the Okta Widget
                              context.Properties.Items.Add("LoginProvider", "OpenIdConnect");
                          }
                          // Get the ClaimsIdentity
                          var identity = context.Principal.Identity as ClaimsIdentity;
  
                          if (identity != null)
                          {
                              // Add the Name ClaimType. This is required if we want User.Identity.Name to actually return something!
                                  if (!context.Principal.HasClaim(c => c.Type == ClaimTypes.Name) &&
                                      identity.HasClaim(c => c.Type == "preferred_username"))
                                      identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, identity.FindFirst("preferred_username").Value));
  
  
  
                              // Check if token names are stored in Properties
                              if (context.Properties.Items.ContainsKey(".TokenNames"))
                              {
                                  // Token names a semicolon separated
                                  string[] tokenNames = context.Properties.Items[".TokenNames"].Split(';');
  
                                  // Add each token value as Claim
                                  foreach (var tokenName in tokenNames)
                                  {
                                      // Tokens are stored in a Dictionary with the Key ".Token.<token name>"
                                      string tokenValue = context.Properties.Items[$".Token.{tokenName}"];
                                      identity.AddClaim(new Claim(tokenName, tokenValue));
                                  }
                              }
  
                          }
  
                          return Task.CompletedTask;
                      }
                  };
              });
          }
  

  

  Save Cancel
• 

  0

  maharatha created 6 years ago

  Do you mind sharing the code changes you did in the angular side ?

  Save Cancel
• 

  0

  cmthomps created 6 years ago

  My project is .NET Core/jQuery. Sorry...

  Save Cancel
• 

  0

  maharatha created 6 years ago

  No problem, thank you for the response.

  Save Cancel
• 

  0

  ismcagdas created 6 years ago

  Support Team

  Thanks a million again @cmthomps for sharing this :)

  Save Cancel