DEV Community: Mohammed Ahmed Hussien

An implementation for twitter's snowflakeId algorithm in C# Langauge

Mohammed Ahmed Hussien — Mon, 12 May 2025 10:53:40 +0000

SnowflakeId is an algorithm was invented by Twitter to generate a unique Ids for a million of posts that are creating daily by users.

I implemented this algorithm using C# programming language and here is the repo link if you want to go deeper and see how I design it.
https://github.com/Shoogn/SnowflakeId

If you wkuld like to know more about this algorithm you can find how this algorithm works from the following link:
https://en.m.wikipedia.org/wiki/Snowflake_ID

Az 900

Mohammed Ahmed Hussien — Wed, 05 Feb 2025 19:09:42 +0000

Rate Limiting in ASP.NET MVC 5

Mohammed Ahmed Hussien — Fri, 31 Jan 2025 17:36:44 +0000

One of the most important parts in any application is to secure your application against Denial of Services attacks (DoS) (to learn more about this attack consult Wikipedia for more details https://en.wikipedia.org/wiki/Denial-of-service_attack), and ASP.NET MVC application is not exception of that attack, in ASP.NET Core there is a built-in Middleware that can help you to do that, but in ASP.NET MVC that target .NET Framework you have to implement this take by yourself, and in this post, I will show you how!
Create a new ASP.NET MVC 5 Application that target .NET Framework (Here I'm going to use a Web API 2.2 application, but it doesn't matter which application you're going to use because the sample that we're going to implement is applicable for both type of application)
I'm going to create a new Action Filter named CustomRateLimitAttribute and this attribute should be inherited from ActionFilterAttribute
In the next section I will put the complete code after that I will explain it in details:

public class CustomRateLimitAttribute : ActionFilterAttribute
{
    private int _limit = 10; // Allowed Request Count.
    private TimeSpan _window = TimeSpan.FromMinutes(1); // Time Window
    private static MemoryCache _cache = MemoryCache.Default;
    private object _lock = new object();
    public CustomRateLimitAttribute(int limit, int window)
    {
        _limit = limit;
        _window = TimeSpan.FromMinutes(window);
    }

    public override bool AllowMultiple
    {
        get { return false; }
    }

    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        var ip = HttpContext.Current.Request.UserHostAddress;
        var key = $"{ip}_{actionContext.ActionDescriptor.ControllerDescriptor.ControllerName}_{actionContext.ActionDescriptor.ActionName}";

        lock (_lock)
        {
            var count = _cache.Get(key) as int? ?? 0;
            if (count >= _limit)
            {
                actionContext.Response = new System.Net.Http.HttpResponseMessage(System.Net.HttpStatusCode.Conflict);
                actionContext.Response.Content = new System.Net.Http.StringContent("Too many request and Rate limit exceeded.");
                return;
            }
            _cache.Set(key, count + 1, DateTimeOffset.UtcNow.Add(_window));
        }
        base.OnActionExecuting(actionContext);
    }

So, first I define multiple private fields, the first one is _limit and the purpose of this filed is to define how many requests are allowed in a specific time and the default time is stored in the next private field _window and by default is one minute, but I give a user to override the default value by pass it in the constructor of the attribute.
Second, I defined a filed named __cache _of type MemoryCache and this field will help to store the number of the requests and compare it to the default limit requests that is defined in the _limit field and to track the number of the request I created unique key which contins of the Controller name, the Action name and the IP address of the user that trying to attack the application.

MemoryCache object is defined in System.Runtime.Caching namespace

Now you're ready to use this attribute, in the HomeController class you can decorate the entire controller by this new attribute, or you can apply it to a specific Action method, in the next example I decorate an action method named GetFiles() to accept a limit number of requests (5 requests duration one minute per user):

   // api/home/getfiles
   [HttpGet]
   [Route("api/home/getfiles")]
   [CustomRateLimit(limit: 5, window: 1)]
   public HttpResponseMessage GetFiles()
   {

   }

And that's all.

Building a Custom Logging Provider in ASP.NET Core

Mohammed Ahmed Hussien — Tue, 22 Oct 2024 15:57:56 +0000

Logging is one of the most important parts in .NET ecosystem and any developer should interact with it to diagnosing the information for applications healthy purposes.
Logging the errors that are happening when the applications shipped to production environment is very important and for that ASP.NET Core has a built-in logging provider, and there is more than one provider that you can use to collect the information during development or production lifecycle, here is a list of the part of logging provider that are shipped with the .NET SDK:

Console
EventLog
Debuge
EventSource
TraceSource

There are also more than one a third-party provider, that are dependent on the built-in one, and you can use any of them in your applications:

NLog
Serilog

Here, we’re going to build our custom logging provider that is dependent on the built-in one but in our provider, we’re going to collect the information and save it in the Database.
To log and save the data in the database we need a table that can help us to hold and query these data for a later time.
Fire your visual studio and create an empty ASP.NET Core project and give it a name DevDbLogger like the following picture:

In the root of the project that you're created int the above step, add a new folder named Advanced and inside this new folder create a new folder named CustomLogging.

I’m going to use the Opting pattern to help me to read some data from the configuration file and in this case the configuration file is appsettings.json or any other type of the configuration files that are available in the .NET applications, so create a new class inside CustomLogging folder named CustomDataBaseLoggerOptions and this class has the following signature:

 public class CustomDataBaseLoggerOptions
 {
     public string ConnectionString { get; set; } = default!;
     public string LogToTable { get; set; } = default!;
     public string TableSchema { get; set; } = default!;
 }

The CustomDataBaseLoggerOptions object has three properties the first one is the ConnectionString and the purpose of this property is to let our log provider connecting to and existing db. The second property LogToTable is the name of the table that we're going to save our log information inside it. The third and last property is TableSchema and this should be the schema name that our table belong to. (By design none of these properties should be null).

In .NET (generally) to create a custom logging provider you must implement two interfaces:

ILoggerProvider.
ILogger.

The purpose of the ILoggerProvider interface is to create an instance of the concreate object that implement the ILogger interface.
The ILogger interface is used to log the data that we're going to save in the Database.
To implement these two interfaces, we need two classes, but before that let us first create our Database and the Table that we're going to save the logging data inside it.

Here I' using SQL Server, so create a new Database named DevDbLogger_DataBase. After creating the database successfully create a new table inside this database named Logs. The schema of the table like the following:

USE [DevDbLogger_DataBase]
GO
SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO

CREATE TABLE [dbo].[Logs](
    [Id] [int] IDENTITY(1,1) NOT NULL,
    [LogLevel] [int] NOT NULL,
    [LogLevelText] [nvarchar](max) NOT NULL,
    [Message] [nvarchar](max) NOT NULL,
    [TimeStamp] [datetime2](7) NOT NULL,
    [Exception] [nvarchar](max) NULL,
    [IpAddress] [nvarchar](max) NULL,
 CONSTRAINT [PK_Logs] PRIMARY KEY CLUSTERED 
(
    [Id] ASC
)WITH (PAD_INDEX = OFF, 
STATISTICS_NORECOMPUTE = OFF,
IGNORE_DUP_KEY = OFF, 
ALLOW_ROW_LOCKS = ON, 
ALLOW_PAGE_LOCKS = ON, 
OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY]
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
GO

Here I'm using SQL Server Express 2019!

Now our Database and table is ready to save our logs data, let us turn our focus to implementing the ILoggerProvider and the ILogger interfaces, back to our application (DevDbLogger) create a new class inside CustomLogging folder named CustomDataBaseLoggerProvider this class should be inherent from ILoogerProvider interface.

As I said before the purpose of the ILoggerProvider interface is creating an instance of the object that implement the ILogger interface, so create a new class inside CustomLogging folder named CustomeDataBaseLogger.

Before doing anything, we need a package that can help us to interact with the Database that we're creating recently. From the NuGet package manager search for Microsoft.Data.SqlClient package and install it. (see the following pic)

Open the CustomDataBaseLoggerProvider class and let it implement the ILoggerProvider interface like so:

    public class CustomDataBaseLoggingProvider : ILoggerProvider
    {
        public readonly CustomDataBaseLoggerOptions Options;

        public CustomDataBaseLoggingProvider(
              IOptions<CustomDataBaseLoggerOptions> options)
        {
            Options = options.Value;
        }

        public ILogger CreateLogger(string categoryName)
        {

            return new CustomeDataBaseLogger(this);
        }

        public void Dispose()
        {

        }
    }

This is class is pretty easy to grasp the idea behind it, the important member of this class is the CreateLogger method, which comes from the ILoggerProvider interface, and our logger here is the CustomeDataBaseLogger and this method accept one parameter of type CustomeDataBaseLogger (we're going to implement this class shortly), as you can see from the signature of this class, I injected the CustomDataBaseLoggerOptions in the constructor to read the required values such as Database name and the Table name (that we're creating above).

Now we're ready to implement the ILogger interface in CustomeDataBaseLogger class, the ILogger interface has three members like so:

void Log<TState>(LogLevel logLevel, 
EventId eventId, 
TState state, 
Exception? exception, 
Func<TState, Exception?, string> formatter);

bool IsEnabled(LogLevel logLevel);

IDisposable? BeginScope<TState>(TState state) where TState : notnull;

The first method is the Log which is contains the information that we're going to send it to our Logs table.
The second one is IsEnabled and it will check the state of the log level is it enabled or not, and here you have to decide at which level you would like your application should collect the data and save it in the database.
The third and the last method BeginScope is creating a scope of the type that is written in the logger level.

Before implementing the ILogger interface let us review the data that we're going to collect, if you look at the signature of the Logs table you will realize that we have seven (7) columns:

Id: the primary key of the table (Logs).
LogLevel: at which level the application creates this log.
LogLevelText: save the log level as a text (ex: Debug, etc...).
Message: the message of the log.
TimeStamp: at which time we logged this message.
Exception: the exception (if any).
IpAddress: the Ip address of the user that use our application.

From the a above columns, we have one column name LogLevelText, this will save the log level as text and because the type of the LogLevel in .NET is Enum so we need a helper method to convert the level of the log to the string and save that value in the **LogLevelText **column.
Here is the helper method that will accomplish our job:

    public class CustomeDataBaseLogger
    {
      // other implementations goes here...

        private string ConvertLogLevelToTxtString(LogLevel logLevel)
        {
            string result = logLevel switch
            {
                LogLevel.Critical => "CRITICAL",
                LogLevel.Warning => "WARNING",
                LogLevel.Information => "INFORMATION",
                LogLevel.Debug => "DEBUG",
                LogLevel.Trace => "TRACE",
                LogLevel.Error => "ERROR",
                _ => logLevel.ToString().ToUpper(),
            };

            return result;
        }
    }

Now let our CustomeDataBaseLogger class inherit from the ILogger interface, here is the complete signature of this class. (Don't worry I will explain it in detail)

 public class CustomeDataBaseLogger : ILogger
 {
     private readonly CustomDataBaseLoggingProvider _dbLoggerProvider;
     public CustomeDataBaseLogger([NotNull] CustomDataBaseLoggingProvider dataBaseLoggerProvider)
     {
         _dbLoggerProvider = dataBaseLoggerProvider;
     }

     public IDisposable BeginScope<TState>(TState state) where TState : notnull
     {
         return default!;
     }

     // ToDo TO set min level to log
     public bool IsEnabled(LogLevel logLevel)
     {
         return logLevel != LogLevel.None;
     }

     public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
     {
         if (!IsEnabled(logLevel))
         {
             // Don't log anything to the back store the logLevel it's not enabled.
             return;
         }

         // validation
         if (formatter == null)
         {
             throw new ArgumentNullException(nameof(formatter));
         }

         string message = formatter(state, exception);
         int lg = (int)logLevel;
         string lgTxt = ConvertLogLevelToTxtString(logLevel);
         using (var con = new Microsoft.Data.SqlClient.SqlConnection(_dbLoggerProvider.Options.ConnectionString))
         {
             using (var command = new Microsoft.Data.SqlClient.SqlCommand())
             {
                 con.Open();
                 command.Connection = con;
                 command.CommandType = System.Data.CommandType.Text;
                 command.CommandText = string.Format(
                     @"INSERT INTO {0}.{1} (LogLevel, LogLevelText, Message, TimeStamp, Exception, IpAddress) 
                         VALUES (@LogLevel, @LogLevelText, @Message, @TimeStamp, @Exception, @IpAddress);", _dbLoggerProvider.Options.TableSchema, _dbLoggerProvider.Options.LogToTable
                     );


                 command.Parameters.Add(new Microsoft.Data.SqlClient.SqlParameter
                 {
                     ParameterName = "@LogLevel",
                     SqlDbType = System.Data.SqlDbType.Int,
                     IsNullable = false,
                     Value = lg,
                     Direction = System.Data.ParameterDirection.Input
                 });


                 command.Parameters.Add(new Microsoft.Data.SqlClient.SqlParameter
                 {
                     ParameterName = "@LogLevelText",
                     SqlDbType = System.Data.SqlDbType.NVarChar,
                     IsNullable = false,
                     Value = lgTxt,
                     Direction = System.Data.ParameterDirection.Input
                 });

                 command.Parameters.Add(new Microsoft.Data.SqlClient.SqlParameter
                 {
                     ParameterName = "@Message",
                     SqlDbType = System.Data.SqlDbType.NVarChar,
                     IsNullable = false,
                     Value = message,
                     Direction = System.Data.ParameterDirection.Input
                 });

                 command.Parameters.Add(new Microsoft.Data.SqlClient.SqlParameter
                 {
                     ParameterName = "@TimeStamp",
                     SqlDbType = System.Data.SqlDbType.DateTime2,
                     IsNullable = false,
                     Value = DateTime.UtcNow,
                     Direction = System.Data.ParameterDirection.Input
                 });

                 command.Parameters.Add(new Microsoft.Data.SqlClient.SqlParameter
                 {
                     ParameterName = "@Exception",
                     SqlDbType = System.Data.SqlDbType.NVarChar,
                     IsNullable = true,
                     Value = (object?)exception ?? DBNull.Value,
                     Direction = System.Data.ParameterDirection.Input
                 });

                 command.Parameters.Add(new Microsoft.Data.SqlClient.SqlParameter
                 {
                     ParameterName = "@IpAddress",
                     SqlDbType = System.Data.SqlDbType.NVarChar,
                     IsNullable = true,
                     Value = "IpAddress",
                     Direction = System.Data.ParameterDirection.Input
                 });

                 command.ExecuteNonQuery();
             }
         }
     }

     private string ConvertLogLevelToTxtString(LogLevel logLevel)
     {
         string result = logLevel switch
         {
             LogLevel.Critical => "CRITICAL",
             LogLevel.Warning => "WARNING",
             LogLevel.Information => "INFORMATION",
             LogLevel.Debug => "DEBUG",
             LogLevel.Trace => "TRACE",
             LogLevel.Error => "ERROR",
             _ => logLevel.ToString().ToUpper(),
         };

         return result;
     }
 }

First, I inject the CustomDataBaseLoggingProvider object to read the configuration values from the CustomDataBaseLoggerOptions object that we inject it already in the CustomDataBaseLoggingProvider class.

