Implementing Okta Single Sign On #8791

tahmad created 2 months ago

ABP Framework version: v7.4.5
UI Type: Angular
Database System: EF Core (SQL Serve)
Tiered (for MVC) or Auth Server Separated (for Angular): yes/
Implemting SSO
I have implemented Okta SSO and obtained the ID Token from Okta. I have also installed the following packages:

@okta/okta-angular (v6.4.0)
@okta/okta-auth-js (v7.10.1)

Authentication is working as expected, as confirmed by the following check:

this.oktaAuth.isAuthenticated().then(async (authStatus) => {
    if (authStatus) {
        // Authenticated successfully
    }
});

Additionally, I can successfully invoke APIs using this authentication setup but not check authorization with different role:

context.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = "MultipleAuthSchemes";
    options.DefaultChallengeScheme = "MultipleAuthSchemes";
})
.AddPolicyScheme("MultipleAuthSchemes", JwtBearerDefaults.AuthenticationScheme, options =>
{
    options.ForwardDefaultSelector = context =>
    {
        string? authorization = context.Request.Headers["Authorization"];
        if (!string.IsNullOrEmpty(authorization) && authorization.StartsWith("Bearer "))
        {
            var token = authorization.Substring("Bearer ".Length).Trim();
            return token.Contains("okta") ? "okta_jwt_schema" : JwtBearerDefaults.AuthenticationScheme;
        }
        return JwtBearerDefaults.AuthenticationScheme;
    };
})
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
{
    options.Authority = configuration["AuthServer:Authority"];
    options.RequireHttpsMetadata = Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]);
    options.Audience = "Project42";
})
.AddJwtBearer("okta_jwt_schema", options =>
{
    options.Authority = configuration["Okta:Authority"];
    options.RequireHttpsMetadata = Convert.ToBoolean(configuration["Okta:RequireHttpsMetadata"]);
    options.Audience = "api://default";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        ValidIssuer = "https://dev-96317405.okta.com/oauth2/default",
        ValidAudience = "api://default",
        ValidateLifetime = true
    };
});

Now, I have route guards set up as follows:

{
    path: '',
    pathMatch: 'full',
    component: DashboardComponent,
    canActivate: [AuthGuard, PermissionGuard, RoleGuard],
}

I believe these guards require the ABP token instead of the Okta token. How can I properly pass authentication to AuthGuard and PermissionGuard while ensuring authorization in the system using Okta?

Can I do something like if authenticated then logged in with the user by matching the email but I don't know the password
I have this method
this.authService
.login({ username, password, rememberMe })

if I can login into the system without password or similar method in backend then I believe i can login the user with proper abp login and can just authenticate with okta.

tahmad created 2 months ago

also I have found. CurrentUser is null

berkansasmaz created 2 months ago

Support Team .NET Developer

Hello, our relevant team member will respond to you as soon as possible.

tahmad created 2 months ago

sure, please respond at earliest. I need to windup, thanks.

berkansasmaz created 2 months ago

Support Team .NET Developer

Unfortunately, our team member is out of working time at the moment. He will probably respond tomorrow during the day. Thank you for your patience.

tahmad created 2 months ago

Sure.

maliming created 2 months ago

Support Team Fullstack Developer

Can you check the current principal(HttpContext.User) after authentication using okta_jwt_schema?

What are the claims(type:value)?

The CurrentUser's values come from claims.

AddJwtBearer("okta_jwt_schema", options =>
{
    options.Authority = configuration["Okta:Authority"];
    options.RequireHttpsMetadata = Convert.ToBoolean(configuration["Okta:RequireHttpsMetadata"]);
    options.Audience = "api://default";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        ValidIssuer = "https://dev-96317405.okta.com/oauth2/default",
        ValidAudience = "api://default",
        ValidateLifetime = true
    };
});

tahmad created 2 months ago

please see the screenshot

CurrentUser fields are different. what I need to do?

tahmad created 2 months ago

also needs to address this issue, I have route guards set up as follows:

{
path: '',
pathMatch: 'full',
component: DashboardComponent,
canActivate: [AuthGuard, PermissionGuard, RoleGuard],
}

I believe these guards require the ABP token instead of the Okta token. How can I properly pass authentication to AuthGuard and PermissionGuard while ensuring authorization in the system using Okta?

maliming created 2 months ago

Support Team Fullstack Developer

ABP will not recognize these claims.

They come from another system, so they can't work with the abp authentication/permission system.

eg: you have a user(id: 123) in your local database. but with okta_jwt_schema claims, abp doesn't know the current user.

tahmad created 2 months ago

if I can login into the system without password or similar method in backend then I believe i can login the user with proper abp login and can just authenticate with okta.

IF NOT then what changes I need to make to compatible claim with ABP?

maliming created 2 months ago

Support Team Fullstack Developer

AddJwtBearer method can map your okta_jwt_schema to compatible with abp.


.AddAbpJwtBearer(options =>
{

    options.MapInboundClaims = false;
    options.Events.OnTokenValidated = async tokenValidatedContext =>
    {
        var yourClaims = tokenValidatedContext.Principal?.Claims;
        
        // Mpa your okta claims to abp claims
        if (tokenValidatedContext.Principal?.Identity is ClaimsIdentity claimIdentity)
        {
            claimIdentity.AddClaim(AbpClaimTypes.UserId, "");
            claimIdentity.AddClaim(AbpClaimTypes.UserName, "");
            claimIdentity.AddClaim(AbpClaimTypes.SurName, "");
            claimIdentity.AddClaim(AbpClaimTypes.Email, "");
            claimIdentity.AddClaim(AbpClaimTypes.Role, "");
        }
    };

});