/OcelotIdentityServerAzureAdWithApi

Demo for a scenario where API is accessed through Ocelot gateway and Ocelot uses IdentityServer and Azure Ad for authentication

Primary LanguageC#

Ocelot & IdentityServer & AzureAD

Demo for a scenario where the following tools are used:

  • Ocelot Gateway (Gateway.sln)
  • Microservices behind the Ocelot Gateway (Microservices.sln)
  • Website in front of the Ocelot Gateway (MvcTestSite.sln)
  • IdentityServer (IdentityServer.sln)
  • Azure AD

Requires .NET Core SDK 3.1.100.

The following services are behind the Ocelot:

  • Microservice1
  • Microservice2
  • SuperMicroservice
  • IdentityServer

MvcTestsite sits in front of the Gateway.

Architecture diagram

Permissions

By default the following permissions are applied:

  • Microservice1 can call Microservice2 but not SuperMicroservice.
  • Microservice2 can call Microservice1 but not SuperMicroservice.
  • SuperMicroservice can call Microservice1 and Microservice2.
  • MvcTestSite's client can call Microservice1 and Microservice2 but not SuperMicroservice.
  • MvcTestSite's Azure AD signed user can call Microservice1, Microservice2 and SuperMicroservice.

Testing

Use MvcTestSite to test microservices calling each other. The same site can be used to test Azure Ad sign-in and the calling of a microservice through the gateway.

Run the solutions in the following order:

  1. Microservices (should start Microservice1, Microservice2 and SuperMicroservice in the following ports: 44392, 44393, 44394)
  2. Gateway (https://localhost:44334/)
  3. IdentityServer (http://localhost:5000/)
  4. MvcTestSite (https://localhost:44322/)

Use "Privacy"-page to sign-in with Azure AD and to call the SuperMicroservice.

Azure Ad configuration

Create a new Azure AD app registration:

Copy the Azure Ad application settings to IdentityServer/Startup.cs.