Use OIDC Provider as main login #9578

1 Answer(s)

• 

  0

  AI-Bot created 2 months ago

  Support Team ABP Agent

  To use an external OIDC provider (like Okta or Auth0) as the main login for your ABP application, you need to configure external authentication and ensure that users authenticated via the OIDC provider are mapped or created in the ABP user store. This is necessary for ABP to recognize the user as logged in, manage permissions, and perform auditing.

  Here’s how you can achieve this:

  1. Configure OIDC Authentication
     In your ABP application's startup (e.g., HttpApi.Host or .Web project), configure the OIDC provider using AddOpenIdConnect:

     context.Services.AddAuthentication()
         .AddOpenIdConnect("OidcProvider", "OIDC Provider", options =>
         {
             options.Authority = "<OIDC_Authority_URL>";
             options.ClientId = "<ClientId>";
             options.ClientSecret = "<ClientSecret>";
             options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
             options.CallbackPath = "/signin-oidc";
             options.RequireHttpsMetadata = true;
             options.SaveTokens = true;
             options.GetClaimsFromUserInfoEndpoint = true;
             options.Scope.Add("email");
             options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub");
         });
     

  2. User Creation/Mapping After External Login
     ABP’s Account module handles external logins by default. When a user logs in via an external provider, ABP will attempt to find a user with the external login info. If not found, it will create a new user in the ABP user store using the claims (like email) from the OIDC provider.

     • Ensure the OIDC provider returns the email claim. ABP uses this to create the user.
     • If you are using the v2.0 endpoint, add options.Scope.Add("email"); to your OIDC configuration.

  3. Troubleshooting

     • If users are not being created, check that the email claim is present in the OIDC response.
     • If you get errors like System.ArgumentNullException: Value cannot be null. (Parameter 'userName'), it usually means the email claim is missing.

  4. Customizing User Creation
     If you need to customize how users are created or mapped, you can override the external login logic in the Account module by handling the OnExternalLoginCallbackAsync event.

  5. References and Examples

     • The following articles provide step-by-step guides and troubleshooting for integrating external OIDC providers and ensuring user creation in ABP:
       • How to Use the Azure Active Directory Authentication for MVC / Razor Page Applications
       • How to Setup Azure Active Directory and Integrate ABP Angular Application

  These guides are applicable to any OIDC provider, not just Azure AD, and the same principles apply for Okta or Auth0.

  Sources:

  • How to Use the Azure Active Directory Authentication for MVC / Razor Page Applications
  • How to Setup Azure Active Directory and Integrate ABP Angular Application

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel