nuages-io / nuages-identity-2

ASP.NET Core Identity UI
https://nuages.io
Apache License 2.0
65 stars 5 forks source link
asp-net-core aws fido2 identity openiddict

Nuages Identity

What is Nuages Identity

Nuages Identity is an ASP.NET Core 7 application implementing ASP.NET Identity. The main goal is to provide a production-ready solution, not just a startup sample project.

What is included?

Database storage

Support is provided for the following Database engine.

Gettings Started

By default, the application will run with the following settings

Those settings can be changed using standard configuration mechanism.

Run locally

From root directory,

cd src/Nuages.Identity.UI
dotnet run

Application will be available at https://localhost:8001

Run locally with Docker

From the root directory,

docker build -t nuages.identity.ui .
docker run -it --rm -p 8003:80 --env-file ./env.list --name nuage-identity nuages.identity.ui

Application will be available at http://localhost:8003 (no HTTPS)

Note: env.list must include environment variables required to run the app (see Configuration below)

Deployment

The application can be deployed using standard ASP.NET Core mechanism.

The sample site https://identity.nuages.org is deployed on AWS with ECS using the following CDK project.

https://github.com/nuages-io/nuages-deploy-ecs-cdk

Configuration

Configuration is done using the standard Configuration system. You may want to use one of the following ways to customize the application.

Data storage options

{
  "Nuages": {
    "Data": {
      "Storage": "InMemory",
      "ConnectionString": "",
      "Redis": ""
    }
  }
}

IMPORTANT! Initial database migration is required for SqlServer and MySql.

{
    "ConnectionString" : "server=localhost;user=yourUser;password=yourPassword;database=identity"
}
 dotnet ef database update

Identity options

{
  "Nuages": {
    "Identity": {
      "Name": "Nuages",
      "Authority": "https://localhost:8001",
      "SupportsAutoPasswordExpiration": true,
      "AutoExpirePasswordDelayInDays": 60,
      "SupportsLoginWithEmail": true,
      "AutoConfirmExternalLogin": true,
      "EnablePasswordHistory": "true",
      "PasswordHistoryCount": 5,
      "Audiences": [
        "IdentityAPI"
      ],
      "Password": {
        "RequiredLength": 6,
        "RequireNonAlphanumeric": true,
        "RequireLowercase": true,
        "RequireUppercase": true,
        "RequireDigit": true,
        "RequiredUniqueChars": 1
      }
    }
  }
}

UI Options

{
  "Nuages": {
    "UI": {
      "AllowSelfRegistration": true,
      "ExternalLoginAutoEnrollIfEmailExists": true,
      "ExternalLoginPersistent": true,
      "EnableMagicLink": true,
      "EnablePhoneFallback": true,
      "Enable2FARememberDevice": true,
      "EnableFido2": true,
      "FontAwesomeUrl": "https://kit.fontawesome.com/70b74b4315.js"
    }
  }
}

Localization options

{
  "Nuages": {
    "Localization": {
      "DefaultCulture": "fr-CA",
      "LangClaim": "lang",
      "Cultures": [
        "fr-CA",
        "en-CA"
      ]
    }
  }
}

See https://github.com/nuages-io/nuages-localization for more localization information

OpenIdDict options

{
  "Nuages": {
    "OpenIdDict": {
      "EncryptionKey": "",
      "SigningKey": "",
      "CreateDemoClients": true
    }
  }
}

Google Racaptcha

{
  "Nuages": {
    "Web": {
      "GoogleRecaptcha": {
        "SiteKey": "",
        "SecretKey": ""
      }
    }
  }
}

OAuth Provider

{
  "Nuages": {
    "OpenIdProviders": {
      "Google": {
        "ClientId": "",
        "ClientSecret": ""
      },
      "Microsoft": {
        "ClientId": "",
        "ClientSecret": ""
      },
      "Facebook": {
        "AppId": "",
        "AppSecret": ""
      },
      "GitHub": {
        "ClientId": "",
        "ClientSecret": ""
      }
    }
  }
}

Configuration with AWS

EventBridge Options

{
  "Nuages":
  {
   "EventBus" :
      {
        "Source" : null,
        "Name" : null
      }
  }
}

SES Options

{
  "Nuages":
  {
    "MessageService": {
      "SendFromEmail": "youremail@yourdomain.com",
      "DefaultCulture": "en"
    }
  }
}

AWS System Manager options

{
  "Nuages": {
    "ApplicationConfig": {
      "ParameterStore": {
        "Enabled": false,
        "Path": "/NuagesIdentity"
      },
      "AppConfig": {
        "Enabled": false,
        "ApplicationId": "NuagesIdentity",
        "EnvironmentId": "Prod",
        "ConfigProfileId": "WebUI"
      }
    }
  }
}

Application settings can be set using System Manager ParameterStore and AppConfig.

Set Enable to true to activate.

More info here https://github.com/aws/aws-dotnet-extensions-configuration

Using AWS SecretManager

You can use a secret instead of a string value for any configuration value.

Ex. Let's says you want to hide the database connection string

So instead of

{
  "Nuages": {
    "Data": {
      "ConnectionString": "my connection string value"
    }
  }
}

You can swap the value for a secret ARN (the ARN can be found in your AWS account)

{
  "Nuages": {
    "Data": {
      "ConnectionString": "arn:aws:secretsmanager:{region}:{account_id}:secret:identity/mongo-ABC123"
    }
  }
}

Only string values are supported.


Restrictions

Some restrictions apply compare to the default ASP.NET identity implementation.

  1. A phone number cannot be used as the primary 2FA method. It can only be used as a fallback mechanism.
  2. It is not possible to require a verified phone number to login
  3. User's email cannot be different from the username if the username is an email.
  4. Email must be unique system wide

Dependencies

Dependencies when UseAWS flag is true