Skip to content

Commit 7647be8

Browse files
maartenbamaartenba
authored
Merge pull request #721 from DuendeSoftware/mb/googleauth
Microsoft.AspnetCore.Authentication.Google -> Use demo.duendesoftware.com
2 parents b0f651f + 2f998c4 commit 7647be8

File tree

2 files changed

+104
-104
lines changed

2 files changed

+104
-104
lines changed

‎src/content/docs/identityserver/quickstarts/2-interactive.md

Lines changed: 87 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ To enable OIDC in IdentityServer you need:
4545
### Add The UI
4646

4747
Support for the OpenID Connect protocol is already built into IdentityServer.
48-
You need to provide the User Interface for login, logout, consent and error.
48+
You need to provide the User Interface for login, logout, consent, and error.
4949

5050
While the look & feel and workflows will differ in each implementation, we
5151
provide a Razor Pages-based UI that you can use as a starting point. You can use
@@ -541,84 +541,22 @@ will automatically include requested claims from the test users added in
541541
Adding support for external authentication to your IdentityServer can be done
542542
with very little code; all that is needed is an authentication handler.
543543

544-
ASP.NET Core ships with handlers for Google, Facebook, Twitter, Microsoft
545-
Account and OpenID Connect. In addition, you can find handlers for many
546-
other authentication providers
547-
[here](https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers).
544+
ASP.NET Core ships with handlers for OpenID Connect, and provides [integrations for Google, Facebook, Microsoft Account, Entra ID, and more](/identityserver/ui/login/external.md#third-party-aspnet-core-authentication-handlers).
548545

549-
#### Add Google support
546+
In this section, you'll register the Duende IdentityServer demo instance at `demo.duendesoftware.com` as an external provider.
547+
Since no other configuration is required apart from your IdentityServer, it is a good starting point.
548+
You'll also see [how to add Google authentication support](#add-google-support).
550549

551-
To use Google for authentication, you need to:
552-
553-
- Add the `Microsoft.AspNetCore.Authentication.Google` NuGet package to
554-
the IdentityServer project.
555-
- Register with Google and set up a client.
556-
- Store the client id and secret securely with *dotnet user-secrets*.
557-
- Add the Google authentication handler to the middleware pipeline and configure
558-
it.
550+
#### Adding An Additional OpenID Connect-Based External Provider
559551

560-
See [Microsoft's
561-
guide](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/social/google-logins?view=aspnetcore-8.0#create-a-google-api-console-project-and-client-id)
562-
for details on how to register with Google, create the client, and store the
563-
secrets in user-secrets. **Stop before adding the authentication middleware and
564-
Google authentication handler to the pipeline.** You will need an
565-
IdentityServer specific option.
552+
A cloud-hosted [demo instance of Duende IdentityServer](https://demo.duendesoftware.com) can be added as an additional external provider.
566553
567-
Add the following to `ConfigureServices` in
568-
`src/IdentityServer/HostingExtensions.cs`:
569-
570-
```cs
571-
// Program.cs
572-
builder.Services.AddAuthentication()
573-
.AddGoogle("Google", options =>
574-
{
575-
options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
576-
577-
options.ClientId = builder.Configuration["Authentication:Google:ClientId"];
578-
options.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"];
579-
});
580-
```
581-
582-
When authenticating with Google, there are again two [authentication
583-
schemes](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/?view=aspnetcore-8.0#authentication-scheme).
584-
`AddGoogle` adds the Google scheme, which handles the protocol flow back and
585-
forth with Google. After successful login, the application needs to sign in to
586-
an additional scheme that can authenticate future requests without needing a
587-
roundtrip to Google - typically by issuing a local cookie. The `SignInScheme`
588-
tells the Google handler to use the scheme named
589-
`IdentityServerConstants.ExternalCookieAuthenticationScheme`, which is a cookie
590-
authentication handler automatically created by IdentityServer that is intended
591-
for external logins.
592-
593-
Now run `IdentityServer` and `WebClient` and try to authenticate (you may need
594-
to log out and log back in). You will see a Google button on the login page.
595-
596-
![IdentityServer login page showing Google as an external login option](./images/2_google_login.png)
597-
598-
Click on Google and authenticate with a Google account. You should land back on
599-
the `WebClient` home page, showing that the user is now coming from Google with
600-
claims sourced from Google's data.
601-
602-
:::note
603-
The Google button is rendered by the login page automatically when there are
604-
external providers registered as authentication schemes. See the
605-
`BuildModelAsync` method in `src/IdentityServer/Pages/Account/Login/Index.cshtml.cs` and
606-
the corresponding Razor template for more details.
607-
:::
608-
609-
#### Adding an additional OpenID Connect-based external provider
610-
611-
A [cloud-hosted demo](https://demo.duendesoftware.com) version of Duende
612-
IdentityServer can be added as an additional external provider.
613-
614-
Register and configure the services for the OpenId Connect handler in
615-
`src/IdentityServer/HostingExtensions.cs`:
554+
Register and configure the services for the OpenId Connect handler in`src/IdentityServer/HostingExtensions.cs`:
616555

