Allow custom JwtBearerEvents to allow SignalR to work with Bearer tokens.

[okta]

Allow custom JwtBearerEvents to allow SignalR to work with Bearer tokens.

[laura-rodriguez]

OIDC and JWT events are now exposed. This feature is available in Okta.AspNet 2.0.0 and Okta.AspNetCore 4.0.0. Fixed in #187.

[thepherm]

Thank you!

[nbarbettini]

Hey @jraadt! Let me know if I am understanding your scenario correctly:

1. Your client/frontend app signs a user in and gets a token from Okta
2. This token is used to make authorized API calls from the frontend to your API
3. This token is also used to establish a connection from the client to a SignalR hub on your API
4. The SignalR JS client doesn't send the Authorization: Bearer header (it sends tokens in the query string instead) so in this case you need to customize how the middleware pulls the token out of the request.

[jraadt]

@nbarbettini That's exactly right.

[chillitom]

👍 this would be extremely useful

will the associated PR be merged?

[chillitom]

Here's a workaround for anyone waiting on the PR.

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Extensions.DependencyInjection;
using Okta.AspNet.Abstractions;
using System;

namespace SignalR.Okta.Fix {

    // these customizations are required to get Okta and SignalR working nicely together
    // https://github.com/okta/okta-aspnet/issues/71
    // https://docs.microsoft.com/it-it/aspnet/core/signalr/authn-and-authz?view=aspnetcore-5.0

    public class ExtendedOktaWebApiOptions : OktaWebApiOptions {
        public JwtBearerEvents Events { get; set; }
    }

    public static class OktaAuthenticationOptionsExtensions {

        /// <summary>
        /// Configures Okta for Web API apps.
        /// </summary>
        /// <param name="builder">The application builder.</param>
        /// <param name="options">The Okta Web API options.</param>
        /// <returns>The authentication builder.</returns>
        public static AuthenticationBuilder AddOktaWebApi(this AuthenticationBuilder builder, ExtendedOktaWebApiOptions options) {
            if (builder == null) {
                throw new ArgumentNullException(nameof(builder));
            }

            new OktaWebApiOptionsValidator().Validate(options);

            return AddJwtValidation(builder, options);
        }

        private static AuthenticationBuilder AddJwtValidation(AuthenticationBuilder builder, ExtendedOktaWebApiOptions options) {
            var issuer = UrlHelper.CreateIssuerUrl(options.OktaDomain, options.AuthorizationServerId);

            var tokenValidationParameters = new DefaultTokenValidationParameters(options, issuer) {
                ValidAudience = options.Audience,
            };

            builder.AddJwtBearer(opt => {
                opt.Audience = options.Audience;
                opt.Authority = issuer;
                opt.TokenValidationParameters = tokenValidationParameters;
                opt.BackchannelHttpHandler = new OktaHttpMessageHandler("okta-aspnetcore", typeof(OktaAuthenticationOptionsExtensions).Assembly.GetName().Version, options);

                opt.SecurityTokenValidators.Clear();
                opt.SecurityTokenValidators.Add(new StrictSecurityTokenValidator());

                opt.Events = options.Events;
            });

            return builder;
        }
    }
}

[laura-rodriguez]

Hi @chillitom,

Thanks for your question and for providing a workaround for folks that are waiting for this 💯 .

We have a plan to expose all the events, but I can't share an ETA at the moment, since the .NET team is currently working on different projects.

Thank you so much for your patience!