feat: add configurable SSL for auth server

Author: jeastham1993

docker-compose.yml

@@ -165,6 +165,7 @@ services:
       ASPNETCORE_ENVIRONMENT: Development
       DRIVING: AGNOSTIC
       DRIVEN: AGNOSTIC
+      DISABLE_SSL: "true"
       ConnectionStrings__messaging: "redpanda:9092"
       ConnectionStrings__database: "Host=user-management-db;Port=5432;Database=user_management;Username=user_mgmt_user;Password=user_mgmt_password"
       KAFKA__BOOTSTRAPSERVERS: "redpanda:9092"

user-management/src/Stickerlandia.UserManagement.Agnostic/ServiceExtensions.cs

@@ -35,23 +35,23 @@ public static IServiceCollection AddKafkaMessaging(this IServiceCollection servi
             BootstrapServers = configuration.GetConnectionString("messaging"),
             // Fixed properties
             SecurityProtocol = SecurityProtocol.Plaintext,
-            Acks             = Acks.All
+            Acks = Acks.All
         };
-        
+
         var consumerConfig = new ConsumerConfig
         {
             // User-specific properties that you must set
             BootstrapServers = configuration.GetConnectionString("messaging"),
             // Fixed properties
             SecurityProtocol = SecurityProtocol.Plaintext,
-            GroupId          = "stickerlandia-users",
-            AutoOffsetReset  = AutoOffsetReset.Earliest,
-            EnableAutoCommit = false,
+            GroupId = "stickerlandia-users",
+            AutoOffsetReset = AutoOffsetReset.Earliest,
+            EnableAutoCommit = false
         };
-        
+
         services.AddSingleton(producerConfig);
         services.AddSingleton(consumerConfig);
-        
+
         // Register event publisher as singleton
         services.AddSingleton<IUserEventPublisher, KafkaEventPublisher>();
         services.AddSingleton<IMessagingWorker, KafakStickerClaimedWorker>();
@@ -64,24 +64,28 @@ public static IServiceCollection AddPostgresAuthServices(this IServiceCollection
     {
         services.AddDbContext<UserManagementDbContext>(options =>
         {
-            options.UseNpgsql(configuration.GetConnectionString("database"), 
+            options.UseNpgsql(configuration.GetConnectionString("database"),
                 npgsqlOptions => npgsqlOptions.MigrationsAssembly("Stickerlandia.UserManagement.Agnostic"));
             options.UseOpenIddict();
         });
-        
+
         services.AddIdentityCore<PostgresUserAccount>()
             .AddEntityFrameworkStores<UserManagementDbContext>()
             .AddDefaultTokenProviders();
 
+        var enableSsl = true;
+
+        if (configuration.GetValue<bool>("DISABLE_SSL")) enableSsl = false;
+
         services.AddCoreAuthentication(options =>
             options.UseEntityFrameworkCore()
-                .UseDbContext<UserManagementDbContext>());
-        
+                .UseDbContext<UserManagementDbContext>(), enableSsl);
+
         services.AddScoped<IAuthService, MicrosoftIdentityAuthService>();
-        
+
         services.AddScoped<IUsers, PostgresUserRepository>();
         services.AddScoped<IOutbox, PostgresUserRepository>();
 
         return services;
     }
-}
+}

user-management/src/Stickerlandia.UserManagement.Auth/AuthServiceExtensions.cs

@@ -14,7 +14,8 @@ namespace Stickerlandia.UserManagement.Auth;
 
 public static class AuthServiceExtensions
 {
-    public static IServiceCollection AddCoreAuthentication(this IServiceCollection services, Action<OpenIddictCoreBuilder> configuration)
+    public static IServiceCollection AddCoreAuthentication(this IServiceCollection services,
+        Action<OpenIddictCoreBuilder> configuration, bool enableSsl)
     {
         services.AddOpenIddict()
             .AddCore(configuration)
@@ -34,7 +35,7 @@ public static IServiceCollection AddCoreAuthentication(this IServiceCollection s
                     .AllowImplicitFlow()
                     .AllowHybridFlow()
                     .AllowRefreshTokenFlow();
-                
+
                 // Expose all the supported claims in the discovery document.
                 options.RegisterClaims("email", "issuer", "preferred_username", "profile", "updated_at");
 
@@ -46,28 +47,36 @@ public static IServiceCollection AddCoreAuthentication(this IServiceCollection s
                     .AddEphemeralSigningKey();
 
                 // Register the ASP.NET Core host and configure the ASP.NET Core options.
-                options.UseAspNetCore()
-                    .EnableTokenEndpointPassthrough();
-                
-                options.AddEventHandler<OpenIddictServerEvents.HandleUserInfoRequestContext>(options => options.UseInlineHandler(context =>
-                {
-                    if (context.Principal.HasScope(OpenIddictConstants.Permissions.Scopes.Profile))
-                    {
-                        context.Profile = context.Principal.GetClaim(OpenIddictConstants.Claims.Profile);
-                        context.PreferredUsername = context.Principal.GetClaim(OpenIddictConstants.Claims.PreferredUsername);
-                        context.Claims[OpenIddictConstants.Claims.UpdatedAt] = long.Parse(
-                            context.Principal.GetClaim(OpenIddictConstants.Claims.UpdatedAt)!,
-                            NumberStyles.Number, CultureInfo.InvariantCulture);
-                    }
-
-                    if (context.Principal.HasScope(OpenIddictConstants.Scopes.Email))
+                if (enableSsl)
+                    options.UseAspNetCore()
+                        .EnableTokenEndpointPassthrough();
+                else
+                    options.UseAspNetCore()
+                        .DisableTransportSecurityRequirement()
+                        .EnableTokenEndpointPassthrough();
+
+
+                options.AddEventHandler<OpenIddictServerEvents.HandleUserInfoRequestContext>(options =>
+                    options.UseInlineHandler(context =>
                     {
-                        context.Email = context.Principal.GetClaim(OpenIddictConstants.Claims.Email);
-                        context.EmailVerified = false;
-                    }
+                        if (context.Principal.HasScope(OpenIddictConstants.Permissions.Scopes.Profile))
+                        {
+                            context.Profile = context.Principal.GetClaim(OpenIddictConstants.Claims.Profile);
+                            context.PreferredUsername =
+                                context.Principal.GetClaim(OpenIddictConstants.Claims.PreferredUsername);
+                            context.Claims[OpenIddictConstants.Claims.UpdatedAt] = long.Parse(
+                                context.Principal.GetClaim(OpenIddictConstants.Claims.UpdatedAt)!,
+                                NumberStyles.Number, CultureInfo.InvariantCulture);
+                        }
 
-                    return default;
-                }));
+                        if (context.Principal.HasScope(OpenIddictConstants.Scopes.Email))
+                        {
+                            context.Email = context.Principal.GetClaim(OpenIddictConstants.Claims.Email);
+                            context.EmailVerified = false;
+                        }
+
+                        return default;
+                    }));
             })
             .AddValidation(options =>
             {
@@ -81,12 +90,12 @@ public static IServiceCollection AddCoreAuthentication(this IServiceCollection s
                 // to reject access tokens retrieved from a revoked authorization code.
                 options.EnableAuthorizationEntryValidation();
             });
-        
+
         services.AddAuthentication(options =>
         {
             options.DefaultScheme = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
         });
-        
+
         return services;
     }
 }