Generate and load signing rsa key

OAuthServer/Controllers/LoginController.cs

@@ -79,7 +79,7 @@ public class LoginController : ControllerBase
 
         if (result.Succeeded)
         {
-            return Redirect(returnUrl ?? "");
+            return Redirect(returnUrl ?? "/");
         }
 
         if (result.IsLockedOut)

OAuthServer/OAuthServer.csproj

@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
+<Project Sdk="Microsoft.NET.Sdk.Web">
 
     <PropertyGroup>
         <TargetFramework>net8.0</TargetFramework>
@@ -6,19 +6,20 @@
         <ImplicitUsings>enable</ImplicitUsings>
         <InvariantGlobalization>true</InvariantGlobalization>
         <DockerDefaultTargetOS>Linux</DockerDefaultTargetOS>
-    </PropertyGroup>
+      <UserSecretsId>01456bf0-f709-42b0-ad41-af6d7b94cab7</UserSecretsId>
+  </PropertyGroup>
 
     <ItemGroup>
         <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.2" />
         <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="8.0.2" />
-        <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="8.0.1"/>
+        <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="8.0.1" />
         <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.2" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.2">
           <PrivateAssets>all</PrivateAssets>
           <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
         <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.2" />
-        <PackageReference Include="Swashbuckle.AspNetCore" Version="6.4.0"/>
+        <PackageReference Include="Swashbuckle.AspNetCore" Version="6.4.0" />
     </ItemGroup>
 
     <ItemGroup>

OAuthServer/Program.cs

@@ -1,9 +1,10 @@
-using Microsoft.AspNetCore.Authentication.JwtBearer;
+using System.Security.Cryptography;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption;
 using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Tokens;
 using Microsoft.OpenApi.Models;
 using OAuthServer;
 
@@ -31,6 +32,20 @@ builder.Services.AddSwaggerGen(options =>
             Id = "Bearer"
         }
     });
+    options.AddSecurityRequirement(new OpenApiSecurityRequirement
+    {
+        {
+            new OpenApiSecurityScheme
+            {
+                Reference = new OpenApiReference
+                {
+                    Type = ReferenceType.SecurityScheme,
+                    Id = "Bearer"
+                }
+            },
+            new string[] { }
+        }
+    });
 });
 
 builder.Services.AddDbContext<AppDbContext>(options => { options.UseSqlite("DataSource=db.sqlite3"); });
@@ -39,24 +54,40 @@ builder.Services.AddIdentity<IdentityUser, IdentityRole>(options => { options.St
     .AddEntityFrameworkStores<AppDbContext>()
     .AddDefaultTokenProviders();
 
+// Load the signing key from a file if it exists or create a new one
+var rsaKey = RSA.Create();
+const string jwtKeyPath = ".aspnet/jwt-key";
+string home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+string fullPath = Path.Combine(home, jwtKeyPath);
+if (File.Exists(fullPath))
+{
+    rsaKey.ImportRSAPrivateKey(File.ReadAllBytes(fullPath), out _);
+}
+else
+{
+    string? dirName = Path.GetDirectoryName(fullPath);
+    if (!string.IsNullOrEmpty(dirName))
+        Directory.CreateDirectory(dirName);
+
+    var privateKey = rsaKey.ExportRSAPrivateKey();
+    File.WriteAllBytes(fullPath, privateKey);
+}
+
+// Add the JWT authentication method
 builder.Services.AddAuthentication().AddJwtBearer("OAuthToken", options =>
 {
-    // options.RequireHttpsMetadata = false;
-    // options.SaveToken = true;
-    // options.TokenValidationParameters = new TokenValidationParameters()
-    // {
-    //     ValidateIssuer = true,
-    //     ValidateAudience = true,
-    //     RequireSignedTokens = true,
-    //     ValidIssuer = builder.Configuration["Jwt:Issuer"],
-    //     ValidAudience = builder.Configuration["Jwt:Audience"],
-    //     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("JWT_KEY")))
-    // };
+    options.SaveToken = false;
+    options.TokenValidationParameters = new TokenValidationParameters()
+    {
+        ValidateIssuer = false,
+        ValidateAudience = false,
+        RequireSignedTokens = true,
+        IssuerSigningKey = new RsaSecurityKey(rsaKey)
+    };
 });
 
 builder.Services.Configure<IdentityOptions>(options =>
 {
-
     // SignIn settings.
     options.SignIn.RequireConfirmedAccount = false;
     options.SignIn.RequireConfirmedEmail = false;
@@ -116,7 +147,7 @@ builder.Services.AddAuthorization(options =>
     // Require the External role to authenticate with a different authentication method
     options.AddPolicy("External", policy => policy
         .RequireRole("External")
-        .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
+        .AddAuthenticationSchemes("OAuthToken")
     );
 });