| | | 1 | | <# |
| | | 2 | | .SYNOPSIS |
| | | 3 | | Adds OpenID Connect (Authorization Code) authentication to the Kestrun server. |
| | | 4 | | .DESCRIPTION |
| | | 5 | | Convenience wrapper around the C# extension AddOpenIdConnectAuthentication. Registers three schemes: |
| | | 6 | | <Name>, <Name>.Cookies, <Name>.Policy |
| | | 7 | | Enables PKCE and token persistence by default; supports custom scopes and callback path. |
| | | 8 | | .PARAMETER Server |
| | | 9 | | The Kestrun server instance. If omitted, uses the current active server. |
| | | 10 | | .PARAMETER AuthenticationScheme |
| | | 11 | | Base scheme name (default 'Oidc'). |
| | | 12 | | .PARAMETER DisplayName |
| | | 13 | | The display name for the authentication scheme (default is the OpenID Connect default display name). |
| | | 14 | | .PARAMETER Description |
| | | 15 | | A description of the OpenID Connect authentication scheme. |
| | | 16 | | .PARAMETER Deprecated |
| | | 17 | | If specified, marks the authentication scheme as deprecated in OpenAPI documentation. |
| | | 18 | | .PARAMETER Authority |
| | | 19 | | The OpenID Connect authority URL. |
| | | 20 | | .PARAMETER ClientId |
| | | 21 | | The OpenID Connect client ID. |
| | | 22 | | .PARAMETER ClientSecret |
| | | 23 | | The OpenID Connect client secret. |
| | | 24 | | .PARAMETER AuthorizationEndpoint |
| | | 25 | | The OpenID Connect authorization endpoint URL. |
| | | 26 | | .PARAMETER TokenEndpoint |
| | | 27 | | The OpenID Connect token endpoint URL. |
| | | 28 | | .PARAMETER ResponseType |
| | | 29 | | The OpenID Connect response type (default is 'Code'). |
| | | 30 | | .PARAMETER CallbackPath |
| | | 31 | | The callback path for OpenID Connect responses. |
| | | 32 | | .PARAMETER SignedOutCallbackPath |
| | | 33 | | The callback path for sign-out responses. |
| | | 34 | | .PARAMETER SaveTokens |
| | | 35 | | If specified, saves the OpenID Connect tokens in the authentication properties. |
| | | 36 | | .PARAMETER UsePkce |
| | | 37 | | If specified, enables Proof Key for Code Exchange (PKCE) for enhanced security. |
| | | 38 | | .PARAMETER GetClaimsFromUserInfoEndpoint |
| | | 39 | | If specified, retrieves additional claims from the UserInfo endpoint. |
| | | 40 | | .PARAMETER ClaimPolicy |
| | | 41 | | An optional Kestrun.Claims.ClaimPolicyConfig to apply claim policies during authentication. |
| | | 42 | | .PARAMETER Options |
| | | 43 | | An instance of Kestrun.Authentication.OidcOptions containing the OIDC configuration. |
| | | 44 | | .PARAMETER PassThru |
| | | 45 | | Return the modified server object. |
| | | 46 | | .EXAMPLE |
| | | 47 | | Add-KrOpenIdConnectAuthentication -Authority 'https://example.com' -ClientId $id -ClientSecret $secret |
| | | 48 | | .EXAMPLE |
| | | 49 | | Add-KrOpenIdConnectAuthentication -AuthenticationScheme 'AzureAD' -Authority $authority -ClientId $id -ClientSecret |
| | | 50 | | #> |
| | | 51 | | function Add-KrOpenIdConnectAuthentication { |
| | | 52 | | [KestrunRuntimeApi('Definition')] |
| | | 53 | | [CmdletBinding()] |
| | | 54 | | [OutputType([Kestrun.Hosting.KestrunHost])] |
| | | 55 | | param( |
| | | 56 | | [Parameter(ValueFromPipeline = $true)] |
| | | 57 | | [Kestrun.Hosting.KestrunHost]$Server, |
| | | 58 | | |
| | | 59 | | [Parameter(Mandatory = $false)] |
| | | 60 | | [string]$AuthenticationScheme = [Kestrun.Authentication.AuthenticationDefaults]::OidcSchemeName, |
| | | 61 | | |
| | | 62 | | [Parameter(Mandatory = $false)] |
| | | 63 | | [string]$DisplayName = [Kestrun.Authentication.AuthenticationDefaults]::OidcDisplayName, |
| | | 64 | | |
| | | 65 | | [Parameter(Mandatory = $false)] |
| | | 66 | | [string]$Description, |
| | | 67 | | |
| | | 68 | | [Parameter(Mandatory = $false)] |
