Signing credentials are used to protect against tampering. They can be either asymmetric (e.g a RSA or ECDSA key) or symmetric.
Encryption credentials are used to ensure the content of tokens cannot be read by malicious parties. They can be either asymmetric (e.g a RSA key) or symmetric.
-
Note
Tokens generated using the opt-in ASP.NET Core Data Protection integration rely on their own key ring, distinct from the credentials discussed in this documentation.
-For more information about Data Protection, visit ASP.NET Core Data Protection.
+
Note
Tokens generated using the opt-in ASP.NET Core Data Protection integration rely on their own key ring, distinct from the credentials discussed in this documentation.
Registering credentials in the authorization server options
OpenIddict allows registering one or multiple keys (raw keys or embedded in X.509 certificates).
@@ -120,8 +120,8 @@ are not used by OpenIddict and certificates with the furthest expiration date ar
.AddEphemeralSigningKey();
});
Note
options.AddEphemeralEncryptionKey() generates an asymmetric RSA key which is not directly used as-is to encrypt the tokens but is used to encrypt an
-intermediate per-token symmetric key with which the token content is first encrypted using AES.
-For more information about this mechanism, read Key Encryption with RSAES OAEP.
+intermediate per-token symmetric key with which the token content is first encrypted using AES.
+
For development purposes, a certificate can be generated and stored by OpenIddict in the certificates store of the user account running the OpenIddict server feature.
@@ -176,7 +176,7 @@ var data = certificate.Export(X509ContentType.Pfx, string.Empty);
For IIS applications, storing the certificates in the machine store is the recommended option.
OpenIddict 3.0 comes with sensible defaults, but depending on the scenarios, the default settings can be amended to change how OpenIddict reacts to requests.
Proof Key for Code Exchange
diff --git a/guide/choosing-the-right-flow.html b/guides/choosing-the-right-flow.html
similarity index 100%
rename from guide/choosing-the-right-flow.html
rename to guides/choosing-the-right-flow.html
diff --git a/guide/choosing-the-right-flow/authorization-code-flow.png b/guides/choosing-the-right-flow/authorization-code-flow.png
similarity index 100%
rename from guide/choosing-the-right-flow/authorization-code-flow.png
rename to guides/choosing-the-right-flow/authorization-code-flow.png
diff --git a/guide/choosing-the-right-flow/client-credentials-flow.png b/guides/choosing-the-right-flow/client-credentials-flow.png
similarity index 100%
rename from guide/choosing-the-right-flow/client-credentials-flow.png
rename to guides/choosing-the-right-flow/client-credentials-flow.png
diff --git a/guide/choosing-the-right-flow/consent-form.png b/guides/choosing-the-right-flow/consent-form.png
similarity index 100%
rename from guide/choosing-the-right-flow/consent-form.png
rename to guides/choosing-the-right-flow/consent-form.png
diff --git a/guide/choosing-the-right-flow/implicit-flow.png b/guides/choosing-the-right-flow/implicit-flow.png
similarity index 100%
rename from guide/choosing-the-right-flow/implicit-flow.png
rename to guides/choosing-the-right-flow/implicit-flow.png
diff --git a/guide/choosing-the-right-flow/resource-owner-password-flow.png b/guides/choosing-the-right-flow/resource-owner-password-flow.png
similarity index 100%
rename from guide/choosing-the-right-flow/resource-owner-password-flow.png
rename to guides/choosing-the-right-flow/resource-owner-password-flow.png
diff --git a/guide/getting-started.html b/guides/getting-started.html
similarity index 89%
rename from guide/getting-started.html
rename to guides/getting-started.html
index 368ab2c..8cecfc2 100644
--- a/guide/getting-started.html
+++ b/guides/getting-started.html
@@ -113,12 +113,11 @@ Here's an example for the client credentials grant, used in machine-to-machi
services.AddDbContext<ApplicationDbContext>(options =>
{
- // Configure the context to use Microsoft SQL Server.
+ // Configure Entity Framework Core to use Microsoft SQL Server.
options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
// Register the entity sets needed by OpenIddict.
- // Note: use the generic overload if you need
- // to replace the default OpenIddict entities.
+ // Note: use the generic overload if you need to replace the default OpenIddict entities.
options.UseOpenIddict();
});
@@ -186,33 +185,16 @@ Here's an example for the client credentials grant, used in machine-to-machi
Update your Entity Framework Core context registration to register the OpenIddict entities:
services.AddDbContext<ApplicationDbContext>(options =>
{
- // Configure the context to use Microsoft SQL Server.
+ // Configure Entity Framework Core to use Microsoft SQL Server.
options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
// Register the entity sets needed by OpenIddict.
- // Note: use the generic overload if you need
- // to replace the default OpenIddict entities.
+ // Note: use the generic overload if you need to replace the default OpenIddict entities.
options.UseOpenIddict();
});
-
Warning
If you change the default entity primary key (e.g. to int or Guid instead of string), make sure you use the options.ReplaceDefaultEntities<TKey>()
-core extension accepting a TKey generic argument and use the generic options.UseOpenIddict<TKey>() overload to configure EF Core to use the specified type:
-
services.AddOpenIddict()
- .AddCore(options =>
- {
- // Configure OpenIddict to use the default entities with a custom key type.
