Inquiry About Documentation, Claims, and Security

[projasWis]

Hello, I need assistance with the following points:

• User manual and updated documentation: Is there an available user manual and updated documentation for the software?

• Handling and mapping of claims: I need information on how to handle and map claims within scopes. In our integration with the software, standard claims (email, name, role, locale) are not appearing in the access token as expected after successful authentication. Could you provide guidance on this issue?

• Password storage: I've noticed that when creating a user and assigning a password, it is stored in plain text in the database without encryption or hashing. How can we configure password storage to ensure passwords are encrypted or hashed?

• Native ORACLE support: Does the software have native support for ORACLE?

• User interface navigability: Is it possible to configure navigation between the main panel and the user profile in the user interface?

I appreciate your attention and look forward to your response.

[simpleidserver]

User manual

You can follow the quick start tutorial (https://simpleidserver.com/docs/installation/quickstart) to install the SimpleIdServer solution in any environment.
You'll also find additional tutorials (https://simpleidserver.com/docs/tutorial/overview) that explain how to implement common security best practices, such as:

• Protecting REST APIs
• Protecting Windows services or console applications
• etc...

Mapping of Claims in Access Token

To include claims such as name in the access token, follow these steps:

• Navigate to the profile scope, and click on the Mappers tab.
• Click on the name property.
• Enable the option Include in access token and click on the save button.

The claim will then be present in the access token. :)

By default, claims present in the Identity Scope are not included in the access token.
You must set the Include in access token property to include them.

Password storage

There is a mistake in the AddCredential operation of the UserController.
Thank you for reporting this bug! It has been fixed in the master branch.

Changeset : bf3addd

Oracle support

It is possible to support the Oracle database by using the NuGet package "Oracle.EntityFrameworkCore".
I have created a temporary branch OracleSupport, where the IdServer solution uses this NuGet package, and the migration scripts are created (SimpleIdServer.IdServer.OracleMigrations).

Changeset : dc2f79c

User interface

I don't understand this last point. Can you please be more specific?

Kind regards,

SID

[projasWis]

Hi, I really appreciate your prompt response and the information provided.

Regarding the claims, I am selecting the option you mentioned, but they are still not arriving. Could it be an issue with the client configuration or the type? I used the Authorization code.

This image shows the claims that are arriving at my application.

I found that in this issue #249 (comment) you mention that the response_type should be id_token, but when I try to set this type for my client, I get the following error, which I don't know if it's a controlled error or if something is wrong.

Regarding the last point, I first wanted to know if there is a user profile screen where the logged-in user can view and edit their own data, and how to access that screen, because I don't see an option in the menu.

Once again, thank you very much

[simpleidserver]

Name is not returned in the access token

I configured the Postman client in our demo application to return the name claim in the access token.
I used Postman to obtain an access token with the following configuration, and the name claim was returned in the access token.

Can you check if your OAuth 2.0 client is correctly configured in SimpleIdServer and has access to the openid and profile scopes? These scopes must be included in the authorization request.

Request :

Access token (name = Firstname of the user)

Id_token is not supported

According to the OpenID specification, a traditional website hosted on a server must use the authorization code grant type.
Therefore, the response_type cannot be set to both code and id_token. Only Single Page Applications (SPAs), such as those built with Angular, can use the implicit flow.

Edit profile information

A user can edit their profile information by navigating to the following URL: https://localhost:5001/master

[projasWis]

Hello, I performed the same test by obtaining the token using Postman, and indeed the claims are present in it.
I will continue investigating why they are lost in my project.

Thank you very much.

[projasWis]

Sorry for insisting, but if the role and locale claims are not included in the token, you map them as User attributes because User property is not an option. How could I solve this case?

Thank you.

[simpleidserver]

Configure user role

To configure a user, follow the steps below:

1. Navigate to a client, and select the Roles tab.
2. Click on the Add client role button, and fill in the form with the following information:

Key	Value
Name	admin
Description	Administrator

3. Still within the client, click on the Scopes tab, and assign the role scope. Don't forget to add the role to the access token.
4. Under the User management section, click on the Groups.
5. Click on the Add group button, and fill in the form with the following information:

Key	Value
Name	admin
Description	Administrator

6. Navigate to the new group, click on the Roles tab, and assign the role <clientid>\admin.
7. Navigate to the user you want to assign to the group.
8. Click on the Grousp tab and assign the new group.
9. Finally, click on the Claims tab and check the Resolve roles checkbox. If the admin role is displayed in the list, the configuration is correct.

If everything is correctly configured, you can request the role in the access token.
The postman client has been configured in the Demo Application, and the role is returned in the access token.

Configure Additional claim

To create a scope, which can be used to return a custom claim such as picture in the access token, follow the steps below :

1. Navigate to the Scopes screen and click on the Add scope button.
2. Select Identity value and click on the next button.
3. Fill in the form with the following values and click on the Save button.

Key	Value
Name	custom
Description	custom
Protocol	OPENID

4. Navigate to the new scope, click on the Mappers tab, and click on the Add mapper button.
5. Select the Attribute option and click on the next button.
6. Fill in the form with the appropriate values:

Key	Value
Name	Unique name of the mapping rule
Token claim name	Name of the claim that will be added to the id_token and access_token
Claim JSON type	Type of the user claim
User attribute	Name of the user claim

The scope is now ready to be used by your client to return a custom claim.

[projasWis]

Thank you very much.