| | | 69 | | [switch]$Deprecated, |
| | | 70 | | |
| | | 71 | | [Parameter(Mandatory = $false)] |
| | | 72 | | [string]$Authority, |
| | | 73 | | |
| | | 74 | | [Parameter(Mandatory = $false)] |
| | | 75 | | [string]$ClientId, |
| | | 76 | | |
| | | 77 | | [Parameter(Mandatory = $false)] |
| | | 78 | | [string]$ClientSecret, |
| | | 79 | | |
| | | 80 | | [Parameter(Mandatory = $false)] |
| | | 81 | | [string]$AuthorizationEndpoint, |
| | | 82 | | |
| | | 83 | | [Parameter(Mandatory = $false)] |
| | | 84 | | [string]$TokenEndpoint, |
| | | 85 | | |
| | | 86 | | [Parameter(Mandatory = $false)] |
| | | 87 | | [string]$CallbackPath, |
| | | 88 | | |
| | | 89 | | [Parameter(Mandatory = $false)] |
| | | 90 | | [string]$SignedOutCallbackPath, |
| | | 91 | | |
| | | 92 | | [Parameter(Mandatory = $false)] |
| | | 93 | | [Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectResponseType]$ResponseType, |
| | | 94 | | |
| | | 95 | | [Parameter(Mandatory = $false)] |
| | | 96 | | [switch]$SaveTokens, |
| | | 97 | | |
| | | 98 | | [Parameter(Mandatory = $false)] |
| | | 99 | | [switch]$UsePkce, |
| | | 100 | | |
| | | 101 | | [Parameter(Mandatory = $false)] |
| | | 102 | | [switch]$GetClaimsFromUserInfoEndpoint, |
| | | 103 | | |
| | | 104 | | [Parameter(Mandatory = $false)] |
| | | 105 | | [Kestrun.Claims.ClaimPolicyConfig]$ClaimPolicy, |
| | | 106 | | |
| | | 107 | | [Parameter(Mandatory = $false)] |
| | | 108 | | [Kestrun.Authentication.OidcOptions]$Options, |
| | | 109 | | |
| | | 110 | | [Parameter(Mandatory = $false)] |
| | | 111 | | [switch]$PassThru |
| | | 112 | | ) |
| | | 113 | | begin { |
| | | 114 | | # Ensure the server instance is resolved |
| | 0 | 115 | | $Server = Resolve-KestrunServer -Server $Server |
| | | 116 | | } |
| | | 117 | | process { |
| | 0 | 118 | | if ( $null -eq $Options ) { |
| | | 119 | | # Build options from individual parameters if not provided |
| | 0 | 120 | | $Options = [Kestrun.Authentication.OidcOptions]::new() |
| | | 121 | | } |
| | 0 | 122 | | if ($Authority) { $Options.Authority = $Authority } |
| | 0 | 123 | | if ($ClientId) { $Options.ClientId = $ClientId } |
| | 0 | 124 | | if ($ClientSecret) { $Options.ClientSecret = $ClientSecret } |
| | 0 | 125 | | if ($AuthorizationEndpoint) { $Options.AuthorizationEndpoint = $AuthorizationEndpoint } |
| | 0 | 126 | | if ($TokenEndpoint) { $Options.TokenEndpoint = $TokenEndpoint } |
| | 0 | 127 | | if ($CallbackPath) { $Options.CallbackPath = $CallbackPath } |
| | 0 | 128 | | if ($SignedOutCallbackPath) { $Options.SignedOutCallbackPath = $SignedOutCallbackPath } |
| | 0 | 129 | | if ($ClaimPolicy) { $Options.ClaimPolicy = $ClaimPolicy } |
| | 0 | 130 | | if ($ResponseType) { $Options.ResponseType = $ResponseType } |
| | 0 | 131 | | if ($Description) { $Options.Description = $Description } |
| | | 132 | | |
| | | 133 | | # Set the Deprecated option |
| | 0 | 134 | | $Options.Deprecated = $Deprecated.IsPresent |
| | | 135 | | |
| | | 136 | | # Set other switches |
| | 0 | 137 | | $Options.SaveTokens = $SaveTokens.IsPresent |
| | 0 | 138 | | $Options.UsePkce = $UsePkce.IsPresent |
| | 0 | 139 | | $Options.GetClaimsFromUserInfoEndpoint = $GetClaimsFromUserInfoEndpoint.IsPresent |
| | | 140 | | # Call C# extension with optional claim policy |
| | 0 | 141 | | [Kestrun.Hosting.KestrunHostAuthnExtensions]::AddOpenIdConnectAuthentication( |
| | | 142 | | $Server, |
| | | 143 | | $AuthenticationScheme, |
| | | 144 | | $DisplayName, |
| | | 145 | | $Options |
| | 0 | 146 | | ) | Out-Null |
| | | 147 | | |
| | 0 | 148 | | if ($PassThru.IsPresent) { |
| | | 149 | | # if the PassThru switch is specified, return the modified server instance |
| | 0 | 150 | | return $Server |
| | | 151 | | } |
| | | 152 | | } |
| | | 153 | | } |