Table of Contents

Backend API Authentication

This page contains the API-side authentication configuration used by RecroGrid Framework applications with an OpenID Connect identity provider.

The API validates bearer tokens issued for the configured API resource. The client-side authentication flow depends on the selected application model and is documented separately under SessionAuth and Blazor WebAssembly Authentication.

JWT bearer package

Install the JWT bearer authentication package in the backend API application.

dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer

or with Package Manager:

Install-Package Microsoft.AspNetCore.Authentication.JwtBearer

Provider configuration

The current RecroGrid Framework application template selects the configured provider through JwtBearerOptions:Provider and binds the matching provider section to the ASP.NET Core JWT bearer options.

"JwtBearerOptions": {
  "Provider": "Duende",
  "Duende": {
    "Authority": "https://localhost:11900",
    "Audience": "api://RgfDemo.Api",
    "TokenValidationParameters": {
      "ValidTypes": [ "at+jwt" ]
    }
  },
  "AzureAD": {
    "Authority": "https://login.microsoftonline.com/{TENANT ID}/v2.0",
    "Audience": "{Application (client) ID}",
    "TokenValidationParameters": {
      "ValidTypes": [ "JWT" ]
    }
  }
}

The existing Microsoft Entra ID and Duende examples are therefore preserved as provider-specific sections of the current configuration structure.

API registration

The current application template reads the selected provider and binds that provider section when registering JWT bearer authentication:

var provider = builder.Configuration.GetValue("JwtBearerOptions:Provider", "Duende");
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        builder.Configuration.Bind($"JwtBearerOptions:{provider}", options);
        options.TokenValidationParameters.SignatureValidator =
            (token, parameters) => new Microsoft.IdentityModel.JsonWebTokens.JsonWebToken(token);
    });

The API startup pipeline enables authentication before authorization:

app.UseAuthentication();
app.UseAuthorization();