617556
```cs
618557
// HostingExtensions.cs
619558
builder.Services.AddAuthentication()
620-
.AddGoogle("Google", options => { /* ... */ })
621-
.AddOpenIdConnect("oidc", "Demo IdentityServer", options =>
559+
.AddOpenIdConnect("oidc", "Sign-in with demo.duendesoftware.com", options =>
622560
{
623561
options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
624562
options.SignOutScheme = IdentityServerConstants.SignoutScheme;
@@ -637,25 +575,85 @@ builder.Services.AddAuthentication()
637575
});
638576
```
639577

640-
Now if you try to authenticate, you should see an additional button to log in to
641-
the cloud-hosted Demo IdentityServer. If you click that button, you will be
642-
redirected to https://demo.duendesoftware.com/. Note that the demo site is using
643-
the same UI as your site, so there will not be very much that changes visually
644-
when you're redirected. Check that the page's location has changed and then log
645-
in using the alice or bob users (their passwords are their usernames, just as
646-
they are for the local test users). You should land back at `WebClient`,
647-
authenticated with a demo user.
578+
Now if you try to authenticate, you should see an additional *Sign-in with demo.duendesoftware.com* button to log in to
579+
the cloud-hosted demo IdentityServer. If you click that button, you will be redirected to https://demo.duendesoftware.com/.
580+
581+
Check that the page's location has changed and then log in using the `alice` or `bob` users (their passwords are their usernames, just as
582+
they are for the local test users). You should land back at `WebClient`, authenticated with a demo user.
648583

649-
The demo users are logically distinct entities from the local test
650-
users, even though they happen to have identical usernames. Inspect their claims
651-
in `WebClient` and note the differences between them, such as the distinct sub
652-
claims.
584+
The demo users are logically distinct entities from the local test users, even though they happen to have identical usernames.
585+
Inspect their claims in `WebClient` and note the differences between them, such as the distinct `sub` claims.
653586

654587
:::note
655-
The quickstart UI auto-provisions external users. When an external user logs in
656-
for the first time, a new local user is created with a copy of all the external
657-
user's claims. This auto-provisioning process occurs in the `OnGet` method of
658-
`src/IdentityServer/Pages/ExternalLogin/Callback.cshtml.cs`, and is completely
659-
customizable. For example, you could modify `Callback` so that it will require
660-
registration before provisioning the external user.
588+
The quickstart UI auto-provisions external users. When an external user logs in for the first time, a new local user is
589+
created with a copy of all the external user's claims. This auto-provisioning process occurs in the `OnGet` method of
590+
`src/IdentityServer/Pages/ExternalLogin/Callback.cshtml.cs`, and is completely customizable.
591+
For example, you could modify `Callback` so that it will require registration before provisioning the external user.
661592
:::
593+
594+
#### Add Google Support
595+
596+
:::note[`Microsoft.AspnetCore.Authentication.Google` no longer maintained]
597+
Before .NET 10, the `Microsoft.AspnetCore.Authentication.Google` package was provided by Microsoft. Starting with .NET 10,
598+
Microsoft [stopped shipping new versions of the `Microsoft.AspnetCore.Authentication.Google` package](https://github.com/dotnet/aspnetcore/issues/61817).
599+
600+
To add Google authentication, we recommend using the [`Google.Apis.Auth.AspNetCore3`](https://www.nuget.org/packages/Google.Apis.Auth.AspNetCore3/)
601+
package that is shipped by Google.
602+
:::
603+
604+
To use Google for authentication, you need to:
605+
606+
- Add the `Google.Apis.Auth.AspNetCore3` NuGet package to the IdentityServer project.
607+
- Register with Google and [set up a client](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/google-logins?view=aspnetcore-9.0#create-the-google-oauth-20-client-id-and-secret).
608+
- Store the client id and secret securely with `dotnet user-secrets`.
609+
- Add the Google authentication handler to the middleware pipeline and configure it.
610+
611+
See [Microsoft's guide](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/google-logins?view=aspnetcore-9.0#create-the-google-oauth-20-client-id-and-secret)
612+
for details on how to register with Google, create the client, and store the
613+
secrets in user secrets. **Stop before adding the authentication middleware and
614+
Google authentication handler to the pipeline.** You will need an
615+
IdentityServer specific option.
616+
617+
Add the following to `ConfigureServices` in `src/IdentityServer/HostingExtensions.cs`:
618+
619+
```cs
620+
// Program.cs
621+
builder.Services.AddAuthentication()
622+
.AddGoogleOpenIdConnect(
623+
authenticationScheme: GoogleOpenIdConnectDefaults.AuthenticationScheme,
624+
displayName: "Google",
625+
configureOptions: options =>
626+
{
627+
options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
628+
629+
options.ClientId = "" builder.Configuration["Authentication:Google:ClientId"];
630+
options.ClientSecret = ""builder.Configuration["Authentication:Google:ClientSecret"];
631+
});
632+
```
633+
634+
:::note
635+
Note that the `authenticationScheme` and `displayName` parameters are optional. They are added here to make the login
636+
button display a short and concise "Google" instad of the default "Google OpenIdConnect".
637+
:::
638+
639+
When authenticating with Google, there are again two [authentication schemes](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/#authentication-scheme).
640+
`AddGoogleOpenIdConnect` adds the `GoogleOpenIdConnect` scheme, which handles the protocol flow back and forth with Google.
641+
After successful login, the application needs to sign in to an additional scheme that can authenticate future requests without
642+
needing a roundtrip to Google - typically by issuing a local cookie. The `SignInScheme` tells the Google handler to use
643+
the scheme named `IdentityServerConstants.ExternalCookieAuthenticationScheme`, which is a cookie authentication handler
644+
automatically created by IdentityServer that is intended for external logins.
645+
646+
Now run `IdentityServer` and `WebClient` and try to authenticate (you may need to log out and log back in)
647+
You will see a *Google* button on the login page.
648+
649+
![IdentityServer login page showing Google as an external login option](./images/2_google_login.png)
650+
651+
Click on *Google* and authenticate with a Google account. You should land back on
652+
the `WebClient` home page, showing that the user is now coming from Google with
653+
claims sourced from Google's data.
654+
655+
:::note
656+
The Google button is rendered by the login page automatically when there are external providers registered as
657+
authentication schemes. See the `BuildModelAsync` method in `src/IdentityServer/Pages/Account/Login/Index.cshtml.cs` and
658+
the corresponding Razor template for more details.
659+
:::

