Duende Software Samples

This sample demonstrates how to implement an ASP.NET Core MVC client using the authorization_code grant type, which is the standard for interactive web applications.

Key capabilities demonstrated include:

• Configuring an MVC client to integrate with IdentityServer.
• Accessing access tokens within the ASP.NET Core authentication session.
• Making secure calls to a Web API using the retrieved tokens.
• Manually performing token refreshes.

This sample demonstrates how to implement back-channel logout notifications in an ASP.NET Core MVC client. It specifically covers:

• Implementing a dedicated back-channel notification endpoint to receive logout requests from IdentityServer.
• Leveraging events on the cookie handler (specifically OnValidatePrincipal) to invalidate the local user session when a logout notification is received.

This sample demonstrates how to implement an ASP.NET Core MVC client that utilizes JWT Profile for Client Authentication (JAR) and JWT-based authentication.

Key capabilities demonstrated include:

• Implementing signed authorize requests using ASP.NET Core extensibility points.
• Using JWT-based authentication to enable automatic token management.
• Configuring IdentityServer clients to share key material across both front-channel and back-channel communications.

The solution uses .NET Aspire to orchestrate three main components:

1. IdentityServerHost: Acts as the SAML 2.0 IdP. It uses AllowIdpInitiated = true for registered SPs and features a custom Razor Page "My Apps" portal. This portal uses IIdpInitiatedSsoService to trigger the SSO flow.
2. ServiceProvider: An ASP.NET Core Razor Pages application using Sustainsys.Saml2.AspNetCore2. It is configured via environment variables for entity ID, base URL, display name, and signing certificate. The sample runs two distinct instances: "HR Portal" and "Expense Tracker".
3. IdPInitiated.AppHost: The .NET Aspire orchestrator. It manages the lifecycle of the services and handles security by generating ephemeral self-signed certificates for each SP and passing the public keys to the IdP for signature validation.

This template provides a minimal setup for running React applications using Vite. It includes support for Hot Module Replacement (HMR) and pre-configured ESLint rules.

There are two official plugin options available for the build process:

1. @vitejs/plugin-react: Uses Babel for Fast Refresh.
2. @vitejs/plugin-react-swc: Uses SWC for Fast Refresh (typically faster compilation).",

The sample repository provides two distinct types of APIs to demonstrate different security scenarios with Duende IdentityServer:

1. SimpleApi: A basic API used by most samples. It is designed to accept any valid token issued by the sample IdentityServer. It typically includes an IdentityController that echoes back the claims contained within the token to the client for verification.

2. ResourceBasedApi: A more advanced API that implements the ApiResource concept from Duende IdentityServer. This API is used to demonstrate advanced security features such as:

   • Audience Validation: Ensuring the token was intended for this specific API.
   • Token Introspection: Validating the token against the IdentityServer to check its current status and metadata.

You can configure a client to automatically extend a user's server-side session whenever a refresh token is used. This is done by enabling CoordinateLifetimeWithUserSession in the client configuration (typically found in Clients.cs).

When this is enabled, as the client application refreshes its access token, the user's server-side session expiration is automatically extended.

// In Clients.cs
new Client
{
    // ... other client settings
    CoordinateLifetimeWithUserSession = true
};

You can configure a client to automatically extend a user's server-side session whenever a refresh token is used. This is achieved by setting CoordinateLifetimeWithUserSession to true in the client configuration (found in Clients.cs in this sample).

When this is enabled, as the client application refreshes its access token, the user's server-side session expiration is automatically extended.

// In Clients.cs
new Client
{
    // ... other settings
    CoordinateLifetimeWithUserSession = true
};