ASP.NET Core Custom OAuth Server (.NET 7 Minimal Apis C#)

🕰 Timestamps
00:00 Introduction
02:38 Auth code flow recap
03:08 Dev Keys
03:24 Authorization Endpoint
05:14 Authorization Endpoint Request
06:23 PKCE recap
07:43 Authorization Endpoint Response
08:25 Authorization Code
11:08 Testing Authorization Endpoint
14:08 Token Endpoint Base
15:03 Grant Type
15:40 Token Endpoint Request
17:02 Authorization Endpoint Response
17:40 Creating JWT
19:16 Token Endpoint Extension
19:52 Code Verifier & Code Challenge
21:00 Testing Token Endpoint
21:54 Code Challenge Creation Logic
23:24 Code Verifier Validation
27:23 Mapping Claims
30:16 Validation

#aspnetcore #authentication #oauth2

[allinvanguard]

Well done, appreciate all the Identity videos, granted the officials doc lacks a lot

[vadymwork]

Мое почтение, сударь)
Сказку прослушал внимательно)

[yonibauduin]

Very nice video and good explanations!

Quick question: in the token endpoint at 18:03, you set the sub claim to a NewGuid(). What would be the correct implementation if we want to keep track of the user? Should it be added to a new property in the AuthCode class and set during the Authorization endpoint? And then if we want to add other claims, a database lookup should occur in the token endpoint, am I right? Thanks for clarifying this!

Keep the good work :) I hope you'll make an OpenId Connect video soon!

[JohnOliverAtHome]

Anton, for parsing a query string (will work for any string that looks like a query string), you can use the the method.

[fieryscorpion]

That was awesome.
Question: How do you handle `Challenge` in this case? Like how do you provide login form for the users to sign in if they navigate to [Authorize] pages?
Also how do you provide Consent screen in this setup? Can you please elaborate on that? Maybe create a new video on that? Thank you!

[prathameshshende]

hey anton, you've already created another identity server, super amazing video I would love to see any small actual example using blazor wasm and webapi with oauth2.1 video !!

[ezmooj]

Thank you Anton great knowledge sharing

[maria_sss]

I live in Latvia and here we have many free courses to help beginners start their IT career

[kodastr]

Спасибо за доходчивое разъяснение материала. Еле смог подписаться на патрионе. Только никак не могу понять с конечной точкой /oauth/custom-cb. У меня ошибка при редиректе. В клиенте не нашел описания и в серверной части тоже

[RicardoJosue]

Increíble project, do you have a code example? Or how can get that? Greetings from México

[kostjaparanoid]

I go nuts. I don't understand how I can read login information in token endpoint so I can load the claims and pass them to client with token. Please help pipez

[damientohin]

Wonderfull entry and intro, LMAO, but good tuto 😂😂

[riccardoparolini]

Is there any possibility to find this project uploaded on GitHub in the near future?

[-matt_p-]

Can I ask you if it is possible, once the web api has been authenticated, at the same time to protect certain actions of the webapi with authorization by checking the token received?
Anyway, congratulations, a truly complete job

[Dms]

Bro, you'r rock! What about the client app logout? I'm trying to make a UI in the authorization server where the user can choose a bunch of client apps and then log in, kinda a sso. If the user log out from authorization server, the cookie in the client still work. I think i am messing up with the concepts pretty hard lol

[garciacgera]

What can I do if I want that the endpoint GET /login be a complete html file including styles, js and more? not just a plain html with two inputs. Thanks in advance!! And great video by the way.

[rahimliparviz]

Hi Anton, could you say where did client pass parameters like for example "code_challange" or "code_challange_method" in the AuthorisationEndpoint class?

[uctran]

Can you help me with this error?
Although, I coded TokenEndpoint endpoint but got error
" The input does not contain any JSON tokens. Expected the input to start with a valid JSON token, when isFinalBlock is true "

[abdullauthan]

Great video. Thanks for your effort.

I got one question. I want to check for client id and client secret for multiple clients. Where is the best place to validate? Is it login page post handler or Authorization handler? Where can I find the client secret inside authorization url? Thank you in advance

[freddycastelblancomacias]

Great tutorial !!!! i have one question btw, there is a way in which i can validate the client secret in the server side ?