Zwedze.Aetherweave.Security.Oidc 0.2.5

Aetherweave.Security.Oidc

Configuration-driven OIDC authentication for Blazor WebAssembly clients, with authorized HttpClient registration built on top of Zwedze.Aetherweave.Http.

Features

• One-Line Registration - Configure AddOidcAuthentication from appsettings.json instead of hand-wiring ProviderOptions
• Startup Validation - Missing or invalid configuration throws immediately via Zwedze.Aetherweave.Core
• Authorized HTTP Clients - Register Aetherweave typed HttpClients that automatically attach the OIDC access token
• Type-Safe Options - AetherweaveOidcOptions validated via data annotations

Installation

dotnet add package Zwedze.Aetherweave.Security.Oidc

Configuration (Aetherweave:Security:Oidc)

{
  "Aetherweave": {
    "Security": {
      "Oidc": {
        "Authority": "https://identity.example.com",
        "ClientId": "orders-web",
        "ResponseType": "code",
        "DefaultScopes": [ "openid", "profile", "orders-api" ],
        "RedirectUri": "authentication/login-callback",
        "PostLogoutRedirectUri": "authentication/logout-callback"
      }
    }
  }
}

Quick Start

1. Register OIDC client authentication

builder.Services.AddAetherweaveOidcClientAuthentication(builder.Configuration);

// Or with a custom section name
builder.Services.AddAetherweaveOidcClientAuthentication(builder.Configuration, "MyApp:Oidc");

This reads and validates AetherweaveOidcOptions from configuration, then calls AddOidcAuthentication(...) mapping Authority, ClientId, ResponseType, RedirectUri, PostLogoutRedirectUri, and appending every entry of DefaultScopes to ProviderOptions.DefaultScopes.

2. Register authorized HttpClients

AddAetherweaveOidcHttpClients returns a builder whose typed clients are registered via Zwedze.Aetherweave.Http and automatically attach the current OIDC access token through AuthorizationMessageHandler.

builder.Services
    .AddAetherweaveOidcHttpClients(authorizedUrls: ["https://api.example.com"])
    .AddAetherweaveHttpClient<IOrderServiceClient, OrderServiceClient>(
        builder.Configuration,
        "OrderService");

authorizedUrls are the base addresses the access token is allowed to be attached to — pass the same URLs registered with AuthorizationMessageHandler (matches Blazor WebAssembly's standard WithAuthorizationMessageHandler set up in Program.cs).

3. Attach auth to any other IHttpClientBuilder

For clients not registered through AddAetherweaveOidcHttpClients, the WithAuth extension attaches the same handler directly:

builder.Services
    .AddHttpClient<IOrderServiceClient, OrderServiceClient>()
    .WithAuth(["https://api.example.com"]);

API Reference