Replace IdentityServer4 with OpenIddict and upgrade to .net 10 by juliangiebel · Pull Request #28 · space-wizards/SS14.Web

juliangiebel · 2025-09-01T19:45:34Z

!!!This PR was locally tested extensively. It should still be tested with different oauth clients used in production though. Esp. the wiki as it can potentially break those oauth clients/application. Ideally upgrading SS14.Web is tested on a separate instance created from a snapshot first!!!

This PR updates the project to .net 9 and replaces IdentityServer4 with OpenIddict while trying to ensure that existing OAuth applications keep working. For that purpose there is a data migration sql script under tools/identityserver4_to_openiddict_data_migration.sql.

Differences between IdentityServer4 and OpenIddict

The biggest difference between the two OIDC solutions is the way client/applications are stored and the amount of extra features and settings.
OpenIddict uses a lot less database entities to store applications as it stores most non queried settings and configurations as json inside the application entity. It also doesn't normalize entities to quite the extent IS4 does.

This means there wasn't a need for a separate schema.
Also a lot of settings that weren't used got removed from the UI as implementing them with OpenIddict would mean adding custom settings and implementing custom event handlers (Which this PR already does for settings that had to be re-implemented like "PlainPkce" and "Allow PS256")

Encryption and Signing keys have to be supplied as certificates using PFX files.

OpenIddict also uses a different hashing algorithm for secrets and it salts them so migrated keys from IS4 are marked as legacy and handled seperatly using a re-implementation of the the way secrets are hashed in IS4 (Which uses standard .net cryptography methods).

Additional changes

With the upgrade to .net 9 this PR also consolidates Program.cs and Startup.cs for SS14.Web/SS14.Web into a single top lever Program.cs file.
Some files use #nullable true.
Custom implementations for postgres type conversions/handlers weren't necessary anymore and got removed.

Noteworthy improvements

The /.well-known/openid-configuration now only lists actually supported capabilities and features
Access and authentication tokens are encrypted (Which might've also been already the case with IS4)
Requested scopes are now present in the ID token in addition to getting them the userinfo endpoint

Generating encryption and signing certificates

At least one encryption and one signing certificate needs to be generated and configured for each encryption/signing algorithm that needs to be supported.
For this purpose a csx file exists under tools\GenerateCerts.csx(I used the .net10 preview to execute it otherwise it needs a proper project file).
Executing that file will generate 3 certificates. One encryption certificate using RS265 and two signing certificates using RS265 and PS265 respectively.

Example certificate configuration

OpenId:
  Certificates:
    DefaultSigningAlgorithm: RS256
    EncryptionCertificates:
      - Path: 'C:\Users\julia\Projects\SS14.Web\cert\server-encryption-certificate.pfx'
    SigningCertificates:
      - Path: 'C:\Users\julia\Projects\SS14.Web\cert\server-signing-certificate-rsa-pss.pfx'
        Algorithm: PS256
      - Path: 'C:\Users\julia\Projects\SS14.Web\cert\server-signing-certificate-rsa.pfx'

Fixes #20
Fixes #17

Upgrade nuget packages Fix npgsql errors from upgrade Note: (IpAddress, int) is now NpgsqlCidr

Migrate to nullable

This reverts commit 7b0520a.

…hm is used

Implement unit tests for multiple secret handling methods

Implement custom url validator

Work on admin oauth app settings page

Implement legacy token handling test

Fix token lifetime settings

SaphireLattice · 2025-11-22T16:05:05Z

+
+var certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(10));
+
+File.WriteAllBytes("server-encryption-certificate.pfx", certificate.Export(X509ContentType.Pfx, string.Empty));


Might want to add a check if any of these files exist and throw hard, so we don't accidentally the certs.

Considering this tool will be ran once I doubt it's really an issue. I guess it's quick though fo code just in case.

VasilisThePikachu · 2025-11-23T15:27:35Z

Lowercase SQL is a crime

VasilisThePikachu

Ok well one thing you SHOULD actually do it update the dotnet version for the test so it wont fail

Also i guess look into net 10 support now, OpenIddict does support it

This reverts commit 9fd9eec.

