| | | 1 | | <# |
| | | 2 | | .SYNOPSIS |
| | | 3 | | Adds OAuth 2.0 (Authorization Code) authentication to the Kestrun server. |
| | | 4 | | .DESCRIPTION |
| | | 5 | | Configures the Kestrun server to use a generic OAuth 2.0 authorization-code flow. |
| | | 6 | | You can pass a prebuilt OAuthOptions object, or specify individual items (authority, paths, client, etc.). |
| | | 7 | | For OAuth2 metadata/OpenAPI support, set -OAuth2MetadataUrl or set OAuth2MetadataUrl on the provided OAuth2Options o |
| | | 8 | | To auto-resolve missing endpoints from metadata at startup, also set the ResolveEndpointsFromMetadata property on th |
| | | 9 | | Metadata discovery requires HTTPS by default. To explicitly allow HTTP metadata URLs in trusted non-production envir |
| | | 10 | | .PARAMETER Server |
| | | 11 | | The Kestrun server instance to configure. If not specified, the current server instance is used. |
| | | 12 | | .PARAMETER AuthenticationScheme |
| | | 13 | | The name of the OAuth authentication scheme (e.g., 'MyOAuth'). |
| | | 14 | | .PARAMETER DisplayName |
| | | 15 | | The display name for the authentication scheme (e.g., 'GitHub Login'). |
| | | 16 | | .PARAMETER Description |
| | | 17 | | A description of the OAuth authentication scheme. |
| | | 18 | | .PARAMETER Deprecated |
| | | 19 | | If specified, marks the authentication scheme as deprecated in OpenAPI documentation. |
| | | 20 | | .PARAMETER ClientId |
| | | 21 | | The OAuth client ID. |
| | | 22 | | .PARAMETER ClientSecret |
| | | 23 | | The OAuth client secret. |
| | | 24 | | .PARAMETER AuthorizationEndpoint |
| | | 25 | | The OAuth authorization endpoint URL. |
| | | 26 | | .PARAMETER TokenEndpoint |
| | | 27 | | The OAuth token endpoint URL. |
| | | 28 | | .PARAMETER OAuth2MetadataUrl |
| | | 29 | | Optional OAuth2 authorization server metadata URL (RFC 8414). |
| | | 30 | | Used for OpenAPI metadata and optional endpoint discovery. |
| | | 31 | | .PARAMETER CallbackPath |
| | | 32 | | The callback path for OAuth responses. |
| | | 33 | | .PARAMETER SaveTokens |
| | | 34 | | If specified, saves the OAuth tokens in the authentication properties. |
| | | 35 | | .PARAMETER UsePkce |
| | | 36 | | If specified, enables Proof Key for Code Exchange (PKCE) for enhanced security. |
| | | 37 | | .PARAMETER ClaimPolicy |
| | | 38 | | An optional Kestrun.Claims.ClaimPolicyConfig to apply claim policies during authentication. |
| | | 39 | | .PARAMETER Options |
| | | 40 | | An instance of Kestrun.Authentication.OAuth2Options containing the OAuth configuration. |
| | | 41 | | .PARAMETER PassThru |
| | | 42 | | If specified, returns the modified Kestrun server object. |
| | | 43 | | .EXAMPLE |
| | | 44 | | Add-KrOAuth2Authentication -AuthenticationScheme 'MyOAuth' -Options $oauthOptions |
| | | 45 | | Adds an OAuth2 authentication scheme named 'MyOAuth' using the provided options. |
| | | 46 | | .NOTES |
| | | 47 | | This is a convenience wrapper around the C# extension AddOAuth2Authentication. |
| | | 48 | | OAuth2MetadataUrl is OpenAPI metadata and is not passed directly to ASP.NET Core AddOAuth. |
| | | 49 | | #> |
| | | 50 | | function Add-KrOAuth2Authentication { |
| | | 51 | | [KestrunRuntimeApi('Definition')] |
| | | 52 | | [CmdletBinding()] |
| | | 53 | | [OutputType([Kestrun.Hosting.KestrunHost])] |
| | | 54 | | param( |
| | | 55 | | [Parameter(Mandatory = $false, ValueFromPipeline = $true)] |
| | | 56 | | [Kestrun.Hosting.KestrunHost]$Server, |
| | | 57 | | |
