Rwd.IAM.Client.AspNetCore 2.0.2

Rwd.IAM.Client.AspNetCore

Optional helpers for ASP.NET Core on top of Rwd.IAM.Client: bearer middleware (validates JWT and sets HttpContext.User), permission filters, and minimal API extensions.

1. Bearer validation middleware (recommended flow)

Registers IAM JWT validation once in the pipeline: reads Authorization: Bearer, calls IIamAccessTokenValidator, assigns HttpContext.User. Endpoints marked [AllowAnonymous] are skipped.

Program.cs example

using Rwd.IAM.Client.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRwdIamAccessTokenValidation(o =>
{
    o.BaseUrl = new Uri(builder.Configuration["Iam:ApiBaseUrl"]!);
    o.IssuerUrl = new Uri(builder.Configuration["Iam:IssuerUrl"]!);
    o.RealmName = builder.Configuration["Iam:Realm"]!;
    // Central services may trust several realms:
    // o.TrustedRealmNames = ["citizens", "main", "master"];
});

builder.Services.AddIamBearerAuthentication(o =>
{
    o.Audience = builder.Configuration["Iam:ApiAudience"]; // e.g. "dms-api"; recommended
    o.AllowAnonymousWhenMissingBearer = true; // default: no Bearer → anonymous
});

builder.Services.AddControllers();
builder.Services.AddAuthorization();

var app = builder.Build();

app.UseRouting();

// After routing (so [AllowAnonymous] / endpoint metadata is visible)
app.UseIamBearerAuthentication();

app.UseAuthorization();
app.MapControllers();

app.Run();

Controller

[ApiController]
[Route("api/[controller]")]
[Authorize] // user must be authenticated (middleware set HttpContext.User)
public class DistrictsController : ControllerBase
{
    [AllowAnonymous]
    [HttpGet("public")]
    public IActionResult Public() => Ok();

    [HttpGet("secure")]
    [RequireIamPermission("districts", "view")]
    public IActionResult Secure() => Ok();
}

Order matters: UseRouting → UseIamBearerAuthentication → UseAuthorization → Map*.
If you omit AddIamBearerAuthentication(), options still default; call it when you need Audience or AllowAnonymousWhenMissingBearer.

2. MVC — [RequireIamPermission] only (no middleware)

If you already set HttpContext.User elsewhere, use the attribute alone:

[HttpGet]
[RequireIamPermission("districts", "view")]
public IActionResult List() => Ok();

Multiple attributes = AND. Alternative: [RequireIamPermission("districts:view")].

3. Minimal APIs

app.MapGet("/districts", () => Results.Ok())
   .RequireIamPermission("districts", "view");

With middleware, add RequireAuthorization() on routes that need a validated user:

app.MapGet("/districts", () => Results.Ok())
   .RequireAuthorization()
   .RequireIamPermission("districts", "view");

Packages

dotnet add package Rwd.IAM.Client
dotnet add package Rwd.IAM.Client.AspNetCore

Version both together when publishing from this repository.