This is necessary to keep the endpoint path that's been used previously while having the authorize logic inside the consent page. That avoids having to haul around the auth request data between redirects (which would be annoying to implement at this point)

Fildrance

Overall it works! Looks slim, which is nice. Almost all of my comments are kinda nitpicks and are dismissable, bragging about inconsistencies in codestyle (which is funny, considering we review stuff with razor pages, kek). I tried my best not to devolve into poking questionable linebreaks :>

Tested it with local calls, with OAuthTest, analyzed OAuthTest and it seems to be statifying all in all.

I do, however, propose some more additions before we release it:

adding settings for blocking user/'oauth client' creation and updates (with some setting-provided message) - so we could bascially make database read-only and not have any data-loss in case of backup if something goes poorly during release
remove tables deletion from migrations so old stuff would still work fine if we just revert app
prepare migration up for migrating down
hook migration script into c# migration class :>

Fildrance · 2026-06-29T16:46:47Z

 using Microsoft.Extensions.Logging;
+using OpenIddict.Core;
 using SS14.Auth.Shared.Data;
+using SS14.Web.Extensions;


unused using

Fildrance · 2026-06-29T16:53:20Z

+            Scopes: x.Scopes
+            ));

-        StringToFile(zip, "UserOAuthClients.json", data);


now it is unused but it is good method to have i think, so let it be?

Fildrance · 2026-06-29T16:57:35Z

+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserManager<SpaceUser> _userManager;
+    private readonly SignInManager<SpaceUser> _signInManager;


unused field

Fildrance · 2026-06-29T17:07:22Z

+        if (_httpContextAccessor.HttpContext is not { } context)
+            return null;
+
+        var user = await _userManager.GetUserAsync(context.User);


Its a little bit sad that we have to do 2 calls for storage - GetUserAsync and GetUserIdAsync, but yeah, i don't see any nicer way... sadge

Fildrance · 2026-06-29T17:10:55Z

+    /// <summary>
+    /// Provides claims for the specified identity.
+    /// </summary>
+    /// <param name="userId"></param>


don't leave them empty :godo:

Fildrance · 2026-07-01T19:37:38Z

+
+public class TestMultipleClientSecretHandling
+{
+    [TestCase( "0.1755342104.key1111.desc", 0, ExpectedResult = 0)]


odd whitespaces at start of test case and unused usings

Fildrance · 2026-07-01T19:47:29Z

+
+certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(10));
+
+File.WriteAllBytes("server-signing-certificate-rsa-pss.pfx", certificate.Export(X509ContentType.Pfx, string.Empty));


I would say it would be nice to have something added in readme.md - what it does (what for certs should be used with openiddict in current scheme), when to use it.

Fildrance · 2026-07-01T19:59:04Z

+       (select "SpaceUserId" from public."UserOAuthClients" uc where c."Id" = uc."ClientId"),
+       "LogoUri", null as ApplicationType, c."ClientId",
+       (select string_agg(array_to_string(array [
+                                              cs."Id"::text,
+                                          floor(extract(epoch from cs."Created"))::text,
+                                          '_OLD_' || cs."Value",
+                                          replace(cs."Description", '*', '')
+                                              ], '.'), ',') from "IS4"."ClientSecrets" cs where cs."ClientId" = c."Id") ClientSecret,
+       'confidential' as ClientType, gen_random_uuid() as ConcurrencyToken,
+       case when "RequireConsent" then 'Explicit' else 'Implicit' end as "ConsentType",
+       "ClientName" as DisplayName, null as DisplayNames, null as JsonWebKeySet,
+       '["ept:authorization","ept:token","ept:introspection","ept:end_session","gt:refresh_token","gt:authorization_code","rst:code","scp:email","scp:profile","scp:roles"]'
+           as Permissions,
+       null as PostLogoutRedirectUris,
+       null as Properties,
+       (select json_agg("RedirectUri") from "IS4"."ClientRedirectUris" cr where cr."ClientId" = c."Id")::text "RedirectUris",
+    case when "RequirePkce" then '["ft:pkce"]' end as "Requirements",
+       json_build_object(
+           'space:AllowPlainPkce', "AllowPlainTextPkce"::TEXT,
+           'space:SigningAlgorithm', "AllowedIdentityTokenSigningAlgorithms",
+           'space:Disabled', ("Enabled" = false)::TEXT
+       )::text as "Settings",
+    "ClientUri" as WebsiteUrl