- options.UseEntityFrameworkCore()
- .UseDbContext<ApplicationDbContext>()
- .ReplaceDefaultEntities<Guid>();
- });
-
-services.AddDbContext<ApplicationDbContext>(options =>
-{
- // Configure the context to use Microsoft SQL Server.
- options.UseSqlServer(configuration["Data:DefaultConnection:ConnectionString"]);
-
- options.UseOpenIddict<Guid>();
-});
-
Create your own authorization controller:
Implementing a custom authorization controller is required to allow OpenIddict to create tokens based on the identities and claims you provide.
diff --git a/guide/index.html b/guides/index.html
similarity index 100%
rename from guide/index.html
rename to guides/index.html
diff --git a/guide/migration/20-to-30.html b/guides/migration/20-to-30.html
similarity index 100%
rename from guide/migration/20-to-30.html
rename to guides/migration/20-to-30.html
diff --git a/guide/toc.html b/guides/toc.html
similarity index 100%
rename from guide/toc.html
rename to guides/toc.html
diff --git a/index.html b/index.html
index 9385834..823bd1a 100644
--- a/index.html
+++ b/index.html
@@ -99,7 +99,7 @@
Configure Entity Framework Core to register the OpenIddict entities in the model:
+
services.AddDbContext<ApplicationDbContext>(options =>
+{
+ // Configure the Entity Framework Core to use Microsoft SQL Server.
+ options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
+
+ // Register the entity sets needed by OpenIddict.
+ options.UseOpenIddict();
+});
+
+
Use migrations or recreate the database to add the OpenIddict entities.
+For more information, read Migrations Overview.
+
+
+
Advanced configuration
+
Use a custom primary key type
+
By default, the Entity Framework Core integration uses string primary keys, which matches the default key type used by ASP.NET Core Identity.
+
To use a different key type (e.g int, long or Guid):
+
+
Call the generic ReplaceDefaultEntities<TKey>() method to force OpenIddict to use the default entities with the specified key type:
+
services.AddOpenIddict()
+ .AddCore(options =>
+ {
+ // Configure OpenIddict to use the default entities with a custom key type.
+ options.UseEntityFrameworkCore()
+ .UseDbContext<ApplicationDbContext>()
+ .ReplaceDefaultEntities<Guid>();
+ });
+
+
Configure Entity Framework Core to include the default entities with the chosen key type in the model:
+
services.AddDbContext<ApplicationDbContext>(options =>
+{
+ // Configure Entity Framework Core to use Microsoft SQL Server.
+ options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
+
+ // Register the entity sets needed by OpenIddict but use a custom key type.
+ options.UseOpenIddict<Guid>();
+});
+
+
+
Use custom entities
+
For applications that require storing additional data alongside the properties used by OpenIddict, custom entities can be used. For that, you need to:
+
+
Create custom entities:
+
public class CustomApplication : OpenIddictEntityFrameworkCoreApplication<long, CustomAuthorization, CustomToken>
+{
+ public string CustomProperty { get; set; }
+}
+
+public class CustomAuthorization : OpenIddictEntityFrameworkCoreAuthorization<long, CustomApplication, CustomToken>
+{
+ public string CustomProperty { get; set; }
+}
+
+public class CustomScope : OpenIddictEntityFrameworkCoreScope<long>
+{
+ public string CustomProperty { get; set; }
+}
+
+public class CustomToken : OpenIddictEntityFrameworkCoreToken<long, CustomApplication, CustomAuthorization>
+{
+ public string CustomProperty { get; set; }
+}
+
+
Call the generic ReplaceDefaultEntities<TApplication, TAuthorization, TScope, TToken, TKey>() method to force OpenIddict to use the custom entities:
+
services.AddOpenIddict()
+ .AddCore(options =>
+ {
+ // Configure OpenIddict to use the custom entities.
+ options.UseEntityFrameworkCore()
+ .UseDbContext<ApplicationDbContext>()
+ .ReplaceDefaultEntities<CustomApplication, CustomAuthorization, CustomScope, CustomToken, long>();
+ });
+
+
Configure Entity Framework Core to include the custom entities in the model:
+
services.AddDbContext<ApplicationDbContext>(options =>
+{
+ // Configure Entity Framework Core to use Microsoft SQL Server.
+ options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
+
+ // Register the entity sets needed by OpenIddict but use the specified entities instead of the default ones.
+ options.UseOpenIddict<CustomApplication, CustomAuthorization, CustomScope, CustomToken, long>();
+});
+
OpenIddict offers native integrations with popular Object–relational Mapping tools and Database Clients like Entity Framework 6 and Entity Framework Core or MongoDB.
+
Documentation for integrations maintained by the OpenIddict community can be found in their respective repositories:
By default, OpenIddict uses the openiddict.[entity name]s pattern to determine the default collection names.
+Applications that require using different collection names can use the Set*CollectionName() helpers:
+