Swashbuckle.aspnetcore: Is clientCredentials flow supported?

[markpritchett]

I'm trying to get clientCredentials flow working using one of the sample websites in this repo.

I've tried to modify Swashbuckle.AspNetCore/test/WebSites/OAuth2Integration/Startup.cs to use the clientCredentials flow type.

Given that OAuthClientId and OAuthClientSecret have been set in the Configure method, I hoped that I could alter the ConfigureServices to use the clientCredentials flow type and that would allow the Swagger UI to _automagically_ retrieve the authentication token.

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    // ...
    app.Map("/resource-server", resourceServer =>
    {
        // ... 
        resourceServer.UseSwaggerUI(c =>
        {
            c.SwaggerEndpoint("/resource-server/swagger/v1/swagger.json", "My API V1");

            // Additional OAuth settings (See https://github.com/swagger-api/swagger-ui/blob/v3.10.0/docs/usage/oauth2.md)
            c.OAuthClientId("test-id");
            c.OAuthClientSecret("test-secret");
            c.OAuthRealm("test-realm");
            c.OAuthAppName("test-app");
            c.OAuthScopeSeparator(" ");
            c.OAuthAdditionalQueryStringParams(new { foo = "bar" });
            c.OAuthUseBasicAuthenticationWithAccessCodeGrant();
        });
    });
}

I've tried changing part of the ConfigureServices method to this:

c.AddSecurityDefinition("Bearer", new ApiKeyScheme
{
    Description = "JWT Authorization header using the Bearer scheme. Example: \"Authorization: Bearer {token}\"",
    Name = "Authorization",
    In = "header",
    Type = "apiKey"
});

However, this just gives me a prompt for the bearer token, like so:

Looking at the Open API Specification - Security Scheme Object Example it has the following JWT Bearer Sample:

{
  "type": "http",
  "scheme": "bearer",
  "bearerFormat": "JWT",
}

I couldn't see any similar options in Swashbuckle to configure the security definition.

It would be great if you could confirm whether what I am asking for is supported and if it is, provide an example.

[VladislavAntonyuk]

The same issue. It worked in 1.2.0

[domaindrivendev]

Use the following to enable the oauth2 client credentials (aka application) flow:

c.AddSecurityDefinition("oauth2", new OAuth2Scheme
{
    Type = "oauth2",
    Flow = "application",
    TokenUrl = "/auth-server/connect/token",
    Scopes = new Dictionary<string, string>
    {
        { "readAccess", "Access read operations" },
        { "writeAccess", "Access write operations" }
    }
});

c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
{
    { "oauth2", new[] { "readAccess", "writeAccess" } }
});

[arlan85]

@domaindrivendev This don't work for me, after put client id and key on popup. It says below :
auth errorTypeError: NetworkError when attempting to fetch resource.
And did not do anything else. on network tab of firefox dev tools says OPTIONS request with response 200 but nothing else. How can we fix this?

[deinok]

@domaindrivendev Same here

[coder8keyboard]

same here. Any documentation for client_credentials flow?

[alexmartinezm]

Same here...

[VictorioBerra]

Guys his example works. Turns out it is Flow = "application" though I second the ask for documentation. Someone can always make a PR.

[cmreynol]

@VictorioBerra Anyone have an updated example of this using OpenApiSecurityScheme?

[ghost1face]

@cmreynol

@VictorioBerra Anyone have an updated example of this using OpenApiSecurityScheme?

I'm experimenting with this at the moment, will let you know how it goes:

options.AddSecurityDefinition("oauth2", new OpenApiSecurityScheme
{
    Type = SecuritySchemeType.OAuth2,
    Flows = new OpenApiOAuthFlows
    {
         ClientCredentials = new OpenApiOAuthFlow
         {
              TokenUrl = new Uri("/auth/token", UriKind.Relative)
         }
    }
});

[SimonKoegler]

@ghost1face any updates?

[ghost1face]

@ghost1face any updates?

That actually worked pretty well 👍

[jstallm]

Use the following to enable the oauth2 client credentials (aka application) flow:

c.AddSecurityDefinition("oauth2", new OAuth2Scheme
{
    Type = "oauth2",
    Flow = "application",
    TokenUrl = "/auth-server/connect/token",
    Scopes = new Dictionary<string, string>
    {
        { "readAccess", "Access read operations" },
        { "writeAccess", "Access write operations" }
    }
});

c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
{
    { "oauth2", new[] { "readAccess", "writeAccess" } }
});

Is this for ASP.NET Core or the full .net framework?

I'm getting that

The name OAuth2Scheme does not exist in the current context

[jstallm]

Guys his example works. Turns out it is Flow = "application" though I second the ask for documentation. Someone can always make a PR.

Did you validate this yourself using ASP.NET Core framework? If so, where is the class "OAuth2Scheme" defined? Did you define this yourself?