Table of Contents

Backend API Authentication

Configure bearer-token validation for the RecroGrid Framework backend API.

Configure API-side authentication for RecroGrid Framework applications that use an OpenID Connect identity provider.

The API validates bearer tokens issued for the configured API resource. The client-side authentication flow depends on the selected application model and is documented separately under SessionAuth and Blazor WebAssembly Authentication.

JWT bearer package

Install the JWT bearer authentication package in the backend API application.

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

or with Package Manager:

Install-Package Microsoft.AspNetCore.Authentication.JwtBearer

Provider configuration

The current RecroGrid Framework application template selects the configured provider through JwtBearerOptions:Provider and binds the matching provider section to the ASP.NET Core JWT bearer options.

For local development, the example below uses the same identity-provider address as the RecroGrid Framework demo configuration.

"JwtBearerOptions": {
  "Provider": "Duende",
  "Duende": {
    "Authority": "https://localhost:11900", // Production example: https://identity.example.com
    "Audience": "api://RgfDemo.Api",
    "TokenValidationParameters": {
      "ValidTypes": [ "at+jwt" ]
    }
  },
  "AzureAD": {
    "Authority": "https://login.microsoftonline.com/{TENANT ID}/v2.0",
    "Audience": "{Application (client) ID}",
    "TokenValidationParameters": {
      "ValidTypes": [ "JWT" ]
    }
  }
}

Configure Microsoft Entra ID or Duende through the corresponding provider-specific section.

API registration

The current application template reads the selected provider and binds that provider section when registering JWT bearer authentication:

var provider = builder.Configuration.GetValue("JwtBearerOptions:Provider", "Duende");
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        builder.Configuration.Bind($"JwtBearerOptions:{provider}", options);
        options.TokenValidationParameters.SignatureValidator =
            (token, parameters) => new Microsoft.IdentityModel.JsonWebTokens.JsonWebToken(token);
    });

The API startup pipeline enables authentication before authorization:

app.UseAuthentication();
app.UseAuthorization();