Suggested change

(select "SpaceUserId" from public."UserOAuthClients" uc where c."Id" = uc."ClientId"),

"LogoUri", null as ApplicationType, c."ClientId",

(select string_agg(array_to_string(array [

cs."Id"::text,

floor(extract(epoch from cs."Created"))::text,

'_OLD_' || cs."Value",

replace(cs."Description", '*', '')

], '.'), ',') from "IS4"."ClientSecrets" cs where cs."ClientId" = c."Id") ClientSecret,

'confidential' as ClientType, gen_random_uuid() as ConcurrencyToken,

case when "RequireConsent" then 'Explicit' else 'Implicit' end as "ConsentType",

"ClientName" as DisplayName, null as DisplayNames, null as JsonWebKeySet,

'["ept:authorization","ept:token","ept:introspection","ept:end_session","gt:refresh_token","gt:authorization_code","rst:code","scp:email","scp:profile","scp:roles"]'

as Permissions,

null as PostLogoutRedirectUris,

null as Properties,

(select json_agg("RedirectUri") from "IS4"."ClientRedirectUris" cr where cr."ClientId" = c."Id")::text "RedirectUris",

case when "RequirePkce" then '["ft:pkce"]' end as "Requirements",

json_build_object(

'space:AllowPlainPkce', "AllowPlainTextPkce"::TEXT,

'space:SigningAlgorithm', "AllowedIdentityTokenSigningAlgorithms",

'space:Disabled', ("Enabled" = false)::TEXT

)::text as "Settings",

"ClientUri" as WebsiteUrl

(select "SpaceUserId" from public."UserOAuthClients" uc where c."Id" = uc."ClientId"),

"LogoUri",

null as ApplicationType,

c."ClientId",

(select string_agg(array_to_string(array [

cs."Id"::text,

floor(extract(epoch from cs."Created"))::text,

'_OLD_' || cs."Value",

replace(cs."Description", '*', '')

], '.'), ',') from "IS4"."ClientSecrets" cs where cs."ClientId" = c."Id") ClientSecret,

'confidential' as ClientType,

gen_random_uuid() as ConcurrencyToken,

case when "RequireConsent" then 'Explicit' else 'Implicit' end as "ConsentType",

"ClientName" as DisplayName,

null as DisplayNames,

null as JsonWebKeySet,

'["ept:authorization","ept:token","ept:introspection","ept:end_session","gt:refresh_token","gt:authorization_code","rst:code","scp:email","scp:profile","scp:roles"]'

as Permissions,

null as PostLogoutRedirectUris,

null as Properties,

(select json_agg("RedirectUri") from "IS4"."ClientRedirectUris" cr where cr."ClientId" = c."Id")::text "RedirectUris",

case when "RequirePkce" then '["ft:pkce"]' end as "Requirements",

json_build_object(

'space:AllowPlainPkce', "AllowPlainTextPkce"::TEXT,

'space:SigningAlgorithm', "AllowedIdentityTokenSigningAlgorithms",

'space:Disabled', ("Enabled" = false)::TEXT

)::text as "Settings",

"ClientUri" as WebsiteUrl

fix indent and line breaks (1 field max per line)

Fildrance · 2026-07-01T20:01:41Z

 */appsettings.Secret.yml
-*/tempkey.jwk
+*/tempkey.jwk
+cert


By default they are generated in tools folder, so i would propose ignoring them there and pathing them there :|

Fildrance · 2026-07-01T20:25:34Z

@@ -0,0 +1,26 @@
+insert into public."OpenIddictApplications"
+select gen_random_uuid() as Id,
+       (select "SpaceUserId" from public."UserOAuthClients" uc where c."Id" = uc."ClientId"),


have we not deleted UserOAuthClients in AddSpaceAppHomePageProperty migration?

juliangiebel added 30 commits August 10, 2025 22:12

Remove IdentityServer4 packages

f6a3aa9

Comment out IdentityServer4 code

555ded6

Upgrade to .net9

bc2cd24

Upgrade nuget packages Fix npgsql errors from upgrade Note: (IpAddress, int) is now NpgsqlCidr

Refactor SS14.Web startup to program.cs

1539281

Work on adding OpenIddict to program.cs

e9eddaa

Implement OpenIddict configuration

0167585

Implement custom application entity

7b0520a

Migrate to nullable

Revert "migrate to nullable"

20a01ad

This reverts commit 7b0520a.

