AnyTixAuth 1.2.0

AnyTixAuth

Secure-by-default JWT authentication and authorization for AnyTix ASP.NET Core resource APIs.

For local package creation, MVC examples, direct request testing, and the complete integration sequence, see the repository's docs/resource-api-jwt-validation.md.

The package validates access tokens locally with the AuthApi issuer's OpenID Connect metadata and public signing keys. It does not call the auth database for normal API requests and does not depend on the AuthApi assembly.

Profile PII is intentionally absent from newly issued access tokens. Frontend and mobile clients call AuthApi /auth/me; trusted resource APIs can opt into the service-authenticated profile client described below.

Install

dotnet add package AnyTixAuth

Configure

{
  "AnyTixAuth": {
    "MetadataAddress": "https://auth.example.com/.well-known/openid-configuration",
    "Issuer": "https://auth.example.com",
    "Audience": "ticketing-api",
    "RequireHttpsMetadata": true,
    "ClockSkewSeconds": 60
  }
}

using System.Security.Claims;
using AnyTixAuth;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAnyTixAuth(
    builder.Configuration.GetSection(
        AnyTixAuthDefaults.ConfigurationSectionName));

var app = builder.Build();

app.UseAnyTixAuth();

app.MapGet("/health/live", () => Results.Ok())
    .ExcludeFromAnyTixAuth();

app.MapGet("/orders", (ClaimsPrincipal user) =>
    Results.Ok(new { UserId = user.FindFirst("sub")?.Value }));

app.MapGet("/me", (ClaimsPrincipal user) =>
    Results.Ok(user.GetAnyTixUserData()));

app.MapPost("/scanner/check-in", () => Results.NoContent())
    .RequireAuthorization(policy => policy.RequireRole("scanner", "admin"));

app.Run();

Read Validated User And Token Data

GetAnyTixUserData() returns typed user fields, roles, scopes, issuer, audiences, token ID, issued/not-before/expiry timestamps, and AllClaims, which preserves every validated payload claim and repeated value:

AnyTixUserData userData = User.GetAnyTixUserData();

string? userId = userData.UserId;
IReadOnlyList<string> roles = userData.Roles;
IReadOnlyDictionary<string, IReadOnlyList<string>> allClaims =
    userData.AllClaims;

Call it on protected endpoints. The method reads the authenticated ClaimsPrincipal; it does not decode arbitrary tokens, expose the authorization header, or replace endpoint authorization.

For newly issued tokens, profile properties such as email, phone, name, and preferred username are empty because those claims are no longer emitted.

Retrieve Current Profile Data

Configure one confidential OAuth client per trusted business API. Keep ClientSecret in environment-backed configuration or a secret manager.

{
  "AnyTixAuth": {
    "UserClient": {
      "BaseAddress": "https://auth.example.com",
      "RequireHttps": true,
      "TokenEndpoint": "/connect/token",
      "ClientId": "ticketing-api",
      "ClientSecret": "<deployment secret>",
      "Scope": "users.read",
      "RefreshBeforeExpirySeconds": 30
    }
  }
}

builder.Services.AddAnyTixUserClient(
    builder.Configuration.GetSection("AnyTixAuth:UserClient"));

app.MapGet("/profile", async (
    IAnyTixUserClient users,
    CancellationToken cancellationToken) =>
    Results.Ok(await users.GetCurrentUserAsync(cancellationToken)));

GetCurrentUserAsync() reads the validated current sub automatically. Use GetUserByIdAsync(userId) only in trusted server-side workflows. The SDK obtains and caches a short-lived service token through OAuth client credentials; it never forwards the end-user bearer token for profile lookup.

Set RequireHttps to false only for an explicitly configured local HTTP development environment.

All endpoints require a valid access token by default. Exclude only intentional public endpoints with ExcludeFromAnyTixAuth(), the standard AllowAnonymous() endpoint extension, or [AllowAnonymous] on MVC controller actions.

Role, scope, ownership, and other business authorization remain the responsibility of the consuming API.

The configured Audience must exactly match the AuthApi AUTH_AUDIENCE value. Clients call this resource API directly with Authorization: Bearer <access_token>; they do not send business requests through the auth proxy.