Namespace Kuestenlogik.Bowire.Auth.Oidc

Classes

OidcAuthProvider

OpenID Connect IBowireAuthProvider built on Microsoft.Identity.Web. Activated by --auth-provider oidc (or Bowire:Auth:ProviderId=oidc); reads its own settings under Bowire:Auth:Oidc:*:

{
  "Bowire": {
    "Auth": {
      "ProviderId": "oidc",
      "Oidc": {
        "Authority": "https://login.example.com/",
        "ClientId": "<app-client-id>",
        "Audience": "<optional audience override>",
        "RequiredClaim": {
          "groups": "bowire-users",
          "tenant_id": "acme"
        }
      }
    }
  }
}

Wire-up: the provider registers JWT-bearer authentication via Microsoft.Identity.Web.AddMicrosoftIdentityWebApi, which is the OIDC-compliant path for protecting an API (as opposed to a browser app). The workbench's HTML shell stays anonymous; the /api/* endpoints under Kuestenlogik.Bowire.BowireApiEndpoints are gated by the Default policy.

Phase-A scope: "lock the door" — every authenticated caller still sees the same ~/.bowire/. Per-user data separation is Phase B and depends on the IBowireUserStore seam landing first.