Second, the IsEnabled method will check the status of the log level if it's None so ignore the log.

Third, the Log method will write the information that we are gathering and send it to the back store and save it inside Logs table. The code in this method is straightforward, I create an instance from the SqlConnection object and apply a simple insert statement that will execute against our database as you see it here (look at the value of the table name and the schema name, I read it from the Options property that is defined in our CustomDataBaseLoggingProvider object)

 command.CommandText = string.Format(
     @"INSERT INTO {0}.{1} (LogLevel, LogLevelText, Message, TimeStamp, Exception, IpAddress) 
         VALUES (@LogLevel, @LogLevelText, @Message, @TimeStamp, @Exception, @IpAddress);", 
     _dbLoggerProvider.Options.TableSchema, _dbLoggerProvider.Options.LogToTable
     );

To be clear, I'm going to improve the implementation of the Log method later after running our application and creating our first log. (See you there)

Also, if you see clearly, I pass a statis value to the *IpAddress * column but also trust me I'm going to improve this right after running our application and creating our first log. (See you there)

The last step that can let us use our provider is to register the provider in the service registration container at the Program.cs class, to end that I'm going to create an extension method of the ILoggingBuilder type and return the ILoggingBuilder also to let you chain multiple logging provider in your application if there is more than one provider, here is the signature of this method

   public static class DataBaseLoggerExtensions
   {
       public static ILoggingBuilder AddDataBaseLogger(this ILoggingBuilder builder, 
            Action<CustomDataBaseLoggerOptions> configure)
       {
           builder.Services.AddSingleton<ILoggerProvider, CustomDataBaseLoggingProvider>();
           builder.Services.Configure(configure);

           return builder;
       }
   }

Now let use add our provider to the service registration container by opining the Program.cs class and add our own provider as shown here:

builder.Logging.ClearProviders();
builder.Logging.AddDataBaseLogger(options =>
{
    options.ConnectionString = "YOUR CONNETION STRING GOES HERE";
    options.LogToTable = "Logs";
    options.TableSchema = "dbo";
});

First, I clear any registered provider and then add my own one DON'T forget to replace the "YOUR CONNETION STRING GOES HERE" text with your real connection string.

To test our own provider let us update the endpoint (/) that return hello world by injecting the ILogger interface and submitting a dummy information as shown here:

using DevDbLogger.Advanced.CustomLogging;

var builder = WebApplication.CreateBuilder(args);

builder.Logging.ClearProviders();
builder.Logging.AddDataBaseLogger(options =>
{
    options.ConnectionString = "YOUR CONNETION STRING GOES HERE";
    options.LogToTable = "Logs";
    options.TableSchema = "dbo";
});

var app = builder.Build();

app.MapGet("/", (ILogger<Program> logger) =>
{
    logger.LogInformation("weeeeeee are here");
    return "hello world";
});

app.Run();

**HEY, PLEASE RUN YOUR APP NOW**.

Open the Database and the Logs table to see the data that is logged! (see the below pic):

At the third row you will find the message that we wrote inside the (/) endpoint.

Make some improvements to our provider

Cool, right after now I'm going to make some improvement to my custom provider and here id the list of the tasks that I will update or add to my custom provider:

Enhance the IsEnabled method in the CustomeDataBaseLogger class by reading the minimum leg level from the configuration file (if any).
Enhance our adding parameters on the SqlCommand object in the Log method.
Get the real IpAddress of the browser when write log to the back store.

The first one is very easy to do.
Open the CustomDataBaseLoggerOptions class and add a new property named MinLevel that will help us to switch the log level at any time:

    public class CustomDataBaseLoggerOptions
    {
        public string ConnectionString { get; set; } = default!;
        public string LogToTable { get; set; } = default!;
        public string TableSchema { get; set; } = default!;


        /// <summary>
        /// A new property that can help us 
        /// switching the log level at any time
        /// </summary>
        public LogLevel MinLevel { get; set; } = LogLevel.Trace;
    }

In the CustomeDataBaseLogger class update the IsEnabled method to read the value from the Options instead of typing it as a hard code:

 public bool IsEnabled(LogLevel logLevel)
 {
     return logLevel != _dbLoggerProvider.Options.MinLevel;
 }

Now in the Program.cs class update the registration of our custom logging provider to be like so:

builder.Logging.ClearProviders();
builder.Logging.AddDataBaseLogger(options =>
{
    options.ConnectionString = "YOUR CONNETION STRING GOES HERE";
    options.LogToTable = "Logs";
    options.TableSchema = "dbo";

    options.MinLevel = LogLevel.Debug;
});

I added a new option value to my custom logging provider to accept the Debug as a minimum level of logging process.

The second improvement (Enhance our adding parameter or the SqlCommand object in the Log method) from our improvement list will change the shape of our code to be more readable than the existing one by reducing the call to command.Parameters.Add **repeatedly, here I'm going to write and extension method that can make my code very clean, create a new folder in the root of the application named **Helpers, inside this folder create a new class named SqlExtensions the full code is shown here:

using Microsoft.Data.SqlClient;
using System.Data;

namespace DevDbLogger.Helpers
{
    public static class SqlExtensions
    {
        public static SqlParameterCollection AddPrameterWithValue(this SqlParameterCollection parameters, 
            string parameterName, 
            SqlDbType sqlDbType, 
            object? value,
            ParameterDirection parameterDirection,
            bool isNullable = false)
        {
            var parameter = new SqlParameter(parameterName, sqlDbType);
            parameter.Value = value;
            parameter.IsNullable = isNullable;
            parameter.Direction = parameterDirection;
            parameters.Add(parameter);
            parameter.ResetSqlDbType();
            return parameters;
        }
    }
}

After that open the CustomeDataBaseLogger class and update the Log methos to be like so:

  public void Log<TState>(LogLevel logLevel, EventId eventId, TState state, Exception? exception, Func<TState, Exception?, string> formatter)
  {
      if (!IsEnabled(logLevel))
      {
          // Don't log anything to the back store the logLevel it's not enabled.
          return;
      }

      // validation
      if (formatter == null)
      {
          throw new ArgumentNullException(nameof(formatter));
      }

      string message = formatter(state, exception);
      int lg = (int)logLevel;
      string lgTxt = ConvertLogLevelToTxtString(logLevel);
      using (var con = new Microsoft.Data.SqlClient.SqlConnection(_dbLoggerProvider.Options.ConnectionString))
      {
          using (var command = new Microsoft.Data.SqlClient.SqlCommand())
          {
              con.Open();
              command.Connection = con;
              command.CommandType = System.Data.CommandType.Text;
              command.CommandText = string.Format(
                  @"INSERT INTO {0}.{1} (LogLevel, LogLevelText, Message, TimeStamp, Exception, IpAddress) 
                      VALUES (@LogLevel, @LogLevelText, @Message, @TimeStamp, @Exception, @IpAddress);", 
                  _dbLoggerProvider.Options.TableSchema, _dbLoggerProvider.Options.LogToTable
                  );

              command.Parameters.AddPrameterWithValue("@LogLevel", System.Data.SqlDbType.Int, lg, System.Data.ParameterDirection.Input, false);

              command.Parameters.AddPrameterWithValue("@LogLevelText", System.Data.SqlDbType.NVarChar, lgTxt, System.Data.ParameterDirection.Input, false);

              command.Parameters.AddPrameterWithValue("@Message", System.Data.SqlDbType.NVarChar, message, System.Data.ParameterDirection.Input, false);

              command.Parameters.AddPrameterWithValue("@TimeStamp", System.Data.SqlDbType.DateTime2, DateTime.UtcNow, System.Data.ParameterDirection.Input, false);

              command.Parameters.AddPrameterWithValue("@Exception", System.Data.SqlDbType.NVarChar, (object?)exception ?? DBNull.Value, System.Data.ParameterDirection.Input, true);

              command.Parameters.AddPrameterWithValue("@IpAddress", System.Data.SqlDbType.NVarChar, "IpAddress", System.Data.ParameterDirection.Input, true);

              command.ExecuteNonQuery();
          }
      }
  }

Now I think the Log method is very clear and easy to read if you compare it to the old version, and you can see that by using the new AddPrameterWithValue extension method.

Are you still here?! glad to be seeing you staying here and reading!

Now I'm going to finishing-up the application by getting the real IpAddress of the browser that I mentioned it in the last point of our improvement list (Get the real IpAddress of the browser when write log to the back store).

Inside Helpers folder I'm going to create a Interface named IWebHelper and has one member named GetCurrentIpAddress like so:

namespace DevDbLogger.Helpers
{
    public interface IWebHelper
    {
        string GetCurrentIpAddress();
    }
}

Now create in the same folder (Helpers) the concrete class that will implement the IWebHelper interface and the name of this class is WebHelper as shown here:

using System.Net;

namespace DevDbLogger.Helpers
{
    public class WebHelper : IWebHelper
    {
        public readonly IHttpContextAccessor _httpContext;
        public WebHelper(IHttpContextAccessor httpContext)
        {
            _httpContext = httpContext;
        }
        public string GetCurrentIpAddress() 
        {
            if (_httpContext?.HttpContext?.Connection?.RemoteIpAddress is not IPAddress remoteIp)
                return "";

            if (remoteIp.Equals(IPAddress.IPv6Loopback))
                return IPAddress.Loopback.ToString();

            return remoteIp.MapToIPv4().ToString();
        }
    }
}

Here I inject the IHttpContextAccessor to get the IpAddress from the HttpContext object, and checking the type of the IpAddress is it v6 or v4.
Last things before running the application I have to register the new object in the container service, open the Program.cs class and add these two lines to the service configure area:

builder.Services.AddHttpContextAccessor();
builder.Services.AddSingleton<IWebHelper, WebHelper>();

Then update the constructor of the CustomeDataBaseLogger object and add the IWebHelper interface to it, the last version of this class it should be like the following code:

private readonly CustomDataBaseLoggingProvider _dbLoggerProvider;
private readonly IWebHelper _webHelper;
public CustomeDataBaseLogger([NotNull] CustomDataBaseLoggingProvider dataBaseLoggerProvider, IWebHelper webHelper)
{
    _dbLoggerProvider = dataBaseLoggerProvider;
    _webHelper = webHelper;
}

Also don't forget to update the value of the IpAddress parameter in the Log method by getting the value from the _webHelper.GetCurrentIpAddress() method:

 command.Parameters.AddPrameterWithValue("@IpAddress", System.Data.SqlDbType.NVarChar, _webHelper.GetCurrentIpAddress(), System.Data.ParameterDirection.Input, true);

Lastly, update the CustomDataBaseLoggingProvider object to accept the IWebHelper interface, because when the ILoggerProvider **interface creates and instance of our logger class (in this case is **CustomeDataBaseLogger object) it should pass the IWebHelper interface as a second parameter, next you will see the last version of the CustomDataBaseLoggingProvider object:

using Microsoft.Extensions.Options;

namespace DevDbLogger.Advanced.CustomLogging
{
    public class CustomDataBaseLoggingProvider : ILoggerProvider
    {
        public readonly CustomDataBaseLoggerOptions Options;
        private readonly IWebHelper _webHelper;

        public CustomDataBaseLoggingProvider(IOptions<CustomDataBaseLoggerOptions> options, IWebHelper webHelper)
        {
            Options = options.Value;
             _webHelper = webHelper;
        }

        public ILogger CreateLogger(string categoryName)
        {

            return new CustomeDataBaseLogger(this, _webHelper);
        }

        public void Dispose()
        {

        }
    }
}

Now, run the application and if you open the Logs table to see the value of the IpAddress you will find it 127.0.0.1 if you run the application in the local environment.

Look at the row number 27 in the above pic.
Thanks for reading.
Mohammed!

