Azure AD/OpenID login

[lyngesdk]

Hi,

We're having trouble with implementing Azure AD/OpenID login.
We have tried the following code, but we get an access denied error when trying to access the piranha manager, all pages are working as expected.
We are logged in correctly, and our user has the PiranhaAdmin role.

builder.Services.AddAuthentication(options =>
    {
        options.DefaultScheme = OpenIdConnectDefaults.AuthenticationScheme;
        options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    })
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddPiranhaManager((permission, options) =>
{
    options.RequireRole("PiranhaAdmin");
});

Kind Regards
Kim

[tidyui]

Hi there! Take a look at #1864, I think the final step is missing in our docs.

[lyngesdk]

Hi, still no luck.

Now we're getting an Access Denied error, when trying to access the Piranha Manager,
We're testing locally in IIS express and Edge browser.

Full Program.cs code below:

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddTransient<IEmployeeService, EmployeeService>();

builder.Services.AddPiranhaManager((permission, options) =>
{
    options.RequireRole("PiranhaAdmin");
});

builder.AddPiranha(options =>
{
    /**
     * This will enable automatic reload of .cshtml
     * without restarting the application. However since
     * this adds a slight overhead it should not be
     * enabled in production.
     */
    options.AddRazorRuntimeCompilation = true;

    options.UseCms();
    options.UseManager();
    options.UseFileStorage(naming: Piranha.Local.FileStorageNaming.UniqueFolderNames);
    options.UseImageSharp();
    options.UseTinyMCE();
    options.UseMemoryCache();

    var connectionString = builder.Configuration.GetConnectionString("piranha");
    options.UseEF<SQLServerDb>(db => db.UseSqlServer(connectionString));

    options.UseSecurity(o => o.UsePermission(""));
    /**
     * Here you can configure the different permissions
     * that you want to use for securing content in the
     * application.
    options.UseSecurity(o =>
    {
        o.UsePermission("WebUser", "Web User");
    });
     */

    /**
     * Here you can specify the login url for the front end
     * application. This does not affect the login url of
     * the manager interface.
    options.LoginUrl = "login";
     */
});

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

builder.Services.Configure<DataProtectionTokenProviderOptions>(opt =>
{
    opt.TokenLifespan = TimeSpan.FromMinutes(15);
});

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

app.UseExceptionHandler("/Error");
app.UseHsts();
app.UseHttpsRedirection();

app.UseCookiePolicy(new CookiePolicyOptions
{
    HttpOnly = HttpOnlyPolicy.Always,
    Secure = CookieSecurePolicy.Always,
    MinimumSameSitePolicy = SameSiteMode.Strict,
    OnAppendCookie = context =>
    {
        if (context.CookieName == "XSRF-REQUEST-TOKEN") // Piranha's antiforgery cookie's name
        {
            context.CookieOptions.HttpOnly = false;
        }
    }
});

app.UsePiranha(options =>
{
    // Initialize Piranha
    App.Init(options.Api);

    App.Modules.Manager().Scripts.Add("~/assets/js/birthday-block.js");
    App.Blocks.Register<BirthdayBlock>();

    // Build content types
    new ContentTypeBuilder(options.Api)
        .AddAssembly(typeof(Program).Assembly)
        .Build();
        //.DeleteOrphans();

    // Configure Tiny MCE
    EditorConfig.FromFile("editorconfig.json");

    options.UseManager();
    options.UseTinyMCE();
    options.UseIdentity();
});

app.Run();

[biapar]

I'm interested, too.

[kttary]

Currently i'm using keycloak. It succesfully login but then access denied. This happened when i use options.NonceCookie.SameSite = SameSiteMode.None; options.CorrelationCookie.SameSite = SameSiteMode.None;. Another value like SameSiteMode.Strict give me error 500. Hope someone else using keycloak as idp here and succesfully integrate it with keycloak

[adonisadipos]

I'm interested how you get so far. is there some snippets available?

[haarhoff-frs]

I don't know if its still relevant, but I got no problems with authenticating and opening the manager using MicrosoftIdentityWebApp.

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(options =>
            {
                config.Bind("AzureAd", options);                
            });

Then I map Piranhas roles to my app roles using services.AddPiranhaManager. My problem is, that the Antiforgery Tokens do not get validated when saving stuff in the manager. The cookie is there after visiting /manager/auth/login, but it does not seem to contain the right value