Use bearer tokens in client applications

Use the ASP.NET Core Web API template to create a new project in Visual Studio, and configure the application URL in the launch profile. The example used here assumes that you configure the API with http://localhost:55600/ as the URL. Replace this URL with the URL you actually use in your own solution.

Add package references to the project:

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>netcoreapp2.1</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.App" />
  </ItemGroup>
</Project>

Configure the Startup class:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvcCore()
            .AddAuthorization()
            .AddJsonFormatters();

        services.AddAuthentication("Bearer")
            .AddJwtBearer("Bearer", options =>
            {
                options.Authority = "https://localhost:44356";
                options.RequireHttpsMetadata = false;

                options.Audience = "sitecore.profile.api";
            });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseAuthentication();
        app.UseMvc();
    }
}

The AddAuthentication method adds the authentication services and configures Bearer as the default scheme. The AddJwtBearer method adds the SI Server access token validation handler so that the authentication services can use it. The UseAuthentication method adds the authentication middleware to the pipeline, so that authentication is performed automatically for every call into the host.

Add a new controller to your API project:

[Route("[controller]")]
[Authorize]
public class IdentityController : ControllerBase
{
    [HttpGet]
    public IActionResult Get()
    {
        return new JsonResult(from c in User.Claims
            select new
            {
                c.Type,
                c.Value
            });
    }
}

Configure the application URL in the launch profile. The following example assumes that you have configured the MVC client with http://localhost:54567/ as the URL. Replace this URL with the URL you actually use in your own solution in the AllowedCorsOriginsGroup1 node in the SI server client configuration.

Add package references to the project:

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>netcoreapp2.1</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.All" Version="[2.1.3]" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Abstractions" Version="[2.1.1.0]" />
    <PackageReference Include="IdentityModel" Version="[3.8.0]" />
  </ItemGroup>
</Project>

In the ConfigureServices method in the Startup class of the MVC application, add support for cookies and OpenID Connect authentication:

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvc();

        services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = "oidc";
            })
            .AddCookie(options =>
            {
                options.ExpireTimeSpan = TimeSpan.FromMinutes(60);
                options.Cookie.Name = "mvcimplicit";
            })
            .AddOpenIdConnect("oidc", options =>
            {
                options.ClientId = "MvcClient";
                options.Authority = "https://localhost:44356";
                options.RequireHttpsMetadata = false;
                options.GetClaimsFromUserInfoEndpoint = true;
                options.ResponseType = "code token";

                options.Scope.Clear();
                options.Scope.Add("openid");
                options.Scope.Add("sitecore.profile");
                options.Scope.Add("offline_access");
                options.Scope.Add("sitecore.profile.api");

                options.SaveTokens = true;

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    NameClaimType = JwtClaimTypes.Name,
                    RoleClaimType = JwtClaimTypes.Role,
                };
            });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseDeveloperExceptionPage();
        app.UseStaticFiles();
        app.UseAuthentication();
        app.UseMvcWithDefaultRoute();
    }
}

The AddAuthentication method adds authentication services. A cookie is the primary way to authenticate a user because Cookies is specified as the DefaultScheme. Because the DefaultChallengeScheme is specified as oidc, when the user logs in, the OpenID Connect scheme has to be used.

The AddCookie method adds the handler that can process cookies.

The AddOpenIdConnect method configures the handler that performs the OpenID Connect protocol. The Authority property specifies that the SI server is trusted. You can identify this client with the ClientId property. The SignInScheme method issues a cookie, using the cookie handler, once the OpenID Connect protocol is complete. The SaveTokens method persists the tokens from SI server in the cookie (you need them later). Specify the ResponseType property as code token (this effectively means to use hybrid flow).

Call the UseAuthentication method in the Configure method to make sure that the authentication services execute for each request. You must add the authentication middleware before MVC in the pipeline.