Encrypt and Decrypt users' data in ASP.NET Core Identity using the ILookupProtector and ILookupProtectorKeyRing interfaces

Mohammed Ahmed Hussien — Sat, 01 Apr 2023 09:47:33 +0000

Decrypting and Encrypting users' data in ASP.NET Core Identity are straightforward task; all you have to do is to implement a two interface to accomplish this task.
In this new post I'm going to show you how to encrypt and decrypt the users' data in ASP.NET Core Identity targeting .NET 7
You can buy my full course on Udemy that discuss more advanced topics in ASP.NET Core Identity from here: https://www.udemy.com/course/advanced-aspnet-core-identity-in-net-7/

So, Encrypting and decrypting data is high level way to secure your content, and there is more than one algorithm help us to do that. Here I'm going to user AES algorithm (Advanced Encryption Standard) to complete my task, so let's do that.
I suppose you have a ready ASP.NET Core Application with configured Identity Core. All I have to do here is to configure the relate options that I need to let ASP.NET Core Identity know how to encrypt and decrypt users' data.

To decrypt and encrypt the user data in ASP.NET Core Identity you have to implement two interfaces the first one is ILookupProtectorKeyRing and the second one is the ILookupProtector.

The ILookupProtectorKeyRing:
This interface has three members and all these members related to the key that we are going to use when we decrypt and encrypt users' data and as you can see below these members: (more details later)

string CurrentKeyId { get; }
string this[string keyId] { get; }
IEnumerable<string> GetAllKeyIds();

The ILookupProtector:
This interface has two members the first one to encrypt the users' data and the second one to decrypt the data that you encrypted (more details later):

string? Protect(string keyId, string? data);
string? Unprotect(string keyId, string? data);

The Implementation inside our Application

So, I have a folder in my application root named Infrastructure, inside this folder I have create a new class named CustomLookupProtectorKeyRing in this class I'm going to implement the ILookupProtectorKeyRing interface:

public class CustomLookupProtectorKeyRing : ILookupProtectorKeyRing
{
    public string this[string keyId]
    {
        get
        {
            return GetAllKeyIds().Where(x => x == keyId).FirstOrDefault();
        }
    }

    public string CurrentKeyId
    {
        get
        {
            byte[] key = { 200, 15, 147, 5, 155, 78, 118, 57, 180, 179, 60, 150, 188, 18, 165, 134 };
            var currentKey = Convert.ToBase64String(key);
            return currentKey;
        }
    }

    public IEnumerable<string> GetAllKeyIds()
    {
        var list = new List<string>();
        // This is 24 bytes length
        byte[] key = { 200, 15, 147, 5, 155, 78, 118, 57, 180, 179, 60, 150, 188, 18, 165, 134 };
        byte[] key2 = { 242, 207, 146, 81, 121, 231, 168, 93, 89, 130, 4, 68, 18, 185, 98, 154 };
        byte[] key3 = { 101, 104, 174, 233, 88, 29, 20, 16, 21, 216, 249, 45, 148, 18, 102, 150 };

        list.Add(Convert.ToBase64String(key));
        list.Add(Convert.ToBase64String(key2));
        list.Add(Convert.ToBase64String(key3));


        return list;
    }
}

First the GetAllKeyIds() method holds all available keys that you have to use it with the encryption algorithm. All the key here is 24 bytes length.
Second the CurrentKeyId property returns the current that are going to use in the encryption and decryption process.
The last thing is an indexer (this) to search for any key by its position (indexing).

So, our first class is done, we need another class and the mission of this class is to encrypt and decrypt the users' data, so in the Infrastructure folder create a new class named CustomLookupProtector in this class I'm going to implement the ILookupProtector interface:

public class CustomLookupProtector : ILookupProtector
{

    byte[] iv = { 208, 148, 29, 187, 168, 51, 181, 178, 137, 83, 40, 13, 28, 177, 131, 248 };
    public string Protect(string keyId, string data)
    {
        byte[] plainTextBytes = Encoding.UTF8.GetBytes(data);

        string cipherText;
        using (SymmetricAlgorithm algorithm = Aes.Create())
        {
            using (ICryptoTransform encryptor = algorithm.CreateEncryptor(Encoding.UTF8.GetBytes(keyId), iv))
            {
                using (MemoryStream ms = new MemoryStream())
                {
                    using (CryptoStream cryptoStream = new CryptoStream(ms, encryptor, CryptoStreamMode.Write))
                    {
                        cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length);
                        cryptoStream.Close();
                        byte[] chiperTextByte = ms.ToArray();
                        cipherText = Convert.ToBase64String(chiperTextByte);
                    }
                }
            }
        }

        return cipherText;
    }


    public string Unprotect(string keyId, string data)
    {
        byte[] cipherTextBytes = Convert.FromBase64String(data);
        string plainText;
        using (SymmetricAlgorithm algorithm = Aes.Create())
        {
            using (ICryptoTransform decrypter = algorithm.CreateDecryptor(Encoding.UTF8.GetBytes(keyId), iv))
            {
                using (MemoryStream ms = new MemoryStream(cipherTextBytes))
                {
                    using (CryptoStream cryptoStream = new CryptoStream(ms, decrypter, CryptoStreamMode.Read))
                    {
                        using (StreamReader streamReader = new StreamReader(cryptoStream))
                        {
                            plainText = streamReader.ReadToEnd();
                        }
                    }
                }
            }
        }

        return plainText;
    }
}

First, we have a Protect() method this method accept two arguments the first one is the keyId by default the value of this parameter is coming from the CurrentKeyId property that is defined in the CustomLookupProtectorKeyRing class that we created in the previous step. The second parameter is the data, and ASP.NET Core Identity by default will encrypt five columns in the AspNetUsers table:

UserName
NormalizedUserName
Email
NormalizedEmail
PhoneNumber

So the Protect() will be call five times during the creation process of the user account. The remaining or the implementation of the method is very clear and it a pure C# code that will encrypt a plain text (data) and then return the encrypted data as Base64.
Second, we have an Unprotect() method which is do the opposite job of Protect() method and also it accept two arguments the first on is the keyId and this is the same key that you used when you encrypt the data and the second parameter is the encrypted data (UserName, NormalizedUserName, Email, NormalizedEmail, PhoneNumber) and after that will return the original data for user.

The last things we need to do is to inform the ASP.NET Core Identity we are going to encrypt the users' data by using the in our application and to accomplish this task we need to use the AddPersonalDataProtection extension method and this method accept a two type parameters the first one a class that should implement ILookupProtector interface and the second type parameter should be a class that implement ILookupProtectorKeyRing so, open the Program.cs class
and in the registration service of the ASP.NET Core Identity add this line right after AddDefaultTokenProviders method:

.AddPersonalDataProtection<CustomLookupProtector, CustomLookupProtectorKeyRing>();

One more thing in the configuration option of ASP.NET Core Identity add also the below line.
(Be sure to add this option because without it aspnet core identity will not going to encrypt and decrypt users' data)

options.Stores.ProtectPersonalData = true;

Here is the complete configuration:

builder.Services.AddIdentity<AppUser, IdentityRole>(options =>
{
    options.Password.RequireDigit = true;
    options.Password.RequireLowercase = true;
    options.Password.RequiredLength = 5;
    options.Password.RequireUppercase = false;
    options.Password.RequireNonAlphanumeric = false;

    options.User.RequireUniqueEmail = true;

    options.SignIn.RequireConfirmedAccount = true;
    options.SignIn.RequireConfirmedEmail = true;

    options.Lockout.AllowedForNewUsers = false;
    options.Lockout.DefaultLockoutTimeSpan = System.TimeSpan.FromMinutes(3); // The Default Lock time is 5 minutes
    options.Lockout.MaxFailedAccessAttempts = 5;

    // be sure to add this option because without it aspnet core
    // identity will not going to encrypt and decrypt users data

    options.Stores.ProtectPersonalData = true; 

}).AddEntityFrameworkStores<BaseDBContext>()
.AddDefaultTokenProviders()
.AddPersonalDataProtection<CustomLookupProtector, CustomLookupProtectorKeyRing>();

Now let us run our sample and create a new account.

And if you see the below pic you will catch that there five columns are encrypted

Then let me try to login and see if the ASP.NET Core Identity can decrypt my data without any issue or not! ( belive me ASP.NET Core Identity can decrypt the data, unless you change the rgbkey that you used in the CreateEncryptor method which is defined in the SymmetricAlgorithm object 😉).

And Here is the Main Page:

So, now we see how we can encrypt the users' data by using interfaces that are provided by ASP.NET Core Identity, but at any time you should encrypt your users' data?! this is a big question; and to answer this question you have to know that ASP.NET Core Identity can't work in two ways, by another words ASP.NET Core Identity works with plain text data for your users or Encrypted data, but you can't combine between them, and in my opinion this is a problem or let me say from my site this is a problem, imagine that, you have a third party provider let us say Active Directory, and you want to encrypt any data for all users coming from this provider, but in the same time you won't do that for the users using your local provider.
Thanks for reading.

Reduce The 2FA'S Token Provider Length in ASP.NET Core Identity To 4 Digits Instead Of 6 Digits in .NET 7

Mohammed Ahmed Hussien — Tue, 13 Dec 2022 21:39:00 +0000

In this new post I will show you how to work with two factor authentication and how to reduce the token provider length from 6 digits to 4 digits.
In the first step we have to create our sample application from scratch by creating a new Empty ASP.NET Core Application from visual Studio 2022 and using .NET 7.

First of all, to follow with me, please download the complete code form my GitHub repo from AspNetCoreIdentity-IUserTwoFactorTokenProvider

I'm not going here to explain how to create a new user in ASP.NET Core Identity but I will guide you how to accomplish the two-factor authentication step after success login from the user.
And ensure you have one user at least in your Back Store with enabled TowFactorEnabled property to true, see the pic below:

In the root of the application create a new folder named Services and inside this folder create a new class and interface as you see in the following code snippet (I will explain later...)

namespace AspNetCoreIdentity.Services
{
    public interface ITokenStoreService
    {
        bool StoreToken(string key, string token);
        bool RemoveToken(string key);
        string GetToken(string key);
    }
}

And here the implementation of this interface like below:

using System.Collections.Concurrent;

namespace AspNetCoreIdentity.Services
{
    public class TokenStoreService : ITokenStoreService
    {
        private readonly ConcurrentDictionary<string, string> _tokenProviderStore = new ConcurrentDictionary<string, string>();

        public bool RemoveToken(string key)
        {
            var result = _tokenProviderStore.TryRemove(key, out _);
            return result; 
        }

        public bool StoreToken(string key, string token)
        {
            if (!_tokenProviderStore.ContainsKey(key))
            {
                var result = _tokenProviderStore.TryAdd(key, token);
                return result;
            }
            return false;
        }

        public string GetToken(string key)
        {
            var result = _tokenProviderStore.TryGetValue(key, out string token );
            if(result)
                return token;
            return null;
        }
    }
}

Make sure to register TokenStoreService.cs class at Program.cs file like below:

builder.Services.AddSingleton<ITokenStoreService, TokenStoreService>();

This class will help us to store the generated token provider in the ConcurrentDictionary

In the root of the application create a new folder named Helpers and inside this folder create a new class named CustomTwoFactorTokenProvider.cs this class has the following signature:

using AspNetCoreIdentity.Models;
using AspNetCoreIdentity.Services;
using Microsoft.AspNetCore.Identity;
using System;
using System.Threading.Tasks;

namespace AspNetCoreIdentity.Helpers
{
    public class CustomTwoFactorTokenProvider 
    : IUserTwoFactorTokenProvider<ApplicationUser>
    {
        private readonly ITokenStoreService _tokenStoreService;
        public CustomTwoFactorTokenProvider(ITokenStoreService tokenStoreService)
        {
            _tokenStoreService = tokenStoreService;
        }
        public Task<bool> CanGenerateTwoFactorTokenAsync(UserManager<ApplicationUser> manager, ApplicationUser user)
        {
            return Task.FromResult(manager.SupportsUserTwoFactor);
        }

        public Task<string> GenerateAsync(string purpose, UserManager<ApplicationUser> manager, ApplicationUser user)
        {
            Random random = new Random();
            int token = random.Next(1000, 9999);

            if (_tokenStoreService.StoreToken(user.Id, token.ToString()))
                return Task.FromResult(token.ToString());

            return Task.FromResult(string.Empty);
        }

        public Task<bool> ValidateAsync(string purpose, string token, UserManager<ApplicationUser> manager, ApplicationUser user)
        {
            var storedToken = _tokenStoreService.GetToken(user.Id);
            if (storedToken != null)
            {
                bool result = storedToken.Equals(token);
                _tokenStoreService.RemoveToken(user.Id);

                return Task.FromResult(result);
            }
            return Task.FromResult(false);
        }
    }
}

When your application supports the 2FA the ASP.NET Core Identity will help you to generate a token by calling a method from the UserManager object named GenerateTwoFactorTokenAsync this method will generate a code that contains 6 digits, and as you working in this field (Software programming) you will meet at least one customer, who don't like this approach, that enforce the user to insert 6 digits to complete their login process, and maybe he will ask you to reduce the number to 4 digits.
So how you can fix that? And from where the token that has contains 6 digits come?
When you register the ASP.NET Core Identity at the level of your application inside the Program.cs class we inform the ASP.NET Core Identity to accept the default token provider by add this extension AddDefaultTokenProviders to the AddIdentity extension the AddDefaultTokenProviders extension has all token providers that our applications need to work with them like working with Email Confirmation Provider and Reset Password Token Provider and Registration any type of Authenticators Provider ( like google Authenticator, you can read my article about how to configure Google Authenticator with ASP.NET Core Identity from here.
So, in our case we need to work with TwoFactorUserId Provider and this will enforce our users to complete their login process in two steps.
ASP.NET Core Identity provide us with an interface name IUserTwoFactorTokenProvider and by inheriting from this interface we can change the default implementation of the TwoFactorUserId Provider as you see in the above code and this interface has three members like below:

