Fix scopes, strange effects with Openiddict

Author: damienbod

ResourceServer/HostingExtensions.cs

@@ -1,6 +1,7 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Logging;
 using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
 using ResourceServer.Model;
 using ResourceServer.Repositories;
@@ -99,11 +100,13 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
         {
             options.AddPolicy("dataEventRecordsAdmin", policyAdmin =>
             {
-                policyAdmin.RequireClaim("role", "dataEventRecords.admin");
+                //policyAdmin.RequireClaim("role", "dataEventRecords.admin");
+                policyAdmin.Requirements.Add(new RequireScope());
             });
             options.AddPolicy("dataEventRecordsUser", policyUser =>
             {
-                policyUser.RequireClaim("role", "dataEventRecords.user");
+                //policyUser.RequireClaim("role", "dataEventRecords.user");
+                policyUser.Requirements.Add(new RequireScope());
             });
             options.AddPolicy("dataEventRecordsPolicy", policyUser =>
             {
@@ -120,6 +123,8 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
 
     public static WebApplication ConfigurePipeline(this WebApplication app)
     {
+        IdentityModelEventSource.ShowPII = true;
+
         var deploySwaggerUI = app.Configuration.GetValue<bool>("DeploySwaggerUI");
         app.UseCors("AllowAllOrigins");
 

ResourceServer/Properties/launchSettings.json

@@ -1,21 +1,5 @@
 {
-  "iisSettings": {
-    "windowsAuthentication": false,
-    "anonymousAuthentication": true,
-    "iisExpress": {
-      "applicationUrl": "https://localhost:44390/",
-      "sslPort": 44390
-    }
-  },
   "profiles": {
-    "IIS Express": {
-      "commandName": "IISExpress",
-      "launchBrowser": true,
-      "launchUrl": "https://localhost:44390/swagger",
-      "environmentVariables": {
-        "ASPNETCORE_ENVIRONMENT": "Development"
-      }
-    },
     "ResourceServer": {
       "commandName": "Project",
       "launchUrl": "https://localhost:44390/swagger",

ResourceServer/RequireScopeHandler.cs

@@ -12,8 +12,6 @@ protected override Task HandleRequirementAsync(
         {
             throw new ArgumentNullException(nameof(context));
         }
-            
-
         if (requirement == null)
         {
             throw new ArgumentNullException(nameof(requirement));
@@ -22,7 +20,7 @@ protected override Task HandleRequirementAsync(
         var scopeClaim = context.User.Claims.FirstOrDefault(t => t.Type == "scope");
 
 
-        if (scopeClaim != null && (context.User.HasScope("dataEventRecords")))
+        if (scopeClaim != null && (scopeClaim.Value.Contains("dataEventRecords")))
         {
             context.Succeed(requirement);
         }

ResourceServer/appsettings.json

@@ -3,8 +3,8 @@
     "DefaultConnection": "Data Source=dataeventrecords.sqlite"
   },
   "ProfileApiConfigurations": {
-    "Authority": "https://localhost:44337",
-    "Audience": "dataEventRecordsApi"
+    "Authority": "https://localhost:44395/",
+    "Audience": "rs_dataEventRecordsApi"
   },
   "DeploySwaggerUI": true,
   "Serilog": {