‎src/content/docs/identityserver/ui/login/external.md

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -329,18 +329,20 @@ authentication and configuring it.
329329

330330
In this section, find a non-exhaustive list of first-party and third-party ASP.NET authentication handlers that you can use in any ASP.NET Core application.
331331

332-
| Authentication handler / Service | Type |
333-
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|
334-
| [Cookie authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie) | Part of .NET |
335-
| [OpenID Connect](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-oidc-web-authentication) | Part of .NET |
336-
| [JWT Bearer authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-jwt-bearer-authentication) | Part of .NET |
337-
| [Certificate authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/certauth) | Part of .NET |
338-
| [Windows authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) | Part of .NET |
339-
| [WS-Federation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation) | Part of .NET |
340-
| [Facebook / Meta](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/facebook-logins) | Part of .NET |
341-
| [Microsoft Account](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/microsoft-logins) | Part of .NET |
342-
| [Twitter / X](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/twitter-logins) | Part of .NET |
343-
| [Sustainsys Saml2](https://sustainsys.com/sustainsyssaml2-libraries) | Open-source |
344-
| Many social providers in [AspNet.Security.OAuth.Providers](https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers)<br /><em><small>Airtable, Apple ID, GitHub, Hubspot, Instagram, Okta, Slack, ...</small></em> | Open-source |
345-
| [Rock Solid Knowledge SAML2P](https://www.identityserver.com/products/saml2p) | Commercial |
346-
| [Rock Solid Knowledge WS-Federation](https://www.identityserver.com/products/ws-federation) | Commercial |
332+
| Authentication handler / Service | Vendor |
333+
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------|
334+
| [Cookie authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie) | Part of .NET |
335+
| [OpenID Connect](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-oidc-web-authentication) | Part of .NET |
336+
| [JWT Bearer authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/configure-jwt-bearer-authentication) | Part of .NET |
337+
| [Certificate authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/certauth) | Part of .NET |
338+
| [Windows authentication](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/windowsauth) | Part of .NET |
339+
| [WS-Federation](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation) | Part of .NET |
340+
| [Facebook / Meta](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/facebook-logins) | Part of .NET |
341+
| [Microsoft Account](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/microsoft-logins) | Part of .NET |
342+
| [Twitter / X](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/twitter-logins) | Part of .NET |
343+
| [Entra ID / Microsoft Account / ...](https://www.nuget.org/packages/Microsoft.Identity.Web) | Microsoft |
344+
| [Google](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/social/google-logins) | Google |
345+
| [Sustainsys Saml2](https://sustainsys.com/sustainsyssaml2-libraries) | Open-source |
346+
| Many social providers in [AspNet.Security.OAuth.Providers](https://github.com/aspnet-contrib/AspNet.Security.OAuth.Providers)<br /><em><small>Airtable, Apple ID, GitHub, Hubspot, Instagram, Okta, Slack, ...</small></em> | Open-source |
347+
| [Rock Solid Knowledge SAML2P](https://www.identityserver.com/products/saml2p) | Rock Solid Knowledge |
348+
| [Rock Solid Knowledge WS-Federation](https://www.identityserver.com/products/ws-federation) | Rock Solid Knowledge |

0 commit comments

Comments
 (0)