Task<bool> CanGenerateTwoFactorTokenAsync(UserManager<TUser> manager, TUser user);
Task<string> GenerateAsync(string purpose, UserManager<TUser> manager, TUser user);
Task<bool> ValidateAsync(string purpose, string token, UserManager<TUser> manager, TUser user);

The first method CanGenerateTwoFactorTokenAsync will be calling when we call the GetTwoFactorEnabledAsync method from the UserManager object and this method (GetTwoFactorEnabledAsync) will return IList of the all available providers for the current user that he wants to login in our application, and the type of the provider in our case is Identity.TwoFactorUserId beacuse when we register the ASP.NET Core Identity we use the custom two factor authentication provider with name Identity.TwoFactorUserId, like so in the Program.cs file:

builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
    options.SignIn.RequireConfirmedAccount = true;
    options.SignIn.RequireConfirmedPhoneNumber = true;
    options.Password.RequireDigit = true;
    options.Password.RequireLowercase = true;
    options.Password.RequiredLength = 5;
    options.Password.RequireUppercase = false;
    options.Password.RequireNonAlphanumeric = false;
    options.Lockout.MaxFailedAccessAttempts = 5;
    options.User.RequireUniqueEmail = true;
}).AddRoles<IdentityRole>().AddEntityFrameworkStores<BaseDbContext>()
.AddTokenProvider<CustomTwoFactorTokenProvider>(IdentityConstants.TwoFactorUserIdScheme);

builder.Services.AddAuthentication(opt =>
{
    opt.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
}).AddCookie(options =>
{
    options.LoginPath = "/Accounts/Login";
});

Keep your eyes open at our default token provider here, we use the AddTokenProvider instead of the AddDefaultTokenProviders

.AddTokenProvider<CustomTwoFactorTokenProvider>(IdentityConstants.TwoFactorUserIdScheme);

The CanGenerateTwoFactorTokenAsync metho it will depend on your business and as you can see here, I return result of Boolean (true) if the current has TowFactorEnabled's property set to true in the back store (SQL Server in my case), feel free to apply any business fits your needs.

So, after we return IList of the all available providers we will generating the token provider by calling GenerateTwoFactorTokenAsync method from the UserManager object and in the same way this method will call GenerateAsync method internally from the CustomTwoFactorTokenProvider.cs class after that we sending the token provier to our user (by SMS or Email service) then, the user will apply this token (code) in a completely new screen, and your job is to validate the token that coming from the user with the one that you're generate it and sending it to that user, so here you will call the VerifyTwoFactorTokenAsync method from the UserManager object also, and by calling this method it will call the ValidateAsync from the our custom class CustomTwoFactorTokenProvider.cs that has implements the IUserTwoFactorTokenProvider interface.
So, we need a to store the custom token provider that we generate and send it to our user in a safe place, for that reason I create the TokenStoreService.cs class that you see it at the beginning of this article. Be sure to remove the token provider from the ConcurrentDictionary after validation it to avoids any duplication of the key in that dictionary.

Let us give it a try by firing the application and navigate to the https:localhost:port/Home/Home/SecureContent

Here is the Login screen:

And as you can see here, I dropped the token provider to Debug output to five myself a chance to apply it in the two-step screen

The code is 2607

And here is the two-step screen:

And last but not least the SecureContent page with my name as current logged-in user

Build your own OAuth 2.0 Server and OpenId Connect Provider in ASP.NET Core 6.0

Mohammed Ahmed Hussien — Fri, 28 Oct 2022 06:52:22 +0000

Update 20, April 2023
This article is out of date because I added more functionality to this OAuth server, so to be more updated I suggest downloading the project or clone it from my GitHub repo here

Yeah, I know the title of this post is very interesting, and I hope you enjoy this journey to building your OAuth 2.0 Server and OpenId Connect Provider with me.
And I and you, we are a team.
But hey wait, there is also one member in our team, let me introduce you to him, Specification

I'm not going here to explain to you how the OAuth 2.0 and OpenId Connect works, but I will explain for you how to implement what inside specifications, at least the basics and fundamentals.
The Authorization Server that we are going to build is very simple but is complete one.

If you are not interesting to read this article don't worry you can download the completed source code from my Github repo from here

First of all, let me give you an overview about what we're going to build right here.

Authorization Server (in ASP.NET Core MVC)
ASP.NET Core MVC Application

First let us Create our Client application (ASP.NET Core MVC)

Open the Visual Studio and create an Empty ASP.NET Core App (see below) named PlatformNet6 (you can give it a name you like)

Choose NET6 (LTS) version (see the pic below)

Create a folder named Controllers and inside this folder create a new controller class named HomeController.cs
In the recent HomeController class you will find one Action Method named Index, Press right click on the name of the project and create a new folder named Views, back to Index Action Method on the HomeControllers.cs press right click on it and choose the Add View option from the menu.
The HomeController class should look like:

namespace PlatformNet6.Controllers
{
    [Authorize]
    public class HomeController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }
    }
}

By using Nuget Packages install this Library:

Microsoft.AspNetCore.Authentication.OpenIdConnect

Open the Program.cs class and drop the code that shown below:

var builder = WebApplication.CreateBuilder(args);
    JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

    builder.Services.AddAuthentication(config =>
    {
        config.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        config.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    })
     .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
     .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
        {
            // this is my Authorization Server Port
            options.Authority = "https://localhost:7275";
            options.ClientId = "platformnet6";
            options.ClientSecret = "123456789";
            options.ResponseType = "code";
            options.CallbackPath = "/signin-oidc";
            options.SaveTokens = true;
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = false,
                SignatureValidator = delegate(string token, TokenValidationParameters validationParameters)
                {
                    var jwt = new JwtSecurityToken(token);
                    return jwt;
                },
            };
        });
builder.Services.AddControllersWithViews();

 var app = builder.Build();
    app.UseStaticFiles();
    app.UseRouting();


    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapDefaultControllerRoute();
    });
    app.Run();

In the above code I use the AddOpenIdConnect extension that inform ASP.NET Core to redirect the app to the Authorization Server when find any Authorize attribute on any Action Method or Controller. I'm going to use Cookies as Default authentication scheme and OpenIdConnect as Default Challenge Scheme.
Oooooooops we finish our client app, we will back to this application to complete the content of the Index.cshtml page.

The Authorization Server Project

In this section we are going to build our Authorization Server and this section is the mail section in this Post.

Open Visual Studio and create an Empty ASP.NET Core App (see below) named OAuth20.Server (you can give it a name you like)
Please look at the name of the solution is OAuth20

Choose NET6 (LTS) version (see the pic below)

Create these folders in the root of our application:

Controllers
Common
Endpoints
Models
OauthRequest
OauthResponse
Services
Views

The structure of our Authorization Server looks like the below picture

By using Nuget Packages install this Library:

System.IdentityModel.Tokens.Jwt

If you look at the specification https://www.rfc-editor.org/rfc/rfc6749 the main role of the OAuth 2.0 is the Client and the client here is the Application that used by the Resource Owner and the Resource Owner is the person who used that application. For example, I'm Mohammed Ahmed Hussien and I used the Dev.to to read the latest articles about Software.
Here Dev.to is the Client and Mohammed Ahmed Hussien is the Resource Owner.
Inside Model folder create a new class named Client.cs

using System.Collections.Generic;

namespace OAuth20.Server.Models
{
    public class Client
    {
        public Client()
        {

        }

        public string ClientName { get; set; }
        public string ClientId { get; set; }

        /// <summary>
        /// Client Password
        /// </summary>
        public string ClientSecret { get; set; }

        public IList<string> GrantType { get; set; }

        /// <summary>
        /// by default false
        /// </summary>
        public bool IsActive { get; set; } = false;
        public IList<string> AllowedScopes { get; set; }

        public string ClientUri { get; set; }
        public string RedirectUri { get; set; }
    }
}

The specification says that the RedirectUri must accept an array of the URI, and as you see in our Client.cs class the RedirectUri is accept only string value not Array values. But I will promise you I will fix that later, trust me!

OpenId Connect build on top of the OAuth2.0 protocol and the main purpose of it is to authenticate the user. And if you remember we use the AddOpenIdConnect extension to authenicate our users in the PlatformNet6 application this extension scans for endpoint have name .well-known/openid-configuration and this endpoint shoud return json response with all the information that OpenId Connect needs, consult the OpenId Connect Docs for more details from here: https://openid.net/specs/openid-connect-discovery-1_0.html
Inside Endpoints folder create a new class named DiscoveryResponse.cs and paste the next code inside it:

using System.Collections.Generic;

namespace OAuth20.Server.Endpoints
{
    public class DiscoveryResponse
    {
        public string issuer { get; set; }
        public string authorization_endpoint { get; set; }
        public string token_endpoint { get; set; }
        public IList<string> token_endpoint_auth_methods_supported { get; set; }
        public IList<string> token_endpoint_auth_signing_alg_values_supported { get; set; }
        public string userinfo_endpoint { get; set; }
        public string check_session_iframe { get; set; }
        public string end_session_endpoint { get; set; }
        public string jwks_uri { get; set; }
        public string registration_endpoint { get; set; }
        public IList<string> scopes_supported { get; set; }
        public IList<string> response_types_supported { get; set; }
        public IList<string> acr_values_supported { get; set; }
        public IList<string> subject_types_supported { get; set; }
        public IList<string> userinfo_signing_alg_values_supported { get; set; }
        public IList<string> userinfo_encryption_alg_values_supported   { get; set; }
        public IList<string> userinfo_encryption_enc_values_supported { get; set; }
        public IList<string> id_token_signing_alg_values_supported { get; set; }
        public IList<string> id_token_encryption_alg_values_supported { get; set; }
        public IList<string> id_token_encryption_enc_values_supported { get; set; }
        public IList<string> request_object_signing_alg_values_supported { get; set; }
        public IList<string> display_values_supported { get; set; }
        public IList<string> claim_types_supported { get; set; }
        public IList<string> claims_supported { get; set; }
        public bool claims_parameter_supported { get; set; }
        public string service_documentation { get; set; }
        public IList<string> ui_locales_supported { get; set; }
    }
}

The most important properties of this class is:

issuer (is the domain name of the Identity Provider)
authorization_endpoint (the endpoint that validate the client)
token_endpoint (the return the Identity Token and the Access Token to the client) As I said before the AddOpenIdConnect extension scans for endpoint with name .well-known/openid-configuration, so let us create this endpoint

Inside the Controllers folder create a new controller class named DiscoveryEndpointController.cs paste the code that shown next:

using Microsoft.AspNetCore.Mvc;
using OAuth20.Server.Endpoints;

namespace OAuth20.Server.Controllers
{
    public class DiscoveryEndpointController : Controller
    {
        // .well-known/openid-configuration
        [HttpGet("~/.well-known/openid-configuration")]
        public JsonResult GetConfiguration()
        {
            var response = new DiscoveryResponse
            {
                issuer = "https://localhost:7275",
                authorization_endpoint = "https://localhost:7275/Home/Authorize",
                token_endpoint = "https://localhost:7275/Home/Token",
                token_endpoint_auth_methods_supported = new string[] { "client_secret_basic", "private_key_jwt" },
                token_endpoint_auth_signing_alg_values_supported = new string[] { "RS256", "ES256" },

                acr_values_supported = new string[] {"urn:mace:incommon:iap:silver", "urn:mace:incommon:iap:bronze"},
                response_types_supported = new string[] { "code", "code id_token", "id_token", "token id_token" },
                subject_types_supported = new string[] { "public", "pairwise" },

                userinfo_encryption_enc_values_supported = new string[] { "A128CBC-HS256", "A128GCM" },
                id_token_signing_alg_values_supported = new string[] { "RS256", "ES256", "HS256" },
                id_token_encryption_alg_values_supported = new string[] { "RSA1_5", "A128KW" },
                id_token_encryption_enc_values_supported = new string[] { "A128CBC-HS256", "A128GCM" },
                request_object_signing_alg_values_supported = new string[] { "none", "RS256", "ES256" },
                display_values_supported = new string[] { "page", "popup" },
                claim_types_supported = new string[] { "normal", "distributed" },

                scopes_supported = new string[] { "openid", "profile", "email", "address", "phone", "offline_access" },
                claims_supported = new string[] { "sub", "iss", "auth_time", "acr", "name", "given_name",
                    "family_name", "nickname", "profile", "picture", "website", "email", "email_verified",
                    "locale", "zoneinfo" },
                claims_parameter_supported = true,
                service_documentation = "https://localhost:7275/connect/service_documentation.html",
                ui_locales_supported = new string[] { "en-US", "en-GB", "en-CA", "fr-FR", "fr-CA" }

            };
            return Json(response);
        }
    }
}

The return type of this Action Method is josn result, and the name of this endpoint is decorated inside HttpGet attribute

 [HttpGet("~/.well-known/openid-configuration")]

Be sure to change the Ports of the endpoints to that one Visual Studio created for you.

My own port is https://localhost:7275

To check if everything is works correctly hit a Breakpoint in this endpoint (.well-known/openid-configuration) and run the OAuth20.Server Authorization Server app, after that run the PlatformNet6 application, you will find the breakpoint is triggered.

