MCCI.Chatbot.Auth 1.0.5

MCCI.Chatbot.Auth

A lightweight .NET SDK that allows a website to reuse its existing logged-in user and roles to authorize access to an external chatbot without a separate chatbot login.

The website remains the identity and authorization authority.
The chatbot trusts tokens issued by the website.

What this package does

This package provides:

• A service to read the currently logged-in user
• Role extraction from the current request
• Role mapping (website roles → chatbot roles)
• Secure JWT token generation

This package does NOT:

• Authenticate users
• Store users or passwords
• Create controllers or endpoints
• Read configuration automatically

Prerequisites

• .NET 6 / 7 / 8
• Existing authentication already configured
  (ASP.NET Identity, OrchardCore, Entra, etc.)

Installation

dotnet add package MCCI.Chatbot.Auth

Step 1: Register the service (Program.cs)

This is the only required setup step after installing the package.

builder.Services.AddChatbotAuth();

Make sure authentication middleware already exists:

app.UseAuthentication();
app.UseAuthorization();

Step 2: Client configuration (appsettings.json)

The client website owns all configuration.

{
  "Chatbot": {
    "SharedSecret": "super-long-32-byte-secret-value",
    "Issuer": "client-website",
    "Audience": "chatbot",
    "RoleMapping": {
      "Administrator": [ "Admin" ],
      "Editor": [ "Editor" ],
      "Student": [ "Student" ]
    }
  }
}

Important rules

• SharedSecret must be at least 32 bytes
• Issuer identifies your website
• Audience identifies the chatbot
• Role mapping is explicit (default deny)

Step 3: Generate a chatbot token

Inject IChatbotAuthService into your controller or service:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using MCCI.Chatbot.Auth;
using System.Security.Claims;

[ApiController]
[Route("api/chatbot")]
public class ChatbotController : ControllerBase
{
    private readonly IChatbotTokenProvider _tokenProvider;
    private readonly IConfiguration _configuration;

    public ChatbotController(
        IChatbotTokenProvider tokenProvider,
        IConfiguration configuration)
    {
        _tokenProvider = tokenProvider;
        _configuration = configuration;
    }

    [HttpGet("token")]
    [Authorize]
    public async Task<IActionResult> GetToken()
    {
        var roleMapping =
            _configuration
                .GetSection("Chatbot:RoleMapping")
                .Get<Dictionary<string, string[]>>() ?? new();

        var token = await _tokenProvider.GetTokenAsync(
            HttpContext,
            sharedSecret: _configuration["Chatbot:SharedSecret"]!,
            roleMapping: roleMapping,
            issuer: _configuration["Chatbot:Issuer"]!,
            audience: _configuration["Chatbot:Audience"]!
        );

        return Ok(new { token });
    }
}

What this endpoint does

• Requires the user to be authenticated
• Extracts the current user and roles
• Maps roles according to configuration
• Generates a JWT token for the chatbot
• Returns the token to the caller

Security notes

• Tokens are generated server-side only
• Secrets never go to the browser
• Tokens are short-lived
• Each website should use a unique secret
• Issuer and audience must be validated by the chatbot