Grant type permissions limit the flows a client application is allowed to use.
-To add a custom flow permission, you can use the following pattern:
OpenIddictConstants.Permissions.Prefixes.GrantType + "custom_flow_name"
-In the following example, the postman application can only use the authorization code flow
while console is restricted to the password and refresh_token flows:
if (await manager.FindByClientIdAsync("postman") == null)
@@ -224,11 +224,11 @@ if (await manager.FindByClientIdAsync("console") == null)
options.IgnoreGrantTypePermissions();
});
Scope permissions limit the scopes (standard or custom) a client application is allowed to use.
-The
openidandoffline_accessscopes are special-cased by OpenIddict and don't require explicit permissions.
To add a custom scope permission, you can use the following pattern:
OpenIddictConstants.Permissions.Prefixes.Scope + "custom_scope_name"
-In the following sample, the angular client is allowed to request the address,
profile and marketing_api scopes: any other scope will result in an error being returned.
if (await manager.FindByClientIdAsync("angular") == null)
@@ -317,7 +317,7 @@ if (await manager.FindByClientIdAsync("console") == null)
Back to top
- Copyright © 2015-2017 Microsoft
Generated by DocFX
+ Generated by DocFX
// Startup.cs
public void ConfigureServices(IServiceCollection services)
@@ -209,7 +209,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerF
public class MyController : Controller
// Startup.cs
public void ConfigureServices(IServiceCollection services)
@@ -243,7 +243,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerF
//...
}
// Startup.cs
public void ConfigureServices(IServiceCollection services)
@@ -306,7 +306,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerF
app.UseAuthentication();
//...
}
-// Note: both OpenIddictValidationDefaults.AuthenticationScheme and JwtBearerDefaults.AuthenticationScheme are "Bearer"
//If you did not set the default authentication scheme then specify it here.
//If you get a 302 redirect to login page instead of a 401 Unauthorized then Cookie authentication is handling the request
@@ -315,7 +315,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerF
public class MyController : Controller
// Startup.cs
public void ConfigureServices(IServiceCollection services)
@@ -352,7 +352,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerF
// <EmbeddedResource Include="FolderName\certname.pfx" />
// </ItemGroup>
Remember, this is only needed if you have API endpoints that require token authorization. If your authorization server generates tokens that are only used by separate resource servers, then this is not needed.
// Startup.cs
@@ -385,7 +385,7 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerF
app.UseAuthentication();
//...
}
-// Startup.cs
public void ConfigureServices(IServiceCollection services)
@@ -408,7 +408,7 @@ public void ConfigureServices(IServiceCollection services)
};
});
}
-// Note: both OpenIddictValidationDefaults.AuthenticationScheme and JwtBearerDefaults.AuthenticationScheme are "Bearer"
//If you didn't set the default authentication scheme then specify it here.
//If you get a 302 redirect to login page instead of a 401 Unauthorized then Cookie authentication is handling the request
@@ -443,7 +443,7 @@ public class MyController : Controller
Back to top
- Copyright © 2015-2017 Microsoft
Generated by DocFX
+ Generated by DocFX
__EFMigrationsHistory
Version="2.0.0" />
</ItemGroup>
Then, open a new command line and add an initial migration using dotnet ef migrations add InitialMigration (but don't apply it!).
For that, simply update your .csproj file to point to the newest OpenIddict packages:
<ItemGroup>
<PackageReference Include="OpenIddict" Version="1.0.0-rc2-final" />
<PackageReference Include="OpenIddict.EntityFrameworkCore" Version="1.0.0-rc2-final" />
<PackageReference Include="OpenIddict.Mvc" Version="1.0.0-rc2-final" />
</ItemGroup>
-<ItemGroup>
<PackageReference Include="OpenIddict" Version="2.0.0-rc2-final" />
<PackageReference Include="OpenIddict.EntityFrameworkCore" Version="2.0.0-rc2-final" />
@@ -550,7 +550,7 @@ controlling and limiting the OAuth2/OpenID Connect features a client application
Back to top
- Copyright © 2015-2017 Microsoft
Generated by DocFX
+ Generated by DocFX
When using reference token format, authorization codes, access tokens and refresh tokens are stored as ciphertext in the database and a crypto-secure random identifier is returned to the client application.
-These are standard tokens verifiable by third parties, used by Azure Active Directory, Auth0, and other valid OAuth 2.0 service. They are signed by the authorization server but their contents are not encrypted so they can be read by anyone.
-id token type