Be sure of the setting at the PlatformNet6 application

     .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
        {
            // this is my Authorization Server Port
            options.Authority = "https://localhost:7275";
            options.ClientId = "platformnet6";
            options.ClientSecret = "123456789";
            options.ResponseType = "code";
            options.CallbackPath = "/signin-oidc";
            options.SaveTokens = true;
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = false,
                SignatureValidator = delegate(string token, TokenValidationParameters validationParameters)
                {
                    var jwt = new JwtSecurityToken(token);
                    return jwt;
                },
            };
        });

So far so good at this stage we prepare the Authorization Server to accept calls from any client.
Let us break the ice by creating a common C# extension Method
Inside Common folder create a new class named ExtensionMethods.cs this class has a signature as follow:

using System.ComponentModel;
using System;
using System.Linq;

namespace OAuth20.Server.Common
{
    public static class ExtensionMethods
    {
        public static string GetEnumDescription(this Enum en)
        {
            if (en == null) return null;

            var type = en.GetType();

            var memberInfo = type.GetMember(en.ToString());
            var description = (memberInfo[0].GetCustomAttributes(typeof(DescriptionAttribute),
                false).FirstOrDefault() as DescriptionAttribute)?.Description;

            return description;
        }



        public static bool IsRedirectUriStartWithHttps(this string redirectUri)
        {
            if(redirectUri != null && redirectUri.StartsWith("https")) return true;

            return false;
        }
    }
}

Instead of creating a static class with const fields of type string I will use Enum type and any filed inside the Enum I will decorate it with the Description attribute, so If I need a value inside this attribute I will use GetEnumDescription extension method.

Inside Model folder create enum type named AuthorizationGrantTypesEnum.cs

using System.ComponentModel;

namespace OAuth20.Server.Models
{
    internal enum AuthorizationGrantTypesEnum : byte
    {
        [Description("code")]
        Code,

        [Description("Implicit")]
        Implicit,

        [Description("ClientCredentials")]
        ClientCredentials,

        [Description("ResourceOwnerPassword")]
        ResourceOwnerPassword
    }
}

Back to Model folder the create a new class named GrantTypes.cs

using OAuth20.Server.Common;
using System.Collections.Generic;

namespace OAuth20.Server.Models
{
    public class GrantTypes
    {
        public static IList<string> Code =>
            new[] { AuthorizationGrantTypesEnum.Code.GetEnumDescription() };

        public static IList<string> Implicit =>
            new[] { AuthorizationGrantTypesEnum.Implicit.GetEnumDescription() };
        public static IList<string> ClientCredentials =>
            new[] { AuthorizationGrantTypesEnum.ClientCredentials.GetEnumDescription() };
        public static IList<string> ResourceOwnerPassword =>
            new[] { AuthorizationGrantTypesEnum.ResourceOwnerPassword.GetEnumDescription() };
    }
}

Consult the specification for more details about this class from here https://www.rfc-editor.org/rfc/rfc6749#page-23

The second endpoint that the AddOpenIdConnect extension looks for it is the Authorization endpoint and the mission of this endpoint is validate the client. Before going deeper let us create our client store object, this object will hold all clients that would like to use our Authorization Server. Inside Model folder create a new class named ClientStore.cs and the content of this class it looks as follow:

using System.Collections.Generic;

namespace OAuth20.Server.Models
{
    public class ClientStore
    {
        public IEnumerable<Client> Clients = new[]
        {
            new Client
            {
                ClientName = "platformnet .Net 6",
                ClientId = platformnet6",
                ClientSecret = "123456789",
                AllowedScopes = new[]{ "openid", "profile"},
                GrantType = GrantTypes.Code,
                IsActive = true,
                ClientUri = "https://localhost:7026",
                RedirectUri = "https://localhost:7026/signin-oidc"
            }
        };
    }
}

The ClientUri and RedirectUri it should mention the PlatformNet6 application (Client) that we created previously at beginning of this post. Be sure to replace the Port with the one that Visual Studio created for you, (Just the port). the ClientName should match the one that you introduce in the PlatformNet6 as well as ClientId and ClientSecret and GrantType

Please let us take a break and come back to complete this post, I feel tired, and I have to take a cup of tea

So, I'm here, and I'm so glad you are here also with me at this stage!

Let's creating the Authorization endpoint but before that I need to explain how this endpoint works.
If you remember when we configure the .well-known/openid-configuratio endpoint we assign https://localhost:7275/Home/Authorize as value of the authorization_endpoint property, so the OpenIdConnect extension scan for the endpoint with name .well-known/openid-configuratio and it expect to find in the response a location of the authorization_endpoint, like so:

 authorization_endpoint = "https://localhost:7275/Home/Authorize"

The authorization_endpoint is the second place the AddOpenIdConnect looks for, and in that request the AddOpenIdConnect take more than one parameter with the current request (HTTPContext), let's take a look.
Create a new class inside OauthRequest folder named AuthorizationRequest.cs and the content of this class as follow:


namespace OAuth20.Server.OauthRequest
{
    public class AuthorizationRequest
    {
        public AuthorizationRequest() { }
        /// <summary>
        /// Response Type, is required
        /// </summary>
        public string response_type { get; set; }

        /// <summary>
        /// Client Id, is required
        /// </summary>

        public string client_id { get; set; }

        /// <summary>
        /// Redirect Uri, is optional
        /// The redirection endpoint URI MUST be an absolute URI as defined by
        /// [RFC3986] Section 4.3
        /// </summary>

        public string redirect_uri { get; set; }

        /// <summary>
        /// Optional
        /// </summary>
        public string scope { get; set; }

        /// <summary>
        /// Return the state in the result 
        /// if it was present in the client authorization request
        /// </summary>
        public string state { get; set; }
    }
}

So, let's dive in and create the Authorization endpoint.

Inside Controllers folder create a new controller named HomeController.cs, see the content of this controller below:

using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using OAuth20.Server.OauthRequest;


namespace OAuth20.Server.Controllers
{
    public class HomeController : Controller
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        public HomeController(IHttpContextAccessor httpContextAccessor)
        {
            _httpContextAccessor = httpContextAccessor;
        }


        public IActionResult Authorize(AuthorizationRequest authorizationRequest)
        {
            // The implementation goes here
        }
        public IActionResult Error(string error)
        {
            return View(error);
        }
    }
}

If look carefully I use the IHttpContextAccessor interface that provide access to the current HttpContext's Request.
You have to register this interface at Program.cs file like so:

builder.Services.AddHttpContextAccessor();

Inside HomeController class I defined two Action Method:

Authorize
Error

The last one is very simple if there is any error has been happening, then redirect the Resource Owner to the Error action method, this Action Method take one parameter of type string, and the name of this errors has standard name, let us create a Enum class take care of all these error name.
Inside OauthResponse folder create class named ErrorTypeEnum.cs as follow:

using System.ComponentModel;
namespace OAuth20.Server.OauthResponse
{
    public enum ErrorTypeEnum : byte
    {
        [Description("invalid_request")]
        InvalidRequest,

        [Description("unauthorized_client")]
        UnAuthoriazedClient,

        [Description("access_denied")]
        AccessDenied,

        [Description("unsupported_response_type")]
        UnSupportedResponseType,

        [Description("invalid_scope")]
        InValidScope,

        [Description("server_error")]
        ServerError,

        [Description("temporarily_unavailable")]
        TemporarilyUnAvailable,

        [Description("invalid_grant")]
        InvalidGrant,

        [Description("invalid_client")]
        InvalidClient
    }
}

Consult the OAuth2.0 specification for more details about the error types
Back to Authorize endpoint (Action Method) in the HomeController class, in this endpoint we have to verify the Client request data that coming inside request with the one that we stored it inside the ClientStore.cs class

By the way you can store the client information at any back store like SQL Server Database, for simplicity I store it inside C# class.

The Client is expected from me a response result if the Authorize* endpoint verifies the Client successfully, for that we need a class take care of the property of that response, so inside OauthResponse folder create a new class named AuthorizeResponse.cs as follow:

using System.Collections.Generic;

namespace OAuth20.Server.OauthResponse
{
    public class AuthorizeResponse
    {
        /// <summary>
        /// code or implicit grant or client creditional 
        /// </summary>
        public string ResponseType { get; set; } 
        public string Code { get; set; }
        /// <summary>
        /// required if it was present in the client authorization request
        /// </summary>
        public string State { get; set; }

        public string RedirectUri { get; set; }
        public IList<string> RequestedScopes { get; set; }
        public string GrantType { get; set; }
        public string Nonce { get; set; }
        public string Error { get; set; } = string.Empty;
        public string ErrorUri { get; set; }
        public string ErrorDescription { get; set; }
        public bool HasError => !string.IsNullOrEmpty(Error);
    }
}

From OpenId Connect specification the authentication response should look similar like so:

HTTP/1.1 302 Found Location: https://client.example.org/cb? code=SplxlOBeZQQYbYS6WxSbIA &state=af0ifjsldkj

The state is coming from the Client request, but the code is s secret key that I have to generate and store it by myself (Authorization Server) in a safe place. But wait, I need also to store all the AuthorizationRequest data after verifying the Client successfully, because I need this data when our Authorization Server issuing the Identity Token and Access Token to the client. So how can I store all these information.

Inside Model folder create a new class named AuthorizationCode.cs as follow:

using System;
using System.Collections.Generic;
using System.Security.Claims;
using System.Security.Principal;

namespace OAuth20.Server.Models
{
    public class AuthorizationCode
    {
        public string ClientId { get; set; }
        public string ClientSecret { get; set; }
        public string RedirectUri { get; set; }

        public DateTime CreationTime { get; set; } = DateTime.UtcNow;
        public bool IsOpenId { get; set; }
        public IList<string> RequestedScopes { get; set; }

        public ClaimsPrincipal Subject { get; set; }
        public string Nonce { get; set; }
    }
}

The name of this class is coming from the generation code step, and I will store this information inside C# Concurrent Dictionary this Dictionary expect from me a key that should be unique for any data that I would like to store inside this Dictionary.

Inside Services folder create a new folder named CodeService and inside the CodeService folder create a new class named CodeStoreService.cs the content of this class as follow:
This service is not completed yet we will come back to it again

using Microsoft.AspNetCore.Authentication.Cookies;
using OAuth20.Server.Models;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;

namespace OAuth20.Server.Services.CodeServce
{
    public class CodeStoreService : ICodeStoreService
    {
        private readonly ConcurrentDictionary<string, AuthorizationCode> _codeIssued = new ConcurrentDictionary<string, AuthorizationCode>();
        private readonly ClientStore _clientStore = new ClientStore();

        // Here I genrate the code for authorization, and I will store it 
        // in the Concurrent Dictionary

        public string GenerateAuthorizationCode(string clientId, IList<string> requestedScope)
        {
            var client = _clientStore.Clients.Where(x => x.ClientId == clientId).FirstOrDefault();

            if(client != null)
            {
                var code = Guid.NewGuid().ToString();

                var authoCode = new AuthorizationCode
                {
                    ClientId = clientId,
                    RedirectUri = client.RedirectUri,
                    RequestedScopes = requestedScope,
                };

                // then store the code is the Concurrent Dictionary
                _codeIssued[code] = authoCode;

                return code;
            }
            return null;

        }

        public AuthorizationCode GetClientDataByCode(string key)
        {
            AuthorizationCode authorizationCode;
            if (_codeIssued.TryGetValue(key, out authorizationCode))
            {
                return authorizationCode;
            }
            return null;
        }

        public AuthorizationCode RemoveClientDataByCode(string key)
        {
            AuthorizationCode authorizationCode;
            _codeIssued.TryRemove(key, out authorizationCode);
            return null;
        }
    }
}

This class has three methods one to store the client data, one to get the client data, and the last one to remove the client data from the Concurrent Dictionary

You can use Dictionary instead of Concurrent Dictionary but the Concurrent Dictionary is thread safe, if you want to use Dictionary be sure to lock the method by using C# lock keywork, to save yourself from the Concurrency Issue

Create an interface inside CodeService and name it ICodeStoreService.cs

using OAuth20.Server.Models;
using System.Collections.Generic;

namespace OAuth20.Server.Services.CodeServce
{
    public interface ICodeStoreService
    {
        string GenerateAuthorizationCode(string clientId, IList<string> requestedScope);
        AuthorizationCode GetClientDataByCode(string key);
        AuthorizationCode RemoveClientDataByCode(string key);
    }
}

Update the CodeStoreService.cs class and let it to inheritance from the that interface you created recently

public class CodeStoreService : ICodeStoreService

we need to register this interface inside the program.cs class

builder.Services.AddSingleton<ICodeStoreService, CodeStoreService>();

Inside Model folder create new class named CheckClientResult.cs as follow:

namespace OAuth20.Server.Models
{
    public class CheckClientResult
    {
        public Client Client { get; set; }

        /// <summary>
        /// The clinet is found in my Clients Store
        /// </summary>
        public bool IsSuccess { get; set; }
        public string Error { get; set; }

        public string ErrorDescription { get; set; }
    }
}

Coming bake to the Authorize endpoint we need a new service to take care of verifying the client and issuing a token and store all the information that we need inside the Concurrent Dictionary that created recently. Let's dive in
Inside Services folder create a new class named AuthorizeResultService.cs

I will go very slowly from here to the end, be patient.and I'm going to put all the methods I need to authenticate the user.
This service is not completed yet we will come back to it again

