CODEWITHSUNDEEP
asp.netasp.net-coreidentityserver4
Randal Cunanan
Randal Cunanan

Reputation: 2529

Multiple Authentication Middlewares ASP.NET Core

I am relatively new to the concept of middlewares. I am aware that a middleware calls the next middleware when it completes.

I am trying to authenticate a request using either Google or my Identity Server. The user can login on my mobile app with google or a local account. However, I can't figure out how to use both authentication middlewares. If I pass the id_token for google, it passes on the first middleware (UseJwtBearerAuthentication) but fails on the second one (UseIdentityServerAuthentication). How can I make it so that it doesn't throw error when it actually passes on at least 1 authentication middleware? For example, if it passes on the first middleware, the second middleware is ignored?

app.UseJwtBearerAuthentication(new JwtBearerOptions()
{
    Authority = "https://accounts.google.com",
    Audience = "secret.apps.googleusercontent.com",
    TokenValidationParameters = new TokenValidationParameters()
    {
        ValidateAudience = true,
        ValidIssuer = "accounts.google.com"
    },
    RequireHttpsMetadata = false
});

app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
{
    Authority = "http://localhost:1000/",
    RequireHttpsMetadata = false,

    ScopeName = "MyApp.Api"
});

Upvotes: 3

Views: 6076

Answers (1)

adem caglin
adem caglin

Reputation: 24083

Normally, when an authentication middleware is failed(i don't mean throwing exception), this doesn't affect another successful authentication middleware. Probably your second middleware throws an exception(not a validation failure). First check error message and try to resolve it. If you can't, use AuthenticationFailed event to handle error. In this case your code should be something like below:

 app.UseJwtBearerAuthentication(new JwtBearerOptions()
 {
     // ...
     Events = new JwtBearerEvents()
     {
          OnAuthenticationFailed = async (context) =>
          {
              if (context.Exception is your exception)
              {
                   context.SkipToNextMiddleware();
              }
          }
     }
 });

However, for your scenerio i wouldn't choose your way. I would use only identity server endpoint. For signing with google you can configure identity server like below:

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
            AutomaticAuthenticate = false,
            AutomaticChallenge = false
        });

        app.UseGoogleAuthentication(new GoogleOptions
        {
            AuthenticationScheme = "Google",
            SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
            ClientId = "",
            ClientSecret = ""
        });

        app.UseIdentityServer();

Edit

It seems AuthenticationFailed event couldn't be used for IdentityServer4.AccessTokenValidation. I am not sure but if you will use identity server for only jwt token, you can use UseJwtBearerAuthentication for validation.

Upvotes: 6

Related Questions