Machine to machine communication does not work as a client in appsettings.json

[dobrinsky]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

We have a SPA application with Angular that we have been developing since dotnet core 2.1.

We recently migrated the code to the new asp.net core 6 template with Angular in order to use the new IdentityServer (Duende).

In the version before the migration we had in the solution a windows service that listens to a port for data to be received and it transmits said data to our application via an API. The service of course, needs to login firstly in order to be able to post data. In the previous version of the application it was much simpler, we requested a Token via a login API, but it was not really safe. Now with the new version of the SPA we need to migrate also the service functionality, but it is much harder to request the token from the Authentication procedure.

A new client was added to the appsettings.json file, but no matter what is changed, it does not work.

The appsettings.json file is:

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=(localdb)\\mssqllocaldb;Database=aspnet-Project1-53bc9b9d-9d6a-45d4-8429-2a2761773502;Trusted_Connection=True;MultipleActiveResultSets=true"
  },
  "Logging": {
      "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
      }
    },
  "IdentityServer": {
    "Clients": {
      "Project1": {
        "Profile": "IdentityServerSPA"
      },
      "postman": {
        "Profile": "IdentityServerSPA",
        "scope": "openid",
        "allowedGrantTypes": "client_credentials",
        "secret": "8CA187C92A6A3892735CA9FDCC5AF91F4F423EE8CDA550158192CFE4219246AD",
        "clientSecrets": [ "8CA187C92A6A3892735CA9FDCC5AF91F4F423EE8CDA550158192CFE4219246AD" ],
        "allowedScopes": [ "api1", "Project1API", "openid", "offline_access" ]
      }
    },
    "Resources": {
      "API.postman": {
        "Profile": "API",
        "scope": "openid",
        "allowedGrantTypes": "client_credentials",
        "secret": "8CA187C92A6A3892735CA9FDCC5AF91F4F423EE8CDA550158192CFE4219246AD",
        "clientSecrets": [ "8CA187C92A6A3892735CA9FDCC5AF91F4F423EE8CDA550158192CFE4219246AD" ],
        "allowedScopes": [ "api1", "Project1API", "openid", "offline_access" ]
      }
    }
  },
"AllowedHosts": "*"
}

As it can be seen, we tried to register postman both as a client and as a Resource.

Trying to connect with Postman as a client does work with the following configuration:

But this opens the Browser, which is not an option for a service, or any machine.

Trying to connect with the following configuration:

does not work with the following response:

Removing the Client "postman" from appsettings.json and trying to connect as a Resource only triggers the error "postman client does not exist".

We also tried to make the service login as a "human" by calling the

HttpClient.GetAsync("https://localhost/connect/authorize?response_type=code&client_id=SIGAD&scope=SIGADAPI%20openid%20profile&redirect_uri=https%3A%2F%2Flocalhost%2Fauthentication%2Flogin-callback&code_challenge=" + code_challenge + "&code_challenge_method=S256");

We receive an OK response, but we are stuck in POST-in the login to receive a token.

How can a service receive a token either as a machine client or POST the login to the Login.cshtml page?

Expected Behavior

A machine should be able to receive a token as in the Duende documentation and be able to POST data.

Steps To Reproduce

Create a new project;

Register a new client in appsettings.json

Try to receive a token with Postman or any other software/service/machine;

Exceptions (if any)

No response

.NET Version

6.0.101

Anything else?

No response

[javiercn]

@dobrinsky thanks for contacting us.

Unfortunately, this problem seems to be specific to your concrete scenario. The scenario that you describe is not something in the scope of what our integration package supports. I would recommend you use Identity Server directly in this case to achieve this instead of relying on our integration package.

[dobrinsky]

I gave a lot of information just to be sure that the scenario is understood.

I just need to understand if the documentation supports API integration (https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.apiauthorization.identityserver.applicationprofiles?view=aspnetcore-6.0), how can that be achieved with aspnetcore package integration?

As I understand, it cannot be done with the current template code and we should revert the Authentication and Authorization code.

[javiercn]

@dobrinsky this won't work.

Within AddApiAuthorization you have access to the clients that we read from config. The profile determines the security constraints and we only support a few configuration properties like the scopes, but we do not have support for client secrets or anything like that. The scenarios involving client secrets are outside of the scope of our integration package. With enough work it can probably be done, but it is not trivial and something we won't offer guidance for as we do not consider it in scope.
You have a few of options:

• Ask on Stackoverflow to see if people with similar scenarios can help.
• Read through the integration package codebase to understand how things compose together and adjust your code as necessary.
• Use Identity Server directly instead of our integration package.

I am sorry we can't be of more help here, but the scenario you describe is not something we consider in scope for our integration package (which is aimed at SPA + API) and we do not have the bandwidth to debug/troubleshoot other scenarios we do not consider in scope as it requires a non-trivial amount of work on our part.

The best we can do is offer some pointers here, but in general, I believe you'll have to troubleshoot this yourself. A good starting point will be to increase the log levels to see Debug statements and to check the clients configuration in apiauthorizationoptions when you call AddApiAuthorization. My suspicion is that your client is not being configured correctly.

      "postman": {
        "Profile": "IdentityServerSPA",
        "scope": "openid",
        "allowedGrantTypes": "client_credentials",
        "secret": "8CA187C92A6A3892735CA9FDCC5AF91F4F423EE8CDA550158192CFE4219246AD",
        "clientSecrets": [ "8CA187C92A6A3892735CA9FDCC5AF91F4F423EE8CDA550158192CFE4219246AD" ],
        "allowedScopes": [ "api1", "Project1API", "openid", "offline_access" ]
      }

Hope this helps.

[dobrinsky]

@javiercn,

Thank you very much for your response. I truly understand your point of view. I did asked on Stackoverflow, I came here as the las resort measure, not the first:

https://stackoverflow.com/questions/73501729/how-to-add-duende-clients-for-m2m-communication-with-default-asp-net-core-with-a

I will update the question there with what I have learned from you and the Duende GitHub:

DuendeArchive/Support#184

The client configuration is just the last one I have tried, I tried a multitude of combinations, but thank you for the suggestion of increasing the Debug statements.

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.