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Http;
using Microsoft.IdentityModel.Tokens;
using NuGet.Common;
using OAuth20.Server.Common;
using OAuth20.Server.Models;
using OAuth20.Server.OauthRequest;
using OAuth20.Server.OauthResponse;
using OAuth20.Server.Services.CodeServce;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Security.Claims;
using System.Text;

namespace OAuth20.Server.Services
{
    public class AuthorizeResultService : IAuthorizeResultService
    {

        private static string keyAlg = "66007d41-6924-49f2-ac0c-e63c4b1a1730";
        private readonly ClientStore _clientStore = new ClientStore();
        private readonly ICodeStoreService _codeStoreService;
        public AuthorizeResultService(ICodeStoreService codeStoreService)
        {
            _codeStoreService = codeStoreService;
        }
        public AuthorizeResponse AuthorizeRequest(IHttpContextAccessor httpContextAccessor, AuthorizationRequest authorizationRequest)
        {
            AuthorizeResponse response = new AuthorizeResponse();

            if (httpContextAccessor == null)
            {
                response.Error = ErrorTypeEnum.ServerError.GetEnumDescription();
                return response;
            }

            var client = VerifyClientById(authorizationRequest.client_id);
            if (!client.IsSuccess)
            {
                response.Error = client.ErrorDescription;
                return response;
            }

            if (string.IsNullOrEmpty(authorizationRequest.response_type) || authorizationRequest.response_type != "code")
            {
                response.Error = ErrorTypeEnum.InvalidRequest.GetEnumDescription();
                response.ErrorDescription = "response_type is required or is not valid";
                return response;
            }

            if (!authorizationRequest.redirect_uri.IsRedirectUriStartWithHttps() && !httpContextAccessor.HttpContext.Request.IsHttps)
            {
                response.Error = ErrorTypeEnum.InvalidRequest.GetEnumDescription();
                response.ErrorDescription = "redirect_url is not secure, MUST be TLS";
                return response;
            }


            // check the return url is match the one that in the client store


            // check the scope in the client store with the
            // one that is comming from the request MUST be matched at leaset one

            var scopes = authorizationRequest.scope.Split(' ');

            var clientScopes = from m in client.Client.AllowedScopes
                               where scopes.Contains(m)
                               select m;

            if (!clientScopes.Any())
            {
                response.Error = ErrorTypeEnum.InValidScope.GetEnumDescription();
                response.ErrorDescription = "scopes are invalids";
                return response;
            }

            string nonce = httpContextAccessor.HttpContext.Request.Query["nonce"].ToString();

            // Verify that a scope parameter is present and contains the openid scope value.
            // (If no openid scope value is present,
            // the request may still be a valid OAuth 2.0 request, but is not an OpenID Connect request.)

            string code = _codeStoreService.GenerateAuthorizationCode(authorizationRequest.client_id, clientScopes.ToList());
            if (code == null)
            {
                response.Error = ErrorTypeEnum.TemporarilyUnAvailable.GetEnumDescription();
                return response;
            }

            response.RedirectUri = client.Client.RedirectUri + "?response_type=code" + "&state=" + authorizationRequest.state;
            response.Code = code;
            response.State = authorizationRequest.state;
            response.RequestedScopes = clientScopes.ToList();
            response.Nonce = nonce;

            return response;

        }




        private CheckClientResult VerifyClientById(string clientId, bool checkWithSecret = false, string clientSecret = null)
        {
            CheckClientResult result = new CheckClientResult() { IsSuccess = false };

            if (!string.IsNullOrWhiteSpace(clientId))
            {
                var client = _clientStore.Clients.Where(x => x.ClientId.Equals(clientId, StringComparison.OrdinalIgnoreCase)).FirstOrDefault();

                if (client != null)
                {
                    if (checkWithSecret && !string.IsNullOrEmpty(clientSecret))
                    {
                        bool hasSamesecretId = client.ClientSecret.Equals(clientSecret, StringComparison.InvariantCulture);
                        if (!hasSamesecretId)
                        {
                            result.Error = ErrorTypeEnum.InvalidClient.GetEnumDescription();
                            return result;
                        }
                    }


                    // check if client is enabled or not

                    if (client.IsActive)
                    {
                        result.IsSuccess = true;
                        result.Client = client;

                        return result;
                    }
                    else
                    {
                        result.ErrorDescription = ErrorTypeEnum.UnAuthoriazedClient.GetEnumDescription();
                        return result;
                    }
                }
            }

            result.ErrorDescription = ErrorTypeEnum.AccessDenied.GetEnumDescription();
            return result;
        }
    }
}

Inside Service folder create a new interface name IAuthorizeResultService.cs and the content of this interface as follow:

using Microsoft.AspNetCore.Http;
using OAuth20.Server.OauthRequest;
using OAuth20.Server.OauthResponse;

namespace OAuth20.Server.Services
{
    public interface IAuthorizeResultService
    {
        AuthorizeResponse AuthorizeRequest(IHttpContextAccessor httpContextAccessor, AuthorizationRequest authorizationRequest);
    }
}

we need to register this interface inside the program.cs class

builder.Services.AddScoped<IAuthorizeResultService, AuthorizeResultService>();

After the Client Authenticated successfully, we need away to let the Resource Owner to insert his username and password, so we need a new class named OpenIdConnectLoginRequest.cs created inside OauthRequest folder:

using System.Collections.Generic;

namespace OAuth20.Server.OauthRequest
{
    public class OpenIdConnectLoginRequest
    {
        public string UserName { get; set; }
        public string Password { get; set; }
        public string RedirectUri { get; set; }
        public string Code { get; set; }
        public string Nonce { get; set; }
        public IList<string> RequestedScopes { get; set; }
    }
}

Now update your Authorize endpoint in HomeController.cs class to be like so:

       private readonly IHttpContextAccessor _httpContextAccessor;
        private readonly IAuthorizeResultService _authorizeResultService;
        private readonly ICodeStoreService _codeStoreService;
        public HomeController(IHttpContextAccessor httpContextAccessor, IAuthorizeResultService authorizeResultService,
            ICodeStoreService codeStoreService)
        {
            _httpContextAccessor = httpContextAccessor;
            _authorizeResultService = authorizeResultService;
            _codeStoreService = codeStoreService;
        }

     public IActionResult Authorize(AuthorizationRequest authorizationRequest)
        {
            var result = _authorizeResultService.AuthorizeRequest(_httpContextAccessor, authorizationRequest);

            if (result.HasError)
                return RedirectToAction("Error", new { error = result.Error });

            var loginModel = new OpenIdConnectLoginRequest
            {
                RedirectUri = result.RedirectUri,
                Code = result.Code,
                RequestedScopes = result.RequestedScopes,
                Nonce = result.Nonce
            };


            return View("Login", loginModel);
        }

When the AuthorizeRequest method returns a successful response, we returned the user to the Login view

Create a new Action Method inside HomeController.cs named Login

    [HttpGet]
        public IActionResult Login()
        {
            return View();
        }

Inside Views/Home folder create a new Login.cshtml file

@model OAuth20.Server.OauthRequest.OpenIdConnectLoginRequest
@{
    ViewData["Title"] = "Login";
    Layout = "~/Views/Shared/_Layout.cshtml";
}

<h1>Login - Page</h1>

<div class="row">
    @foreach (var i in Model.RequestedScopes)
    {
        <p>@i</p>
    }


    <div class="col-12">
        <form asp-action="Login" asp-controller="Home" method="post">
            <input type="hidden" asp-for="RedirectUri" />
            <input type="hidden" asp-for="Code" />
            <input type="hidden" asp-for="Nonce" />

            @for (int i = 0; i < Model.RequestedScopes.Count; i++)
            {
                <input type="hidden" asp-for="RequestedScopes[i]" />
            }


            <div class="col-md-6">
                <label>User Name</label>
                <input type="text" asp-for="UserName" class="form-control" />
            </div>

            <div class="col-md-6">
                <label>Password</label>
                <input type="text" asp-for="Password" class="form-control" />
            </div>


            <div class="col-md-6">
                <input type="submit" value="Login" class="btn btn-primary" />
            </div>
        </form>
    </div>
</div>

Here the user will insert his username and password, but for that we have to create a POST version of the Login Action Method, so let us create it inside HomController.cs class

but before that we need to update the CodeStoreService.cs service by adding a new method to it, named UpdatedClientDataByCode so open the CodeStoreService.cs and add the follow mwthod, don't forget to update the ICodeStoreService interface as well by adding the name of the method

// TODO
        // Before updated the Concurrent Dictionary I have to Process User Sign In,
        // and check the user credienail first
        // But here I merge this process here inside update Concurrent Dictionary method
        public AuthorizationCode UpdatedClientDataByCode(string key, IList<string> requestdScopes,
            string userName, string password = null, string nonce = null)
        {
            var oldValue = GetClientDataByCode(key);

            if (oldValue != null)
            {
                // check the requested scopes with the one that are stored in the Client Store 
                var client = _clientStore.Clients.Where(x => x.ClientId == oldValue.ClientId).FirstOrDefault();

                if (client != null)
                {
                    var clientScope = (from m in client.AllowedScopes
                                       where requestdScopes.Contains(m)
                                       select m).ToList();

                    if (!clientScope.Any())
                        return null;

                    AuthorizationCode newValue = new AuthorizationCode
                    {
                        ClientId = oldValue.ClientId,
                        CreationTime = oldValue.CreationTime,
                        IsOpenId = requestdScopes.Contains("openId") || requestdScopes.Contains("profile"),
                        RedirectUri = oldValue.RedirectUri,
                        RequestedScopes = requestdScopes,
                        Nonce = nonce
                    };


                    // ------------------ I suppose the user name and password is correct  -----------------
                    var claims = new List<Claim>();



                    if (newValue.IsOpenId)
                    {
                        // TODO
                        // Add more claims to the claims

                    }

                    var claimIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
                    newValue.Subject = new ClaimsPrincipal(claimIdentity);
                    // ------------------ -----------------------------------------------  -----------------

                    var result = _codeIssued.TryUpdate(key, newValue, oldValue);

                    if (result)
                        return newValue;
                    return null;
                }
            }
            return null;
        }

The purpose of this method is to update the HttpContext's Request information for the client in Concurrent Dictionary.

Now create the POST Action Method for the Login inside HomeController.cs

        [HttpPost]
        public async Task<IActionResult> Login(OpenIdConnectLoginRequest loginRequest)
        {
            // here I have to check if the username and passowrd is correct
            // and I will show you how to integrate the ASP.NET Core Identity
            // With our framework

            var result = _codeStoreService.UpdatedClientDataByCode(loginRequest.Code, loginRequest.RequestedScopes,
                loginRequest.UserName, nonce: loginRequest.Nonce);
            if (result != null)
            {

                loginRequest.RedirectUri = loginRequest.RedirectUri + "&code=" + loginRequest.Code;
                return Redirect(loginRequest.RedirectUri);
            }
            return RedirectToAction("Error", new { error = "invalid_request" });
        }

Inside Views/Home create a new Error.cshtml file and paste the follow code inside it

@model string
@{
    ViewData["Title"] = "Error";
    Layout = "~/Views/Shared/_Layout.cshtml";
}

<h1>Error</h1>

After user login successfully we retune him/her to the return URI that we verify it by the one in the ClientStore.cs after this point the AddOpenIdConnect (From Client Application) extension make a soft HTTP call to token endpoint, and you remember where we defend the value of this endpoint, if you check the DiscoveryEndpointController.cs file you will find the value of this endpoint is assigned to the token_endpoint property as follow:

token_endpoint = "https://localhost:7275/Home/Token",

Ok, at this point we complete the process of the Authorization the next step is the TOKEN

Issuing Identity Token and AccessToken

We need new classes to make our journey very easy when we are working with these tokens (id_token & access_token)

Inside OauthRequest folder create a new class named TokenRequest.cs as follow:

namespace OAuth20.Server.OauthRequest
{
    public class TokenRequest
    {
        public string ClientId { get; set; }
        public string ClientSecret { get; set; }
        public string Code { get; set; }
        public string GrantType { get; set; }
        public string RedirectUri { get; set; }
        public string CodeVerifier { get; set; }
    }
}

And then, inside Models folder create a new enum named TokenTypeEnum.cs

using System.ComponentModel;

namespace OAuth20.Server.Models
{
    public enum TokenTypeEnum : byte
    {
        [Description("Bearer")]
        Bearer
    }
}

And last but not least inside OauthResponse folder create a new class named TokenResponse.cs as follow:

using OAuth20.Server.Common;
using OAuth20.Server.Models;

namespace OAuth20.Server.OauthResponse
{
    public class TokenResponse
    {
        /// <summary>
        /// Oauth 2
        /// </summary>
        public string access_token { get; set; }

        /// <summary>
        /// OpenId Connect
        /// </summary>
        public string id_token { get; set; }

        /// <summary>
        /// By default is Bearer
        /// </summary>

        public string token_type { get; set; } = TokenTypeEnum.Bearer.GetEnumDescription();

        /// <summary>
        /// Authorization Code. This is always returned when using the Hybrid Flow.
        /// </summary>
        public string code { get; set; }



        // For Error Details if any

        public string Error { get; set; } = string.Empty;
        public string ErrorUri { get; set; }
        public string ErrorDescription { get; set; }
        public bool HasError => !string.IsNullOrEmpty(Error);
    }
}

Updating the AuthorizeResultService.cs class by adding the following new method:

public TokenResponse GenerateToken(IHttpContextAccessor httpContextAccessor)
        {
            TokenRequest request = new TokenRequest();

            request.CodeVerifier = httpContextAccessor.HttpContext.Request.Form["code_verifier"];
            request.ClientId = httpContextAccessor.HttpContext.Request.Form["client_id"];
            request.ClientSecret = httpContextAccessor.HttpContext.Request.Form["client_secret"];
            request.Code = httpContextAccessor.HttpContext.Request.Form["code"];
            request.GrantType = httpContextAccessor.HttpContext.Request.Form["grant_type"];
            request.RedirectUri = httpContextAccessor.HttpContext.Request.Form["redirect_uri"];

            var checkClientResult = this.VerifyClientById(request.ClientId, true, request.ClientSecret);
            if (!checkClientResult.IsSuccess)
            {
                return new TokenResponse { Error = checkClientResult.Error, ErrorDescription = checkClientResult.ErrorDescription };
            }