| | | 58 | | [Parameter(Mandatory = $false)] |
| | | 59 | | [string]$AuthenticationScheme = [Kestrun.Authentication.AuthenticationDefaults]::OAuth2SchemeName, |
| | | 60 | | |
| | | 61 | | [Parameter(Mandatory = $false)] |
| | | 62 | | [string]$DisplayName = [Kestrun.Authentication.AuthenticationDefaults]::OAuth2DisplayName, |
| | | 63 | | |
| | | 64 | | [Parameter(Mandatory = $false)] |
| | | 65 | | [string]$Description, |
| | | 66 | | |
| | | 67 | | [Parameter(Mandatory = $false)] |
| | | 68 | | [switch]$Deprecated, |
| | | 69 | | |
| | | 70 | | [Parameter(Mandatory = $false)] |
| | | 71 | | [string]$ClientId, |
| | | 72 | | |
| | | 73 | | [Parameter(Mandatory = $false)] |
| | | 74 | | [string]$ClientSecret, |
| | | 75 | | |
| | | 76 | | [Parameter(Mandatory = $false)] |
| | | 77 | | [string]$AuthorizationEndpoint, |
| | | 78 | | |
| | | 79 | | [Parameter(Mandatory = $false)] |
| | | 80 | | [string]$TokenEndpoint, |
| | | 81 | | |
| | | 82 | | [Parameter(Mandatory = $false)] |
| | | 83 | | [string]$OAuth2MetadataUrl, |
| | | 84 | | |
| | | 85 | | [Parameter(Mandatory = $false)] |
| | | 86 | | [string]$CallbackPath, |
| | | 87 | | |
| | | 88 | | [Parameter(Mandatory = $false)] |
| | | 89 | | [switch]$SaveTokens, |
| | | 90 | | |
| | | 91 | | [Parameter(Mandatory = $false)] |
| | | 92 | | [switch]$UsePkce, |
| | | 93 | | |
| | | 94 | | [Parameter(Mandatory = $false)] |
| | | 95 | | [Kestrun.Claims.ClaimPolicyConfig]$ClaimPolicy, |
| | | 96 | | |
| | | 97 | | [Parameter(Mandatory = $false)] |
| | | 98 | | [Kestrun.Authentication.OAuth2Options]$Options, |
| | | 99 | | |
| | | 100 | | [Parameter(Mandatory = $false)] |
| | | 101 | | [switch]$PassThru |
| | | 102 | | ) |
| | | 103 | | begin { |
| | | 104 | | # Ensure the server instance is resolved |
| | 0 | 105 | | $Server = Resolve-KestrunServer -Server $Server |
| | | 106 | | } |
| | | 107 | | process { |
| | 0 | 108 | | if ($null -eq $Options) { |
| | | 109 | | # Build options from individual parameters if not provided |
| | 0 | 110 | | $Options = [Kestrun.Authentication.OAuth2Options]::new() |
| | | 111 | | } |
| | | 112 | | |
| | 0 | 113 | | if ($ClientId) { $Options.ClientId = $ClientId } |
| | 0 | 114 | | if ($ClientSecret) { $Options.ClientSecret = $ClientSecret } |
| | 0 | 115 | | if ($AuthorizationEndpoint) { $Options.AuthorizationEndpoint = $AuthorizationEndpoint } |
| | 0 | 116 | | if ($TokenEndpoint) { $Options.TokenEndpoint = $TokenEndpoint } |
| | 0 | 117 | | if ($OAuth2MetadataUrl) { $Options.OAuth2MetadataUrl = $OAuth2MetadataUrl } |
| | 0 | 118 | | if ($CallbackPath) { $Options.CallbackPath = $CallbackPath } |
| | 0 | 119 | | if ($ClaimPolicy) { $Options.ClaimPolicy = $ClaimPolicy } |
| | 0 | 120 | | if ($Description) { $Options.Description = $Description } |
| | | 121 | | |
| | | 122 | | # Set the Deprecated option |
| | 0 | 123 | | $Options.Deprecated = $Deprecated.IsPresent |
| | | 124 | | |
| | | 125 | | # Set other switches |
| | 0 | 126 | | $Options.SaveTokens = $SaveTokens.IsPresent |
| | 0 | 127 | | $Options.UsePkce = $UsePkce.IsPresent |
| | | 128 | | |
| | | 129 | | # Bridge to your C# extension (parallel to AddCookieAuthentication) |
| | 0 | 130 | | [Kestrun.Hosting.KestrunHostAuthnExtensions]::AddOAuth2Authentication( |
| | 0 | 131 | | $Server, $AuthenticationScheme, $DisplayName, $Options) | Out-Null |
| | 0 | 132 | | if ($PassThru.IsPresent) { |
| | 0 | 133 | | return $Server |
| | | 134 | | } |
| | | 135 | | } |
| | | 136 | | } |