Authorize / api security

[DennyFiguerres]

i have a set of api items and i am trying to setup the requirements for callers to need to supply a token from azure ad.
seems like i have not been able to make that work and wonder if anyone have any examples for this?

[DennyFiguerres]

well as i do some testing i cant seem to get the restier controller to use the Authorize attribute and so that kills the use of this.....
i guess i will go back to the odatacontroller and make each one as it seems to be the only way that will work.

[robertmclaws]

This is an ASP.NET Core feature, not a Restier feature. You need to enable the ASP.NET Core pipeline to use Bearer tokens.

In the latest build of Restier we made this a little easier:

 services .AddRestier(
      options =>
      {
          options.EnableEndpointRouting = false;
          options.Filters.Add(new AuthorizeFilter(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build()));
      },

      builder =>
      {
          // This delegate is executed after OData is added to the container.
          // Add your Restier-specific services here.
          builder.AddRestierApi<SomeApi>(routeServices =>
          {
              ...
          });
      });

You need the EnableEndpointRouting set to false, since we don't support Endpoint Routing yet (it's under review).

The RequireAuthenticatedUser extension is custom code we built for our app, but you can do something similar to get your filter working.

Hope that helps!

[DennyFiguerres]

ahhh i think this might help...
the options bit goes to builder.Services.AddControllers(options => {
i had the endpointrouting but not the filter. i did not see that in the docs ....
will try this out.....

i wonder how many folks are activily trying to use OData with dot net core outside of microsoft......
seems like restier could be a great boost to using it if it got the right updates / care and exposure to the right folks....

[DennyFiguerres]

now i just have to deal with the swagger side of this..... i now get http 401 on the location but for swagger i had to use the metadata xml file to run thru a tool to make a json file for swagger.... now i need to update that .... have to work out some scripting to work that....
got to hit the end point with a token to get the updated metadata xml to build the new json.....

i wish i had a good idea on how to get this to work better with swagger......
i might check some options .... i have a project where i got nswag to work with some odata.... may check that out and see if i can get something to work....

[DennyFiguerres]

robert in case you have any ideas i want to give you some info on things i am trying to get working and if you have any good ideas please let me know.

so i was able to get the restier odata to require authorization ! great !
before that i was able to get Sawashbuckle to show the Odata via a ustity that can read the csdl / xml metadata
but when i tried to get it to work with the swagger ui getting a token that was failing with a cors preflight error and i was not able to find a way to solve that.

but i found that nswag has no problem with the azure ad / authorize and token so i thought ok it will use nswag!

BUT.... i have not found a way to get nswag to use a static json file as of yet!

if i can get nswag to take a file i upload then i have a working swagger for restier !

a dot net package can convert the xml to json:
https://github.com/Microsoft/OpenAPI.NET.OData

as a command line it works like this:

string csdl = System.IO.File.ReadAllText(@"C:\metadata.xml"); IEdmModel model = CsdlReader.Parse(XElement.Parse(csdl).CreateReader()); File.WriteAllText(@"C:\openapi3.json", model.ConvertToOpenApi().SerializeAsJson(OpenApiSpecVersion.OpenApi3_0));
that creates a json file that works.
there is also an npm that does the same thing from javascript.

this is klunky but i am now very close to a working swagger

nswag is here:
https://github.com/RicoSuter/NSwag

if i can just find out what to do to get it to read my json file in place of the runtime generator!

another thought is to find a way to get the metadata direct from resiter to send to the library and then to nswag.

i have been trying to find where in the nswag setup to just get it to take my file..... close but still no joy there.