Class OidcAuthProvider

Namespace

Kuestenlogik.Bowire.Auth.Oidc

Assembly

Kuestenlogik.Bowire.Auth.Oidc.dll

OpenID Connect IBowireAuthProvider built on Microsoft.Identity.Web. Activated by --auth-provider oidc (or Bowire:Auth:ProviderId=oidc); reads its own settings under Bowire:Auth:Oidc:*:

{
  "Bowire": {
    "Auth": {
      "ProviderId": "oidc",
      "Oidc": {
        "Authority": "https://login.example.com/",
        "ClientId": "<app-client-id>",
        "Audience": "<optional audience override>",
        "RequiredClaim": {
          "groups": "bowire-users",
          "tenant_id": "acme"
        }
      }
    }
  }
}

Wire-up: the provider registers JWT-bearer authentication via Microsoft.Identity.Web.AddMicrosoftIdentityWebApi, which is the OIDC-compliant path for protecting an API (as opposed to a browser app). The workbench's HTML shell stays anonymous; the /api/* endpoints under Kuestenlogik.Bowire.BowireApiEndpoints are gated by the Default policy.

Phase-A scope: "lock the door" — every authenticated caller still sees the same ~/.bowire/. Per-user data separation is Phase B and depends on the IBowireUserStore seam landing first.

public sealed class OidcAuthProvider : IBowireAuthProvider

Inheritance

object

OidcAuthProvider

Implements

IBowireAuthProvider

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Constructors

OidcAuthProvider()

public OidcAuthProvider()

Properties

Id

Stable id used to select this provider on the CLI / in config (e.g. "oidc", "saml", "apikey"). Compared case-insensitively against --auth-provider <id>.

public string Id { get; }

Property Value

string

Name

Human-readable provider name shown in the workbench's "signed in via" surface and in startup logs. Examples: "OpenID Connect", "SAML 2.0".

public string Name { get; }

Property Value

string

Methods

AddAuthentication(IServiceCollection, IConfiguration)

Register the authentication scheme + any provider-specific services. Called once at startup, before builder.Build(). Implementations should read their configuration off configuration under Bowire:Auth:<Id> (e.g. Bowire:Auth:Oidc:Authority).

public void AddAuthentication(IServiceCollection services, IConfiguration configuration)

Parameters

services IServiceCollection

The host service collection.

configuration IConfiguration

Configuration root — providers should look at Bowire:Auth:<Id> for their own keys.

BuildDefaultPolicy(AuthorizationPolicyBuilder)

Configure the policy that BowireApiEndpoints enforces on every Bowire route. The default implementation requires authenticated user; providers can tighten it (e.g. require a specific claim, role, or audience).

public void BuildDefaultPolicy(AuthorizationPolicyBuilder policy)

Parameters

policy AuthorizationPolicyBuilder

Builder pre-seeded with RequireAuthenticatedUser(). Override or extend in concrete providers.