More expansive template for IdentityServer 8

[amortsell]

I'm in the startup of a project where we want to use IdentityServer 8 to use the added support for SAML support and the added UserManagement features. I found the samples github project which has a few samples for UserManagement, but I haven't found any templates to use as the starting point for a completely new project. Are there any templates that include any of these features?

[maartenba]

@amortsell We are working on what the template could look like, but currently do not have anything ready-made (should OTP lead? username/password? all? ...?). We recommend using the samples for now, or go with the getting started guide for user management (https://docs.duendesoftware.com/identityserver/usermanagement/getting-started/)

If you think of a template, what would, for your scenario, be the default implementation/authenticator(s) you would like to see for user management?

[amortsell]

Thanks for the quick response! I think in our case OTP or Passkeys should be the preferred choice, we haven't really decided yey, but we want to offer username/password and OTP/passkey as options.

Our primary use case is federation between different M365 tenants, but some external users don't belong to a tenant and in those cases we need UserManagement. The use case in those cases is that the user should be able to create his own user, and in a later step, an administrator grants access to the newly created user. Hence authentication is only needed for the admin parts of UserManagement, not for creating users.

[maartenba]

That makes sense, thanks! That does sound like some customization will be needed anyway. I'd likely start with these resources:

• The Getting Started sample is purely OTP. I will do a bonus round on this sample below this list.
• The Full Sample showcases everything. If you want to start from a rich example and then trim it down to your needs, I would recommend looking into this one.
• The blog post we did on passkeys may also be interesting to see how you could start with OTP and then require a passkey being added progressively. The full sample above uses a similar approach.
• and password registration if that's needed.

In all of these, the login page can also be set up to federate with Entra ID if needed (https://docs.duendesoftware.com/identityserver/ui/login/external/ is a good start).

Now the bonus round!

Adding profile to the Getting Started sample

In the Getting Started sample, you will see that there's only OTP. Let's say you want to start adding a user profile with more info. In Program.cs, you will see there is a call to MigrateAsync at some point. Right underneath, you can start customizing the user profile schema. This would add e.g. a Name attribute:

var schemaAdmin = scope.ServiceProvider.GetRequiredService<IUserProfileSchemaAdmin>();
var existing = await schemaAdmin.GetAllAttributeDefinitionsAsync(default);
if (!existing.ContainsKey(OidcStandardAttributes.Name.Code))
{
   await schemaAdmin.TryAddAttributeDefinitionAsync(OidcStandardAttributes.Name, default);
}

If you need something custom, that's also possible. Adding location for example:

var locationAttributeCode = AttributeCode.Create("location");

if (!existing.ContainsKey(locationAttributeCode))
{
    await schemaAdmin.TryAddAttributeDefinitionAsync(new()
    {
        Code = locationAttributeCode,
        AttributeType = new ScalarAttributeType(ScalarDataType.String),
        Description = AttributeDescription.Create("The user's location.")
    }, default);
}

A bit of plumbing, but this essentially tells User Management which attributes are there, which ones are required, etc. Building the user profile domain model if you will.

Whenever you then login with OTP, for example in EnterOtp.cshtml.cs, you can use otpSuccess.UserSubjectId.Value as the "user profile primary key" (in reality: subject ID) and pass it to a page to create the profile. Once you have the data to store in the profile, you can do that by injecting IUserProfileAdmin profileAdmin and then updating the profile:

var profile = await profileAdmin.TryGetAsync(..., HttpContext.RequestAborted); // ... would be the otpSuccess.UserSubjectId.Value
if (profile is null)
{
   var schema = await profileAdmin.GetSchemaAsync(HttpContext.RequestAborted);
   var attributes = new AttributeValueCollection(schema);

   attributes.Set(OidcStandardAttributes.Name, Model.Name);
   attributes.Set(AttributeCode.Create("location"), Model.Location); // note: move code to a static

   profile = await profileAdmin.TryAddAsync(otpSuccess.UserSubjectId, attributes.Validate(), HttpContext.RequestAborted);
}

Later when you need to retrieve it, you can fetch the profile again using the known subject ID, and, for example, build a list of claims:

var claims = new List<Claim>
{
   new("sub", ...),
   new(ClaimTypes.Name, profile?.Attributes.GetValueOrDefault(OidcStandardAttributes.Name)?
       .TryGetValue<string>(out var name) == true ? name : otpSuccess.Address.SubjectId.ToString()),
   new(ClaimTypes.Locality, profile?.Attributes.GetValueOrDefault(AttributeCode.Create("location"))?
       .TryGetValue<string>(out var location) == true ? location : "unknown")
};

Hope this helps you get started!

[amortsell]

Once again, thanks a lot! I think we now have enough to get ourselves started.