Add list of ef core commands to readme

848c7df

A

a046867

Fix wrong get openiddict request method call

34f9134

Finish implementing the oidc authorization/consent endpoint

5886192

Clean up Consent.cshtml and codebehind

ed44b1b

Remove IS4 code from ApplicationDbContext

6960459

Remove UserOauthClient

20873e6

Change PersonalDataCollector to collecto from OpenIddict

88995d3

Implement generate token event handler for ensuring the right algorit…

ad63ba5

…hm is used

Add home page url property to SpaceApplication

50d2919

Work on oauth application manage page

6baccda

Implement multiple client secret support

2226e2d

Make a migration

96ebfc9

Implement methods for working with multiple secrets

952ec46

Implement unit tests for multiple secret handling methods

Re-Implement developer and oauth manage page

49d3d26

Re-Implement oauth application create page

df74a59

Re-Implement confirm delete page

7effe54

Implement custom url validator

Implement identityserver4 legacy SHA256 client secret validation

435ea91

Re-Implement oauth client admin index and delete pages

fd67c7e

Implement plain pkce option

8975aa9

Work on admin oauth app settings page

Re-Implement oauth client admin edit page

4710fd5

Add quartz for openiddict pruning

cefe399

Implement legacy token handling test

juliangiebel added 5 commits August 30, 2025 20:37

Work on IdentityServer4Migration

01309dd

Improve certificate configuration

2e7440d

Fix token lifetime settings

Remove test data seeder

9fd9eec

Add data migration sql to tools

191384c

Address leftover todos and comments

cb12e03

PJB3005 added the A: SS14.Web label Sep 1, 2025

SaphireLattice reviewed Nov 22, 2025

View reviewed changes

VasilisThePikachu approved these changes Nov 23, 2025

View reviewed changes

VasilisThePikachu suggested changes Nov 26, 2025

View reviewed changes

juliangiebel added 4 commits January 17, 2026 17:13

Revert "Remove test data seeder"

d327ff7

This reverts commit 9fd9eec.

Update to .net10

2f3b2b8

Update dependencies

e526805

Set openiddict logging to warning outside of development

b015ccc

juliangiebel changed the title ~~Replace IdentityServer4 with OpenIddict and upgrade to .net 9~~ Replace IdentityServer4 with OpenIddict and upgrade to .net 10 Mar 2, 2026

juliangiebel added 4 commits March 2, 2026 21:22

Add configuration setting for enabling test data seeding

0d4b82c

Remove unimplemented and unused methods

ca94bd0

Add documentation comments for OpenIdActionService

75dc50d

Fildrance suggested changes Jul 2, 2026

View reviewed changes


		var certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(10));

		File.WriteAllBytes("server-encryption-certificate.pfx", certificate.Export(X509ContentType.Pfx, string.Empty));


		certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddYears(10));

		File.WriteAllBytes("server-signing-certificate-rsa-pss.pfx", certificate.Export(X509ContentType.Pfx, string.Empty));

Uh oh!

Conversation

juliangiebel commented Sep 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Differences between IdentityServer4 and OpenIddict

Additional changes

Noteworthy improvements

Generating encryption and signing certificates

Example certificate configuration

Uh oh!

Choose a reason for hiding this comment

Uh oh!

VasilisThePikachu Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

VasilisThePikachu left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Fildrance left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

juliangiebel commented Sep 1, 2025 •

edited

Loading

VasilisThePikachu Nov 22, 2025 •

edited

Loading

VasilisThePikachu left a comment •

edited

Loading