CODEWITHSUNDEEP
asp.net-web-apioauth-2.0swaggeropenid-connectswashbuckle
mbx-mbx
mbx-mbx

Reputation: 1775

Web API add openid scope to auth url for swagger/swashbuckle UI

We have a asp.net web api application which uses swagger/swashbuckle for it's api documentation. The api is secured by azure AD using oauth/openid-connect. The configuration for swagger is done in code:

        var oauthParams = new Dictionary<string, string>
        {
            { "resource", "https://blahblahblah/someId" }
        };

        GlobalConfiguration.Configuration
            .EnableSwagger(c =>
            {
                c.SingleApiVersion(Version, Name);
                c.UseFullTypeNameInSchemaIds();
                c.OAuth2("oauth2")
                    .Description("OAuth2 Implicit Grant")
                    .Flow("implicit")
                    .AuthorizationUrl(
                        "https://login.microsoftonline.com/te/ourtenant/ourcustompolicy/oauth2/authorize")
                    .TokenUrl(
                        "https://login.microsoftonline.com/te/ourtenant/ourcustompolicy/oauth2/token");
                c.OperationFilter<AssignOAuth2SecurityRequirements>();
            })
            .EnableSwaggerUi(c =>
            {
                c.EnableOAuth2Support(_applicationId, null, "http://localhost:49919/swagger/ui/o2c-html", "Swagger", " ", oauthParams);
                c.BooleanValues(new[] { "0", "1" });
                c.DisableValidator();
                c.DocExpansion(DocExpansion.List);
            });

When swashbuckle constructs the auth url for login, it automatically adds: &scope=

However I need this to be: &scope=openid

I have tried adding this:

        var oauthParams = new Dictionary<string, string>
        {
            { "resource", "https://blahblahblah/someId" },
            { "scope", "openid" }
        };

But this then adds:

&scope=&someotherparam=someothervalue&scope=openid

Any ideas how to add

&scope=openid

To the auth url that swashbuckle constructs?

Many thanks

Upvotes: 0

Views: 2161

Answers (1)

mbx-mbx
mbx-mbx

Reputation: 1775

So, found out what the issue was, the offending code can be found here:

https://github.com/swagger-api/swagger-ui/blob/2.x/dist/lib/swagger-oauth.js

These js files are from a git submodule that references the old version of the UI.

I can see on lines 154-158 we have this code:

url += '&redirect_uri=' + encodeURIComponent(redirectUrl);
url += '&realm=' + encodeURIComponent(realm);
url += '&client_id=' + encodeURIComponent(clientId);
url += '&scope=' + encodeURIComponent(scopes.join(scopeSeparator));
url += '&state=' + encodeURIComponent(state);

It basically adds scopes regardless of whether there are scopes or not. This means you cannot add scopes in the additionalQueryParams dictionary that gets sent into EnableOAuth2Support as you will get a url that contains 2 scope query params i.e.

&scope=&otherparam=otherparamvalue&scope=openid

A simple length check around the scopes would fix it.

I ended up removing swashbuckle from the web api project and added a different nuget package called swagger-net, found here:

https://www.nuget.org/packages/Swagger-Net/

This is actively maintained and it resolved the issue and uses a newer version of the swagger ui. The configuration remained exactly the same, the only thing you need to change is your reply url which is now:

http://your-url/swagger/ui/oauth2-redirect-html

Upvotes: 1

Related Questions