integrate blazor with aws cognito using openid - amazon-cognito

Question

I am trying to integrate aws cognito in Blazor server app. I have configured user pool in cognito, and changed the startup as
services.AddAuthentication()
.AddCookie()
.AddOpenIdConnect(options =>
{
options.ResponseType = "code";
options.MetadataAddress = "address here";
options.ClientId = "clientid";
options.ClientSecret = "secret";
});
now how to display the cognito sign in page once the blazor application loads and then after sign in i want to redirect to blazor default page.
any help please.

Answer 1

I spent a couple of days trying to figure this all out. Following is what I came up with.
Program.cs
builder.Services.AddAuthentication(opt =>
{
opt.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
opt.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, opt =>
{
opt.Authority = builder.Configuration["AWS:Authority"]; //"https://cognito-idp.ap-southeast-2.amazonaws.com/ap-southeast-XXXXX/";
opt.ClientId = builder.Configuration["Secret_AWS:ClientId"];
opt.ClientSecret = builder.Configuration["Secret_AWS:ClientSecret"];
opt.ResponseType = OpenIdConnectResponseType.Code;
opt.SaveTokens = true;
opt.GetClaimsFromUserInfoEndpoint = true;
opt.UseTokenLifetime = true;
opt.Scope.Add("openid");
opt.Scope.Add("email");
opt.Scope.Add("profile");
opt.CallbackPath = "/signin-oidc"; //This is where you can change the callback path. Just remember to change the ReturnUrl in the Cognito console
opt.TokenValidationParameters = new TokenValidationParameters()
{
NameClaimType = "name"
};
opt.Events = new OpenIdConnectEvents //if you want to see what is going on during the authentication handshake, you can hook into these events as follows (only first one shown for brevity)
{
//order of calling during login. OnRedirectToIdentityProvider, OnMessageReceived, OnAuthorizationCodeReceived, OnTokenResponseReceived, OnTokenValidated, OnUserInformationReceived, OnTicketReceived,
OnRedirectToIdentityProvider = async ctx =>
{
AuthEventFlow = $"{AuthEventFlow}OnRedirectToIdentityProvider, ";
}
}
});
string? AuthEventFlow;
I found it useful studying the Cognito authentication endpoints Amazon Cognito Endpoints Link. It seems that a lot of the magic happens as a result of setting opt.GetClaimsFromUserInfoEndpoint = true. OpenIdConnect then gets all of the various Cognito endpoints by querying https://cognito-idp.Region.amazonaws.com/your user pool ID/.well-known/openid-configuration
In order to call the Cognito hosted UI, create the following Razor pages in your Pages folder
Login.cshtml
#page
#model AmmanControls.Pages.LoginModel
#{
}
Login.cshtml.cs
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Mvc.RazorPages;
namespace XXXX.Pages
{
public class LoginModel : PageModel
{
public async Task OnGet(string redirectUri)
{
await HttpContext.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties { RedirectUri = redirectUri });
//This was a critical point for me - it is the entry point to the OpenIdConnect login events
}
}
}
Logout.cshtml
#page
#model AmmanControls.Pages.LogoutModel
#{
}
Logout.cshtml.cs
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.RazorPages;
namespace XXX.Pages
{
public class LogoutModel : PageModel
{
public async Task<IActionResult> OnGetAsync()
{
await HttpContext.SignOutAsync();
return Redirect("/");
}
}
}
You then call these pages as follows:
Shared\LoginDisplay.razor
<AuthorizeView>
<Authorized>
<a>Hello, #context.User.Identity.Name </a>
<form method="get" action="logout">
<button type="submit" class="nav-link btn btn-link">Log out</button>
</form>
</Authorized>
<NotAuthorized>
Log in
</NotAuthorized>
</AuthorizeView>
Must admit I couldn't believe it when I finally got to click the Login button and all of the redirects just worked!
The problem I'm having now is that #context.User.Identity.Name is null even though the user is authenticated and I'm working out how to get the name of the authenticated user from the claims into the ClaimPrincipal. Will post an update when I figure that out.