            // check code from the Concurrent Dictionary
            var clientCodeChecker = _codeStoreService.GetClientDataByCode(request.Code);
            if (clientCodeChecker == null)
                return new TokenResponse { Error = ErrorTypeEnum.InvalidGrant.GetEnumDescription() };


            // check if the current client who is one made this authentication request

            if (request.ClientId != clientCodeChecker.ClientId)
                return new TokenResponse { Error = ErrorTypeEnum.InvalidGrant.GetEnumDescription() };

            // TODO: 
            // also I have to check the rediret uri 


            // Now here I will Issue the Id_token

            JwtSecurityToken id_token = null;
            if (clientCodeChecker.IsOpenId)
            {
                // Generate Identity Token

                int iat = (int)DateTime.UtcNow.Subtract(new DateTime(1970, 1, 1)).TotalSeconds;


                string[] amrs = new string[] { "pwd" };

                var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(keyAlg));
                var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

                var claims = new List<Claim>()
                {
                    new Claim("sub", "856933325856"),
                    new Claim("given_name", "Mohammed Ahmed Hussien"),
                    new Claim("iat", iat.ToString(), ClaimValueTypes.Integer), // time stamp
                    new Claim("nonce", clientCodeChecker.Nonce)
                };
                foreach (var amr in amrs)
                    claims.Add(new Claim("amr", amr));// authentication method reference 

                id_token = new JwtSecurityToken("https://localhost:7275", request.ClientId, claims, signingCredentials: credentials,
                    expires: DateTime.UtcNow.AddMinutes(
                       int.Parse("5")));

            }

            // Here I have to generate access token 
            var key_at = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(keyAlg));
            var credentials_at = new SigningCredentials(key_at, SecurityAlgorithms.HmacSha256);

            var claims_at = new List<Claim>();


            var access_token = new JwtSecurityToken("https://localhost:7275", request.ClientId, claims_at, signingCredentials: credentials_at,
                expires: DateTime.UtcNow.AddMinutes(
                   int.Parse("5")));

            // here remoce the code from the Concurrent Dictionary
            _codeStoreService.RemoveClientDataByCode(request.Code);

            return new TokenResponse
            {
                access_token = new JwtSecurityTokenHandler().WriteToken(access_token),
                id_token = id_token != null ? new JwtSecurityTokenHandler().WriteToken(id_token) : null,
                code = request.Code
            };
        }

The method is straightforward, verify the Client and then create a new id_token and then access_token
Be sure to add the signature this method to the IAuthorizeResultService.cs interface

Back to HomeController.cs class here is the signature of the token endoint

       public JsonResult Token()
        {
            var result = _authorizeResultService.GenerateToken(_httpContextAccessor);

            if (result.HasError)
                return Json("0");

            return Json(result);
        }

Back to our Client Application that we create at the beginning of this post. Inside Views/Home create a new Index.cshtml file and the content of this file as follow:

@using Microsoft.AspNetCore.Authentication

@{
    ViewData["Title"] = "Index";
    Layout = "~/Views/_Layout.cshtml";
}


<div class="col-12">
    <div class="card">
        <div class="card-header">
            <h1>Tokens Resut - For PlatformNet6 Client</h1>
        </div>

        <div class="card-body">
            @if (User.Identity.IsAuthenticated)
            {
                <h2>User is Authenticated</h2>
                <p>
                    <ul>
                        @foreach (var claim in User.Claims)
                        {
                            <li><strong> @claim.Type:</strong> @claim.Value</li>
                        }
                        <li><strong>Access Token: </strong>@await Context.GetTokenAsync("access_token")</li>
                        <li><strong>Identity Token: </strong>@await Context.GetTokenAsync("id_token")</li>

                    </ul>
                </p>
            }
            else
            {
                <h2>ohhhh, u being Unauthenticated</h2>
            }
        </div>
    </div>
</div>

Now run your Authorization Server and then you Client Application
And you will see the result like so:

Ooooooops we do it, now we need to improve our Authorization Server code and application structure. This is the next step. see you in the next post.
Again, you can download the completed source code from my Github repos from here feel free to add pull request.
Enjoy!

Versioning REST APIs in ASP.NET Core 6.0

Mohammed Ahmed Hussien — Fri, 30 Sep 2022 18:26:23 +0000

In this post I will show you how to versioning you REST APIs, and I will explain to you when to versioning and what is the best approach to apply and implement this feature to your APIs.

First, let us take an example to build our idea based on it.
What are the APIs that I'm working on it. What are the kinds of APIs that I build.
Is it whether services to show the case of the current Whether or banking services or APIs for internal uses by your organization?
If you develop or build APIs for internal uses by your organization DON'T versioning your APIs at all because you have to put in your mind that when you apply the versioning to your APIs, you increase the maintenances process for all versions of your APIs. And you actually build APIs for internal uses ( NOT for customers ), or by other way you have not external consumers to use your APIs.

Now let us assume taht we have built an whether services APIs for external uses by multiple consumers.

The signature of our Controller it would be like so:

    [Route("api/whether")]
    [ApiController]
    public class WhetherController : ControllerBase
    {
        [HttpGet("ShowCuurentStatus")]
        public string ShowCuurentStatus()
        {
            string result = "The current status  of the weather is: 35";
            return result;
        }
    }

We have an endpoint that return the current status of the whether, and for demo purpose I returned a hard code result like so:

The current status of the weather is: 35

Let us say we have more than one hundred (100) of consumers uses our APIs. And our endpoint works perfectly with them.And after long time we decide as the owner of this API to improve the result of the ShowCuurentStatus( ) Action Method. And we decide to include the Air Quality to the result depend on the current status of the weather. for instance, the result it will become like so:

The current status of the weather is: 35. The Air Quality is: Poor

So, when we decide this change, we put in mind that, we need to apply this change without breaking the old result. How we can do that.
We can use the REST APIs visioning.
First, we have to install a NuGet packages:

Microsoft.AspNetCore.Mvc.Versioning
Microsoft.AspNetCore.Mvc.Versioning.ApiExplorer

What is the best approach to versioning you APIs?

To version your REST APIs you have more than one way to let your consumers to get the result from that endpoint depend on specific version.

*You can apply the versioning in query string parameter:
*

api/whether/ShowCuurentStatus?api-version=1.0

Or by applying it in Request-Header

Or by Accept Header like so:

GET /api/whether/ShowCuurentStatus
Accept: application/json;api-version=1.0

Also, you can apply the versioning by URL Path approach,

/api/v1/whether/ShowCuurentStatus

The best approach to versioning you APIs is Request-Header, and the Request-Header like a meta data for your endpoint.

Now let us see how we can implement this on ASP.NET Core 6

In the program.cs class add these lines of code:

builder.Services.AddVersionedApiExplorer();
builder.Services.AddApiVersioning(config =>
{
    config.DefaultApiVersion = new Microsoft.AspNetCore.Mvc.ApiVersion(1, 0);
    config.AssumeDefaultVersionWhenUnspecified = true; // To Ignore 404 Error
    config.ReportApiVersions = true; // To show Which Version the Reauest Supported

    config.ApiVersionReader = new HeaderApiVersionReader("api-version");
});

In the AddApiVersioning( ) method we configure it to accept by default the version 1.0 for all endpoints in our APIs, and this means that, if the consumer forgets to add the version of the endpoint to the header the result will directly match and return the version 1.0 for requested endpoint.

config.DefaultApiVersion = new Microsoft.AspNetCore.Mvc.ApiVersion(1, 0);
config.AssumeDefaultVersionWhenUnspecified = true;

In the configuration of the AddApiVersioning( ) I enforce the Header to be the approach that it should be used by consumers when requesting my endpoints by applying this line of code:

config.ApiVersionReader = new HeaderApiVersionReader("api-version");

The HeaderApiVersionReader objcet accept a string of array to name your version.

Letter I will show you how to combine more than one approach to get the result by different ways.

Let us jump to our WhetherController and apply the version two of the ShowCuurentStatus( ) Action Method:

 [HttpGet("ShowCuurentStatus")]
        [ApiVersion("1.0")]
        public string ShowCuurentStatus()
        {
            string result = "The current status of the weather is: 35";
            return result;
        }


        [HttpGet("ShowCuurentStatusV2")]
        [ApiVersion("2.0")]
        public string ShowCuurentStatusV2()
        {
            string result = "The current status of the weather is: 35  The Air Quality is: Poor";
            return result;
        }

Now if you see the result of the version 2 of our method it returns a totally different result like so:

The current status of the weather is: 35. The Air Quality is: Poor

Let us give it a try by running the application and test it by Postman

In the next image if you see, I make a request to the ShowCuurentStatus( ) endpoint without mentioning any version, and the result coming by default from version 1.0

Second let us make a request to version two of the ShowCuurentStatusV2( ) endpoint without applying the version of the endpoint in the header, and as you can see the result is 400 bad request

This error is coming here because I decorate the ShowCuurentStatusV2( ) Action Methos to accept version 2.0 only.
Let us add the version 2.0 to the header of the request, and now here we go:

Look carefully at the header of the request, I added a new header to request, and the name of that new header is:

api-version: 2

The 2 here is the number of the version.

How to use multiple approach to accept the version of your endpoints

If I want to give my customers more than one way to apply the version of my endpoint to fetch the current status of the whether instead of the Request-Header only, I can do that by this way:

config.ApiVersionReader = ApiVersionReader.Combine(new HeaderApiVersionReader("api-version"),
                    new QueryStringApiVersionReader("api-V"));

Here I combined two Api version reader to request the endpoints by using Combine method of the ApiVersionReader object.

Also, I can let my consumers to know when I decide to deprecate anyone of my endpoints and that by adding a second parameter to the ApiVersion attribute like so:

   [HttpGet("ShowCuurentStatus")]
        **[ApiVersion("1.0", Deprecated = true)]**
        public string ShowCuurentStatus()
        {
            string result = "The current status of the weather is: 35";
            return result;
        }

And here the version one of the ShowCuurentStatus( ) Action Methos now is deprecated, if you give it a try you will see the result like so Look to next image:
Look at the api-deprecated-versions header at the end of the Headers tap of the result.

And that all I have to show you how to versioning your REST APIs in ASP.NET Core 6.
Thanks for reading.

Store Log Messages in SQL Server For Your ASP.NET Core 6.0 App by Using NLog

Mohammed Ahmed Hussien — Wed, 16 Mar 2022 21:38:00 +0000

NLog is a third-party library to store message that shown the state of the application, and there is more than one way to store that messages:
1- File
2- Console
3- Database (I will describe how to use this option in this text)
I will guide you how to setup NLog in ASP.NET Core App that target .NET 6.

I assume you have an ready ASP.NET Core project.
First you have to install four packages by using Nuget package:

The System.Data.SqlClient it helps us to store the log message to SQL Server database, and in the same context, if you're working with different database you have to install the properly package that fit what the NLog needs.

So, to prepare the ASP.NET Core Application to work with NLog open the Program.cs class and paste the below code ( I will explain it later)


using NLog;
using NLog.Web;

var logger = NLog.LogManager
    .Setup()
    .LoadConfigurationFromAppSettings()
    .GetCurrentClassLogger();
try
{
    var builder = WebApplication.CreateBuilder(args);
    builder.Services.AddControllersWithViews();

       // Cleaer the build in provider
    builder.Logging.ClearProviders();

    // log youe application at trace level 
    builder.Logging.SetMinimumLevel(Microsoft.Extensions.Logging.LogLevel.Trace);

    // Register the NLog service
    builder.Host.UseNLog();

    var app = builder.Build();
    app.UseStaticFiles();
    app.UseRouting();
   app.MapDefaultControllerRoute();
   app.Run();
}

catch(Exception ex)
{
    logger.Error(ex);
    throw;
}
finally
{
// Ensure to shout downon the NLog ( Disposing )
    NLog.LogManager.Shutdown();
}

Here I create an instance of Logger class by calling the LogManager. The LogManager class will let me to work with all available functions and methods that I need when I working with NLog, therefore, NLog need to know from where can render all the settings and configurations it needs, so I Setup and add all the configurations at appsettings.json file( I will show you next what this file include...) by adding LoadConfigurationFromAppSettings() method, and chaining it with GetCurrentClassLogger() method to get the full name of the class ( including namespace ) that I want to log and fetch all the information and errors and warning from it.
Now let us jump into the appsettings.json file, but before that we need to setup our Database and the Table that will take care of our all information we would like to log.

So Run this script to create the table, Be sure to create the database first with any name you liked!

