OpenID Connect with an External Provider

using System.Net.Http.Headers;
using System.Security.Claims;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    // The cookie stays the challenge scheme, so fetch calls to /bff/* get 401, not a 302 to the provider.
    .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.Name = "__Host-shop";
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.Cookie.SameSite = SameSiteMode.Lax; // Strict drops the cookie on the redirect back from the provider
        // Provider access tokens last minutes, not hours: before production, add an OnValidatePrincipal
        // step that checks expires_at and redeems the refresh_token, or rejects the principal.
        options.ExpireTimeSpan = TimeSpan.FromHours(8);
        options.SlidingExpiration = false;
    })
    .AddOpenIdConnect(options =>
    {
        options.Authority = builder.Configuration["Oidc:Authority"];
        options.ClientId = builder.Configuration["Oidc:ClientId"];
        options.ClientSecret = builder.Configuration["Oidc:ClientSecret"];
        options.ResponseType = OpenIdConnectResponseType.Code;
        options.UsePkce = true;
        options.SaveTokens = true;
        options.MapInboundClaims = false;
        options.GetClaimsFromUserInfoEndpoint = true;
        options.Scope.Add("offline_access");
        options.Scope.Add("orders.read");
        options.TokenValidationParameters.NameClaimType = "name";
        options.TokenValidationParameters.RoleClaimType = "role";
    });

builder.Services.AddAuthorization();
builder.Services.AddHttpClient("orders-api", client =>
    client.BaseAddress = new Uri(builder.Configuration["OrdersApi:BaseUrl"] ?? "https://orders.internal.example.com/"));

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

var bff = app.MapGroup("/bff").DisableCookieRedirect();

// The only place the provider is challenged; the SPA navigates here after a 401 from /bff/*.
bff.MapGet("/login", (string? returnUrl) =>
    TypedResults.Challenge(new AuthenticationProperties { RedirectUri = LocalPathOrRoot(returnUrl) },
        [OpenIdConnectDefaults.AuthenticationScheme]));

bff.MapPost("/logout", () =>
        TypedResults.SignOut(new AuthenticationProperties { RedirectUri = "/" },
            [CookieAuthenticationDefaults.AuthenticationScheme, OpenIdConnectDefaults.AuthenticationScheme]))
    .RequireAuthorization();

bff.MapGet("/user", (ClaimsPrincipal user) =>
        TypedResults.Ok(new { name = user.Identity?.Name, email = user.FindFirstValue("email") }))
    .RequireAuthorization();

// The SPA calls the BFF; the BFF calls the API with the user's access token.
bff.MapGet("/orders", async (HttpContext context, IHttpClientFactory clients, CancellationToken cancellationToken) =>
{
    var accessToken = await context.GetTokenAsync("access_token");
    if (accessToken is null) return Results.Unauthorized();

    var client = clients.CreateClient("orders-api");
    using var request = new HttpRequestMessage(HttpMethod.Get, "orders/mine");
    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
    using var response = await client.SendAsync(request, cancellationToken);
    return Results.Content(await response.Content.ReadAsStringAsync(cancellationToken), "application/json",
        statusCode: (int)response.StatusCode);
}).RequireAuthorization();

app.Run();

static string LocalPathOrRoot(string? returnUrl) =>
    returnUrl is { Length: > 0 } && returnUrl[0] == '/' && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\")
        ? returnUrl
        : "/";