Understanding Identityserver4 with Identity (cookies/tokens, server architecture)

Admin 1
Viewed 1006

I have some problems seeing the big picture when it comes to understanding how it all fits togheter. It's a big topic for a beginner.

What is the point of Identity's cookies and all its default templates/pages when combined with IdentityServer, when it issues tokens?

And why are these pages included in all the examples even when using SPA clients? Isn't the whole point to be able to authorize/authenticate/register via an API?

I see many suggest that one should have IdentityServer in it's own project, and then the user database on a local network separately, how is that possible? I have not found one sample of this.

Why is there any need to separate the userdatabase from the resource API, and isn't the combined IdentityServer4 and Identity its own API?

I appreciate your time and help.

identityserver4 asp.net-identity asp.net-core c#
2 Answers

Identity Server should always be a separate project, and it should be the only one who has direct access to the user database. Here is a nice video on Identity Server and a newer one here, and here is a great github repo with a IS project pretty much completed that i use. Hope it helps.

user_113204260

Imagine an organizations that has several websites, each provide a service to users. This organization will benefit in several ways by using OAuth/OpenID Connect:

  • It gets single sign-on, meaning users need to create only one account and they will be able to use all of this organization's services.
  • It can provide access to its resources for other websites and services (machine-to-machine) with subscription and limitation (client credential). For example this organization might have a weather API that can be consumed by other Applications.
  • It can provide access to its resources behalf of a user. For example it might have a popular photo album creating website and someone else has a popular photo editor and effects website. It would be great if this photo editor website could import user's photos from their photo album in that website (with their consent of course)

Architecture and flow (I'm going to skip the technical stuff and OAuth flows):

We have a dedicated IdentityServer4 website that is responsible for creating and logging user accounts. No one else should have access to users database.

Now one of this organization's website (let's call it Photo Album) wants to login a user, this is what happens:

  • First it redirects the user to the IS4 website
  • User logs in, the IS4 website set's a cookie on the browser for its own website (so next time the user comes here he/she is logged in) and redirects the user back to Photo Album with a token or code
  • Photo Album does a bunch of things behind the scene (for example it might exchange the code with a token) and at the end it has a token with user's information. At this point Photo Album also stores this information in a cookie so that next time the user comes here he/she is logged in

Now another website of this organization (let's call it Online Drive) wants to login a user:

  • First it redirects the user to the IS4 website
  • The IS4 website recognizes the user (via the cookie that it had set before) and redirects the user back to Online Drive with a token or code
  • Online Drive also does a bunch of things behind the scene and it also stores user's information in a cookie so that next time the user comes here he/she is logged in

Now a third party website (let's call it Photo Editor) wants to access user's photos in Photo Album:

  • First it redirects the user to the IS4 website (and it specifies what it wants to access)
  • The IS4 website recognizes the user (via the cookie that it had set before) and shows user a consent page and ask the user if he/she is OK to let Photo Editor access their specified resource (for example their albums)
  • If user accepts, IS4 redirects the user back to Photo Editor with a token or code and at that point Photo Editor can call Photo Album's APIs and access user's resources

I hope I've helped, I recommend reading Securing the Perimeter book and IdentityServer docs.

user_66835250
Related