Authentication with Keycloak in .NET and ASP.NET Core. Secure your api with Keycloak JWT bearer authentication
Add the Keycloak.Net.Authentification nuget package to your project.
Api calls requires auhorization header with an JWT token from Keycloak.
POST https://yourapi/action HTTP/1.1
Auhorization: Bearer JwtTokenContent
Add to program.cs of your api
builder.Services
.AddKeyCloakAuthentication()
.AddKeyCloakJwtBearerOptions("appsettings_section_name");
.....
app.UseAuthentication();
app.UseAuthorization();
Add section to the appsettings.{Environment}.json
- Authority is required. If not set will throw exception during app startup.
- Set the audience as "Audience", "ValidAudience" or "ValidAudiences". If not set will throw exception during app startup.
{
"KeycloakUrl": "<<FROM_USER_SECRET>>",
"RealmName": "<<FROM_USER_SECRET>>",
"appsettings_section_name": {
"Authority": "{KeycloakUrl}{RealmName}",
"Audience": "<<Audience>>"
}
// or
"appsettings_section_name": {
"Authority": "{KeycloakUrl}{RealmName}",
"ValidAudience": "<<Audience>>"
}
//or
"appsettings_section_name": {
"Authority": "{KeycloakUrl}{RealmName}",
"ValidAudiences": ["<<Audience>>"]
}
}
- Variation of first option. Additional configuration of JwtBearerOptions available.
- If set will override the value of same property defined in appsettings.{Environment}.json
builder.Services
.AddKeyCloakAuthentication()
.AddKeyCloakJwtBearerOptions("appsettings_section_name", options =>
{
options.Audience = "<<Audience>>";
options.SaveToken = true;
options.TokenValidationParameters.ClockSkew = TimeSpan.FromSeconds(30);
});
- If you want to get auth options from other source, not from appsettings.{Environment}.json, you can pass Action<JwtBearerValidationOptions> instead.
- Authority is required. If not set will throw exception during app startup.
- Set the audience as "Audience", "ValidAudience" or "ValidAudiences".If not set will throw exception during app startup.
builder.Services
.AddKeyCloakAuthentication()
.AddKeyCloakJwtBearerOptions(options =>
{
options.KeycloakAuthority = "https://{host}/realms/{realm}";
options.KeycloakAudience = "<<Audience>>";
})
- You have to manually configure the JwtBearerOtions.
builder.Services
.AddKeyCloakAuthentication()
.AddJwtBearerOptions(options =>
{
options.Authority = "https://{host}/realms/{realm}";
options.Audience = "<<Audience>>";
......
options.TokenValidationParameters = new TokenValidationParameters( options =>
{
options.ClockSkew = TimeSpan.FromSeconds(30);
.......
});
});
- Under the hood the Keyclaok JWT is mapped and transformed to Identity JWT
- The Keycloak Realm and Client "roles" claims are mapped and transformed to ClaimType.Role
- By default the Keycloak "preferred_username" claim is transformed to ClaimType.Name. You can change it by just adding the following:
{
"KeycloakUrl": "<<FROM_USER_SECRET>>",
"RealmName": "<<FROM_USER_SECRET>>",
"appsettings_section_name": {
"Authority": "{KeycloakUrl}{RealmName}",
"Audience": "<<Audience>>",
"NameClaim: "<<NameOfClaimWhichShouldBeSetToNameClaim>>"
}
}