API Secured with Auth0

Sample code showing how to test an API that has been secured using Auth0. Three types of tests are showcased:

.NET Core 3.1 based integration tests using the xUnit template. The tests are using test tokens procured from Auth0
.NET Core 3.1 based integration tests using fake JWT Bearer tokens
Jasmine and Node JS based outside-in tests using test tokens procured from Auth0

Note	This repository requires the use of .NET Core `3.1.100` or higher! Test with dotnet --version If your version is older or you don’t have .NET Core installed, then get it from here: https://dotnet.microsoft.com/download

Create an Account on Auth0

First you need an account on Auth0. You can create a free personal account here: https://auth0.com/signup.

The login or tenant name you select during signup will determine the Authority. It looks like the following:

https://<tenant>.auth0.com

or if you have selected EU as the data location it will be:

https://<tenant>.eu.auth0.com

Once logged in to Auth0:

Navigate to APIs
Click the button "+ CREATE API"
Enter the following data:
- Friendly name, e.g. Glossary API
- Identifier, e.g. https://glossary.acme.com
- Leave Signing Algorith at RS256
- Click the button CREATE

Once the API is created you’ll get a client_id and a client_secret for it. Navigate to the Test tab to find out the details.

Working with Developer Secrets

The API and integration tests work with developer secrets to avoid having secrets in code.

To define the secrets open a terminal and navigate to the api folder
Initialize the user secrets manager
```
$ dotnet user-secrets init
```

Add the 4 necessary secrets:

$ dotnet user-secrets set "auth0:url" "<url to token provider>"
$ dotnet user-secrets set "auth0:client_id" "<client-id>"
$ dotnet user-secrets set "auth0:client_secret" "<client-secret>"
$ dotnet user-secrets set "auth0:audience" "<audience>"

where

<url to token provider> equals something like https://<tenant>.auth0.com/oauth/token and
<audience> is the API Audience such as https://glossary.acme.com. It corresponds to the identifier you chose for the API during creation.

Getting a Token

To get a token from Auth0 use the following command:

curl --request POST \
  --url https://<tenant>.eu.auth0.com/oauth/token \
  --header 'content-type: application/json' \
  --data '{"client_id":"<client-id>","client_secret":"<client-secret>","audience":"<audience>","grant_type":"client_credentials"}'

Testing the API

To get a list of all glossary items use (endpoint not secured):
```
curl --insecure https://localhost:5001/api/glossary
```
To get a specific glossary item by its term use (endpoint not secured):
```
curl --insecure https://localhost:5001/api/glossary/<term>
```

To create a new glossary item use:

curl --insecure --request POST \
    --header 'content-type: application/json' \
    --header 'Authorization: Bearer <token>' \
    --data '<data>' \
    --url https://localhost:5001/api/glossary

Where <token> is the token requested in the previous section.

To update a specific glossary item use:

curl --insecure --request PUT \
    --header 'content-type: application/json' \
    --header 'Authorization: Bearer <token>' \
    --data '<data>' \
    --url https://localhost:5001/api/glossary

To delete a specific glossary item use:

curl --insecure --request DELETE \
    --header 'content-type: application/json' \
    --header 'Authorization: Bearer <token>' \
    --url https://localhost:5001/api/glossary/<term>

Running the XUnit Test

Before continuing make sure you have defined User Secrets as described above.

To run Xunit based tests that use User Secrets to configure access to Auth0, use the following command:
```
$ dotnet test tests
```

Running the XUnit Test with fake JWT Bearer tokens

To run Xunit based tests that use fake JWT Bearer tokens, use the following command:
```
$ dotnet test tests-with-fake-tokens
```

Running Outside-In Tests

Navigate to the solution folder
Make sure to create a file conf/conf.js according to the README.md in the conf folder

Run the tests with:

$ docker-compose -f docker-compose-test.yml up --build

Whenever you change code in the API it will restart automatically
Whenever you change code in the Jasmine based test suite all tests will rerun automatically

gnschenker/auth0-sample