CREATE TABLE [dbo].[AppLogs](
    [Id] [int] IDENTITY(1,1) NOT NULL,
    [Added_Date] [datetime] NOT NULL,
    [Level] [nvarchar](10) NULL,
    [Message] [nvarchar](max) NULL,
    [StackTrace] [nvarchar](max) NULL,
    [Exception] [nvarchar](max) NULL,
    [Logger] [nvarchar](255) NULL,
    [RequestUrl] [nvarchar](255) NULL,
    [RequestType] [nvarchar](10) NULL,
PRIMARY KEY CLUSTERED 
(
    [Id] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON, OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY]
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

Now we need to map this column names to NLog Layout, and that what we have to do in the appsettings.josn file, like below:

{
  "NLog": {
    "throwConfigExceptions": true,
    "targets": {
      "async": true,
      "database": {
        "type": "Database",
        "dbProvider": "System.Data.SqlClient",
        "connectionString": "Data Source=Youe Server Name;Initial Catalog=Your Database Name;Trusted_Connection=True;",
        "keepConnection": "true",
        "commandText": "insert into dbo.AppLogs (Added_Date,Level,Message,StackTrace,Exception,Logger,RequestUrl,RequestType) values (@addeddate, @level, @message, @stackTrace, @logger, @exception, @requestUrl, @requestType);",
        "parameters": [
          {
            "name": "@addeddate",
            "layout": "${date}"
            //"dbType": "DbType.DateTime"
          },
          {
            "name": "level",
            "layout": "${level}"
          },
          {
            "name": "message",
            "layout": "${message}"
          },
          {
            "name": "stackTrace",
            "layout": "${stacktrace}"
          },
          {
            "name": "logger",
            "layout": "${logger}"
          },
          {
            "name": "exception",
            "layout": "${exception:tostring}"
          },
          {
            "name": "requestUrl",
            "layout": "${aspnet-request-url}"
          },
          {
            "name": "requestType",
            "layout": "${aspnet-request-method}"
          }
        ]
      },
      "logconsole": {
        "type": "Console"
      }
    },
    "rules": [
      {
        "logger": "*",
        "minLevel": "Info",
        "writeTo": "logconsole"
      },
      {
        "logger": "*",
        "minLevel": "Debug",
        "writeTo": "database"
      }
    ]
  },
  "AllowedHosts": "*"
}

Ooooooops, there is a lot of configuration data here. but it's easy to understand.
In this configuration file I have two target:
1- Database
2- Console

At target element I introduce more than one attribute, the important one is commandText the mission of this attribute is to run SQL Insert Statement against the table that we created when we setup our database.
The connectionString attribute it's very clear, and it give us the capability to connect between the app and database.
The type attribute indicate where I would like to store the log messages. In our case at ( Back Store ).
You have to be careful with name of your target element, in our case the name is database, therefore if you look at the rules element at the end of appsettings.json file you will notice that, I append this name ( database ) to the second rule like so:

  {
        "logger": "*",
        "minLevel": "Debug",
        "writeTo": "database"
      }

The parameters attribute ensure that all the column names in the AppLogs table are mapped to NLog Layout correctly.

Now here is my HomeController.cs class

using Microsoft.AspNetCore.Mvc;

namespace NLogExample.Controllers
{
    public class HomeController : Controller
    {
        private readonly ILogger<HomeController> _logger;   
        public HomeController(ILogger<HomeController> logger)
        {
            _logger = logger;
        }
        public IActionResult Index()
        {
            _logger.LogInformation("My Name is Mohammed Ahmed Hussien");
            _logger.LogWarning("Please, can you check your app's performance");
            _logger.LogError(new Exception(), "Booom, there is an exception");

            ViewBag.Name = "Mohammed Ahmed Hussien";
            return View();
        }
    }
}

If you run the application, and navigate to you SQL Server to see what the information are logged you will see the messages that I typed it in the Index action method. see the next image:

Thanks for reading...

ASP.NET Core Identity 2FA with Google Authenticator

Mohammed Ahmed Hussien — Tue, 07 Dec 2021 19:40:31 +0000

Hi, in this post I will show you how to setup ASP.NET Core Identity 2FA by using Google authenticator.
2FA is a technique and more secure way and enforce the users to access their accounts with two steps.

Our Example

I suppose you have a ready application with ASP.NET Core Identity with Register and Login functionality (without 2FA). And also (I suppose...) you have a tested user that has TwoFactorEnabled assigned to false in you Database.
So let's started.

First, we need to enable the 2FA in our application, in ASP.NET Core Identity you can achieve that by three ways.

Email
Phone
Authenticator, and this is what we are going to do in this post.

To let user work with 2FA we need a setup page that give the user the ability to enable the 2FA for his account.
So, create a new class with this signature:

public class ConfigureTwoFactorAuthenticatorModel
    {
        /// <summary>
        /// The key that we have to store it in our Database
        /// </summary>
        public string AuthenticatorKey { get; set; }

        /// <summary>
        /// Generated key the user must insert it in his authenticator app
        /// You can use any QRCode library the facilate the reading of this key instead of typing it.
        /// Try the QRCode js library
        /// </summary>
        public string Code { get; set; }
    }

Ok, now we have to create an Action Method with html page.

[HttpGet]
        [Authorize]
        public async Task<IActionResult> TwoFactorAuthenticationSetupPage()
        {
            var user = await _userManager.GetUserAsync(User);
            if (user == null)
            {
                // Redirect user to any page you want...
                return RedirectToAction("/");
            }
            else
            {
                var authenticatorKey = await _userManager.GetAuthenticatorKeyAsync(user);
                if (authenticatorKey == null)
                {
                    await _userManager.ResetAuthenticatorKeyAsync(user);
                    authenticatorKey = await _userManager.GetAuthenticatorKeyAsync(user);
                }
 // For demo purpose writh the key to attached debugger
                    Debug.WriteLine(authenticatorKey);
                return View(new ConfigureTwoFactorAuthenticatorModel { AuthenticatorKey = authenticatorKey });

            }
        }

The purpose of this action is to create an AuthenticatorKey for current user, by calling _userManager.GetAuthenticatorKeyAsync(user) this method will retrieve the key from the back store and the return of GetAuthenticatorKeyAsync method is string so if the return type is null generate a new authenticator key by calling the new method ResetAuthenticatorKeyAsync and call again GetAuthenticatorKeyAsync method to retrieve the key after saved it in back store. We drop the authenticator key to writeline of debugger for demo purpose (here you have to use an QRCode library to let your users scan the image and type the code is the code's field in the html page (coming next). Pretty easy!

Before digging into html page of the [TwoFactorAuthenticationSetupPage] action method let us finished from the HTTPOST method, the code is below:

[HttpPost]
        [Authorize]
        public async Task<IActionResult> TwoFactorAuthenticationSetupPage(ConfigureTwoFactorAuthenticatorModel model)
        {
            if (ModelState.IsValid)
            {
                var user = await _userManager.GetUserAsync(User);
                bool isValidCode = await _userManager.VerifyTwoFactorTokenAsync(user, 
                    _userManager.Options.Tokens.AuthenticatorTokenProvider,
                    model.Code);

                if (isValidCode)
                {
                    await _userManager.SetTwoFactorEnabledAsync(user, true);
                    return RedirectToAction("Index", "Home");
                }
                else
                {
                    ModelState.AddModelError("", "Error in Code");
                    return View(model);
                }
            }
            ModelState.AddModelError("", "General Error");
            return View(model);
        }

This method is straightforward , check the model state and validate the token by calling VerifyTwoFactorTokenAsync the second argument of this method specify the name of the authenticator. which is come from the AddDefaultTokenProviders,the extension you added to your startup class when you configure the ASP.NET Core Identity.
Now the time for the html page ( no need to explain it, it's pretty easy to get it's grasp)

@model Platform.ViewModel.ConfigureTwoFactorAuthenticatorModel
@{
    ViewData["Title"] = "TwoFactorAuthenticationSetupPage";
    Layout = "~/Views/Shared/_Layout.cshtml";
}

<div class="row justify-content-md-center" style="margin-top:130px;">

    <div class="col-md-5">
        <div class="card">
            <h5 class="card-header bg-dark text-white">TwoFactorAuthenticationSetupPage</h5>
            <div class="card-body">

                <form class="px-4 py-3" asp-action="TwoFactorAuthenticationSetupPage" asp-controller="Account" method="post" id="frmLogin">
                    <div asp-validation-summary="All" class="text-danger"></div>

                    <input type="hidden" asp-for="AuthenticatorKey" />
                    <div class="form-group">
                        <input class="form-control" asp-for="Code">
                    </div>

                    <button type="submit" class="btn btn-primary">Submit</button>

                </form>

            </div>
        </div>
    </div>


</div>

Let' run the app and see what happened?!

This is the AuthenticatorKey that we write it to Debugger.

This is the code the Google Authenticator App generated to me after I inserted the AuthenticatorKey to Google Authenticator App.

This is the AuthenticatorKey saved to BackStore in AspNetUserTokens Table.

So, now we prepare our app and registration to work with the any Authenticator app. The next step is Signing with Authenticator App.

First, let me paste my LoginModel.cs class

public class LoginModel
    {
        [Required]
        public string Email { get; set; }
        [Required]
        public string Password { get; set; }
    }

Straightforward class that let user provide his email and password.
And this is the Login [HTTPPOST] Action Method

 [AllowAnonymous]
        [ValidateAntiForgeryToken]
        [HttpPost]
        public async Task<IActionResult> Login(LoginModel model, string returnUrl)
        {
            if (ModelState.IsValid)
            {
                AppUser user = await _userManager.FindByEmailAsync(model.Email);
                if(user!= null)
                {
                    await _signInManager.SignOutAsync();

                    Microsoft.AspNetCore.Identity.SignInResult result = 
                                     await _signInManager.PasswordSignInAsync(user, model.Password, false, false);

                    if (result.RequiresTwoFactor)
                    {
                        return RedirectToAction("LoginTwoStep", new { returnUrl = returnUrl });
                    }



                    if (result.Succeeded)
                    {
                        return Redirect(returnUrl ?? "/");
                    }
                }

                ModelState.AddModelError(nameof(LoginModel.Email), "Invalid user name or password");
            }

            return View(model);
        }

Here after user looged in we check if he has 2FA enabled by calling this property RequiresTwoFactor and if the result of this property return true so we have to redirect the user to LoginTwoStep Action Method.

and here is the HTTPGET and HTTPPOST of the LoginTwoStep Action method

[HttpGet]
        public IActionResult  LoginTwoStep(string returnUrl)
        {
            return View(new LoginTwoStepModel { ReturnUrl = returnUrl});
        }
        [HttpPost]
        public async Task<IActionResult> LoginTwoStep(LoginTwoStepModel model)
        {
            if (ModelState.IsValid)
            {
                var user = await _signInManager.GetTwoFactorAuthenticationUserAsync();
                if(user!= null)
                {
                    var result = await _signInManager.TwoFactorAuthenticatorSignInAsync(model.Token, true, false);
                    if (result.Succeeded)
                    {
                        return Redirect(model.ReturnUrl);
                    }
                    // show the error to user
                    ModelState.AddModelError("", "General Error");
                    return View(model);
                }
            }
            // show the error to user
            ModelState.AddModelError("", "General Error");
            return View(model);
        }

In the POST method we return an user for the current 2FA login by calling GetTwoFactorAuthenticationUserAsync method and if this method return null we have to cancel the operation of the login otherwise we have to complete the process of the login as you see in the next pictures

Here I have to insert the code from the Google Authenticator App, see next picture:

Sorry for the dirty pic, because I can't take an screenshot from the Google Authenticator App I took a photo by other phone.

In the HTTPPOST of the Login Action Method, instead of using:

 if (result.RequiresTwoFactor)
                    {
                        return RedirectToAction("LoginTwoStep", new { returnUrl = returnUrl });
                    }

You can check by the following code:

    if (await _userManager.GetTwoFactorEnabledAsync(user))
                    {
                        var validProvider = await _userManager.GetValidTwoFactorProvidersAsync(user);

                        if (validProvider.Contains(_userManager.Options.Tokens.AuthenticatorTokenProvider))
                        {
                            return RedirectToAction("LoginTwoStep", new { returnUrl = returnUrl });
                        }
                    }

Here first we check if the current user has enabled the 2FA in back store (database), then we made a second check if the available 2FA is AuthenticatorTokenProvider and if so then redirect the user to the LoginTowStep Action Method.

Set min Date to Today in Date Input Field, By Tag Helper in ASP.NET Core

Mohammed Ahmed Hussien — Fri, 13 Aug 2021 02:59:07 +0000

Here I will show you how to set date input field's min date to today by Tag Helper in asp.net core.
Create a new class name it InputDateTagHelper (or any name you like it).
Update the InputDateTagHelper.cs class with the following code statements:

[HtmlTargetElement("input", Attributes ="is-accept-old-day")]
    public class InputDateTagHelper : TagHelper
    {
        [HtmlAttributeName("is-accept-old-day")]
        public bool OldDay { get; set; } = false;
        public override void Process(TagHelperContext context, TagHelperOutput output)
        {
            if (!OldDay)
            {

                var dateTime = DateTime.Now;
                var dd = dateTime.Day;
                var mm = dateTime.Month;
                var yyyy = dateTime.Year;

                string newDay = Convert.ToString(dd);
                string newMonth = Convert.ToString(mm);

                if (dd < 10)
                {
                    newDay =  $"0{newDay}";
                }
                if(mm < 10)
                {
                    newMonth = $"0{mm}";
                }
                var today = $"{yyyy}-{newMonth}-{newDay}";
                output.Attributes.SetAttribute("min", today);
            }
        }
    }

The previous code is accept a boolean field OldDay if the field is false then set a min attribute to Date Input field and set it's value to date of today.

To test this new tag helper in your .cshtml file, you have to register it inside _ViewImport.cshtml file first, Here is the code:

@addTagHelper Platform.Infrastructure.*, Platform

The Platform is my ProjectName and the Infrastructure is the folder that I put the InputDateTagHelper.cs class inside it

So, now you can use the InputDateTagHelper like so:

<input type="date" is-accept-old-day="false" />

Here I force the input field to accept the today as a min date by passing false to is-accept-old-day field

The HTML output is

<input type="date" min="2021-08-13">