Table of Contents

Configure the API Proxy

This step configures the host-side OpenID Connect and downstream API proxy integration used by the recommended application model.

Use this configuration when the ASP.NET Core host should authenticate the user and proxy downstream API traffic on the user's behalf.

Recrovit.RecroGridFramework.Client.Blazor.Host.OpenIdConnect is the recommended app-level entry point for the host/proxy application model.

It combines:

  • the reusable OpenID Connect host infrastructure;
  • the SessionAuth SSR registration;
  • the downstream proxy endpoint wiring used by RecroGrid Framework applications;
  • the Razor Components host setup needed by the shared Blazor application.

Host registration

builder.AddRgfBlazorServerProxyOpenIdConnectRazorComponents();
builder.AddRgfBlazorServerProxyOpenIdConnectHost();

Endpoint mapping

app.MapRgfBlazorServerProxyOpenIdConnectEndpoints("/not-found");
app.MapRgfBlazorServerProxyOpenIdConnectComponents<App>(typeof(BlazorApp.Client._Imports).Assembly);

This setup maps:

  • the host authentication endpoints;
  • the generic downstream proxy endpoints;
  • the RGF-specific proxy routes used by existing applications.

Minimal configuration

Configure the host-facing OpenID Connect behavior under Recrovit:OpenIdConnect:Host and the downstream API under Recrovit:OpenIdConnect:DownstreamApis:RgfApi.

{
  "Recrovit": {
    "OpenIdConnect": {
      "Provider": "MainProvider",
      "Providers": {
        "MainProvider": {
          "Authority": "https://idp.example.com",
          "ClientId": "client-id",
          "ClientSecret": "client-secret",
          "Scopes": [ "openid", "profile", "offline_access" ],
          "CallbackPath": "/signin-oidc",
          "SignedOutRedirectPath": "/"
        }
      },
      "DownstreamApis": {
        "RgfApi": {
          "BaseUrl": "https://rgf-api-app.example.com",
          "Scopes": [ "api.scope" ]
        }
      }
    },
    "RecroGridFramework": {
      "API": {
        "ProxyBaseAddress": "https://app-host.example.com"
      }
    }
  }
}

Production requirements

Before production deployment, verify at minimum:

  • explicit Data Protection key storage;
  • reverse-proxy and forwarded-header behavior;
  • downstream proxy request-protection settings;
  • the host origin used by the interactive client.

Next step