swagger oauth security definition

问题

On my current webapi project I have set a swagger oauth security definition with implicit flow and authorize url https://login.microsoftonline.com/ + tenant Id. The scopes are the same as in the github exapmle for the Swashbuckle.AspNetCore nuget , this is the link https://github.com/domaindrivendev/Swashbuckle.AspNetCore. But when i try to authenticate on swagger online editor, this one https://editor.swagger.io/, I can't get the token back and get a 404 exception. What do I need to set in my azure portal registered app to return a token back to the online swagger editor ?

回答1:

According to your description, I created my .Net Core 2.0 Web API application and created the AAD app on Azure Portal. The configuration under ConfigureServices would look like this:

services.AddAuthentication(options =>
{
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
// Configure the app to use Jwt Bearer Authentication
.AddJwtBearer(jwtOptions =>
{
    jwtOptions.Authority = string.Format(CultureInfo.InvariantCulture, "https://sts.windows.net/{0}/", Configuration["AzureAd:TenantId"]);
    jwtOptions.Audience = Configuration["AzureAd:WebApiApp:ClientId"];
});

For Swagger UI, I also created a new AAD app on Azure Portal and add permissions to access the Web API app as follows:

Then, I added the following code snippet for defining the OAuth2.0 scheme as follows:

// Define the OAuth2.0 scheme that's in use (i.e. Implicit Flow)
c.AddSecurityDefinition("oauth2", new OAuth2Scheme
{
    Type = "oauth2",
    Flow = "implicit",
    AuthorizationUrl = string.Format(CultureInfo.InvariantCulture, "https://login.microsoftonline.com/{0}/oauth2/authorize", Configuration["AzureAd:TenantId"]),
    Scopes = new Dictionary<string, string>
    {
        { "user_impersonation", "Access Bruce-WebAPI-NetCore" }
    }
});
// Enable operation filter based on AuthorizeAttribute
c.OperationFilter<SecurityRequirementsOperationFilter>();

And use the following code for initializing the middleware to serve swagger-ui.

// Enable middleware to serve swagger-ui (HTML, JS, CSS, etc.), specifying the Swagger JSON endpoint.
app.UseSwaggerUI(c =>
{
    c.SwaggerEndpoint("/swagger/v1/swagger.json", "My API V1");
    c.ConfigureOAuth2(
        Configuration["AzureAd:SwaggerApp:ClientId"],
        Configuration["AzureAd:SwaggerApp:ClientSecret"],
        Configuration["AzureAd:SwaggerApp:RedirectUri"], //http://localhost:30504/swagger/o2c.html
        "Bruce-WebAPI-NetCore-Swagger",
        additionalQueryStringParameters: new Dictionary<string, string>(){
            { "resource",Configuration["AzureAd:WebApiApp:ClientId"]}
    });
});

Test:

but it still returns AADSTS50001 Resource identifier is not provided

During my processing, I encountered the similar issue. At last, I found that the resource parameter is not specified. Then, I set the additionalQueryStringParameters parameter for ConfigureOAuth2. Here is my code sample WebAPI-Swagger-NetCore, you could refer to it.

Moreover, for adding access scopes to your resource application (Web API), you could follow the Adding access scopes to your resource application section under here. Also, my SecurityRequirementsOperationFilter did not assign the scope requirements to operations based on AuthorizeAttribute provided here. You could specific the supported scopes under AddSecurityDefinition, then for your controller or action you could mark it as [Authorize(AuthenticationSchemes = "Bearer", Policy = "{scope}")]. Details, you could follow this sample.

来源：https://stackoverflow.com/questions/48057672/swagger-oauth-security-definition

标签

azure

oauth-2.0

swagger