To trigger the authentication handshake, add the [Authorize] attribute to the Home controller:

[Authorize]
public class Home : Controller
{
    private static readonly HttpClient HttpClient = new HttpClient();
 
    public async Task<IActionResult> Index()
    {
        string accessToken = await HttpContext.GetTokenAsync("access_token");
        string refreshToken = await HttpContext.GetTokenAsync("refresh_token");

        return Content($"Current user: <span id=\"UserIdentityName\">{User.Identity.Name ?? "anonymous"}</span><br/>" +
            $"<div>Access token: {accessToken}</div><br/>" +
            $"<div>Refresh token: {refreshToken}</div><br/>"
            , "text/html");
    }
}

If you now navigate to this controller in a browser, a redirect attempt is made to SI server and, if authentication is succesful, this page is shown:

Current user: sitecore\Admin
Access token: eyJhbG......L8A
Refresh token: 4cdf3b4d873a65135553afdf420a47dbc898ba0c1c0ece2407bbbf2bde02a68b

Add this action to the Home controller to call the API with a bearer token:

[Route("/callapi")]
    public async Task<IActionResult> CallApi()
    {
        string accessToken = await HttpContext.GetTokenAsync("access_token");

        var request = new HttpRequestMessage(HttpMethod.Get, "http://localhost:55600/identity");
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        HttpResponseMessage response = await HttpClient.SendAsync(request);

        if (response.StatusCode != HttpStatusCode.OK)
        {
            return Content(response.ToString());
        }

        return Content($"{await response.Content.ReadAsStringAsync()}");
    }

You obtain a bearer (access) token from the HttpContext with the GetTokenAsync method by passing the access_token argument. This is how you add the access token to the request header:

request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

Navigate to http://localhost:54567/callapi url. The answer will be like this:

[
{
"type": "nbf",
"value": "1543572239"
},
{
"type": "exp",
"value": "1543572359"
},
{
"type": "iss",
"value": "https://localhost:44356"
},
{
"type": "aud",
"value": "https://localhost:44356/resources"
},
{
"type": "aud",
"value": "sitecore.profile.api"
},
{
"type": "client_id",
"value": "MvcClient"
},
{
"type": "name",
"value": "sitecore\\Admin"
},
........

Add the following action to the home controller:

[Route("/exchange")]
public async Task<IActionResult> Exchange()
{
    var disco = await DiscoveryClient.GetAsync("https://localhost:44356");
    if (disco.IsError) throw new Exception(disco.Error);

    var tokenClient = new TokenClient(disco.TokenEndpoint, "MvcClient", "secret");
    var rt = await HttpContext.GetTokenAsync("refresh_token");
    var tokenResult = await tokenClient.RequestRefreshTokenAsync(rt);

    if (!tokenResult.IsError)
    {
        var expiresAt = (DateTime.UtcNow + TimeSpan.FromSeconds(tokenResult.ExpiresIn)).ToString("o", CultureInfo.InvariantCulture);

        var authService = HttpContext.RequestServices.GetRequiredService<IAuthenticationService>();
        AuthenticateResult authenticateResult = await authService.AuthenticateAsync(HttpContext, null);
        AuthenticationProperties properties = authenticateResult.Properties;

        properties.UpdateTokenValue(OpenIdConnectParameterNames.RefreshToken, tokenResult.RefreshToken);
        properties.UpdateTokenValue(OpenIdConnectParameterNames.AccessToken, tokenResult.AccessToken);
        properties.UpdateTokenValue(OpenIdConnectParameterNames.ExpiresIn, expiresAt);

        await authService.SignInAsync(HttpContext, null, authenticateResult.Principal, authenticateResult.Properties);

        return Redirect("/");
    }

    return BadRequest();
}

You use an instance of the TokenClient class to request new tokens from the SI server. You need to have a valid refresh token before this request. After a successful request (RequestRefreshTokenAsync), this refresh token is invalidated and you have to update refresh and access tokens in the cookie with new ones.

Call the AuthenticateAsync method to obtain authentication properties. The UpdateTokenValue method updates the tokens and also the expiration timestamp in the properties, and finally the SignInAsync method saves the authentication cookie.