CODEWITHSUNDEEP
asp.net-coreoauth-2.0blazoropenid-connectblazor-server-side
ameya
ameya

Reputation: 1668

What is the correct way to host .well-known/openid-configuration?

I have a Blazor Server Project based on ASP.NET Core 5. I want to host my own openid-configuration discovery file. Since this file is served while running the OIDC workflow I want to verify what is the correct way to host this file. So far I have tried the following and only option 2 works.

  1. using wwwroot/.well-known

This involves hosting the openid-configuration file statically in the wwwroot folder of my blazor server project.

enter image description here

After this if I run he project and try to access the file using localhost:44382/.well-known/openid-configuration, the file is not served.

  1. Using Controllers

For this I just added a simple controller to my blazor project and specified .well-known/openid-configuration as a route for my anonymous controller HTTPGET action.

public class OidcConfigurationController : Controller
{      

    [HttpGet(".well-known/openid-configuration")]
    public JsonResult OpenIdConfiguration()
    {
        return Json(new Storage.Storables.Security.OIDC.Configuration());
    }   
}

Now if I run the project with Option 2 and try to reach the localhost:44382/.well-known/openid-configuration the configuration JSON is served correctly.

enter image description here

Is option 2 the correct way to serve the OpenId-Configuration using ASP.NET Core and Blazor server project ? Will it cause any issues if I publish the server (for e.g. to Azure)

Upvotes: 1

Views: 4030

Answers (1)

Just the benno
Just the benno

Reputation: 2601

The reason why your first method is not working is that you don't serve a static file in a way the static file extensions assume you do. You missing a file ending, otherwise, the request isn't recognized as a file.

That said, you can write your own middleware. Give the file a proper ending like .json. If the resources /.well-known/openid-configuration/ is requested, you change the requested path to /.well-known/openid-configuration.json and let the static file extension handle the rest.

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
            ...
          

            app.Use(async (context, next) =>
            {
                if (context.Request.Path == "/.well-known/openid-configuration")
                {
                    context.Request.Path = "/.well-known/openid-configuration.json";
                }
           
                await next();
            });

            app.UseStaticFiles();

            ...
}

For more information about writing a middleware have a look at the documentation https://learn.microsoft.com/en-us/aspnet/core/fundamentals/middleware/write

However, you ran into the problem - I guess - because mostly this document is generated on the fly based on the configuration of your open id connect server like IdentityServer. So, maybe there is away around the static file?

Upvotes: 3

Related Questions