I've just started using Keycloak to provide OpenID for F# Safe stack applications.
Wow the learning curve was steep on that one. Not having ever touched OpenID or anything other than forms based authentication and not knowing ASP.Net very well.
But it's neat to get it all up and running. Still a few issues with getting Keycloak to redirect to HTTPS but we will get there.
Thanks. I have recently rolled out Keycloak on k8s with Istio and ACME cert-manager. I’m going to write an article about it and post here when I find some time.
The most disappointing problem with asp.net for me was, that there is no backchannel logout. So you can’t easily force-logout users from oidc/keycloak.
Everything else was going pretty smooth, although the authentication documentation for asp.net really sucks.
Yeah I've hit that. So if you log them out in your application that will remove the cookies and they won't show as logged in but the next redirect to Keycloak shows an error.
The documentation sucks for ASP.net and it's far worse for the Safe stack.
You have to understand the stack so you have to read up on the following.
ASP.net
Giraffe
Saturn
Fable remoting
Keycloak
OpenID
Once you have a good understanding of all of those you can start to understand the half a dozen blog posts that attempt something similar.
You can do a logout via redirect though. So you have to call SignOutAsync on the oidc scheme, and then the user will get redirected to a logout page.
Need to enable SaveTokens in session though, because you need the logout token for that.
If you have any issues, please ask and I will post some (short!) code snippets here :)
Ps: I also love f#, but I concluded that it’s not worth using it for asp.net. There are just too many f# specific things you need to figure out first. Just going with c# is the safer bet. But you can still use f# for your service layer and for tests!
I built my own auth, forms based with blowfish encryption is a few hours. Then I felt like I was doing it wrong. So I looked at OpenID. It's been two weeks and it just working. It'll take me. A few days to document it well enough to be happy I can keep it running.
I made a poor choice and introduced too much complexity.
Comments
I've just started using Keycloak to provide OpenID for F# Safe stack applications.
Wow the learning curve was steep on that one. Not having ever touched OpenID or anything other than forms based authentication and not knowing ASP.Net very well.
But it's neat to get it all up and running. Still a few issues with getting Keycloak to redirect to HTTPS but we will get there.
Maybe this will be helpful? https://gruchalski.com/posts/2022-02-20-keycloak-1700-with-t.... I’m the author.
That’s exactly what needs to be done. It is also in the keycloak documentation, but not as easy to find as in your post.
Thanks. I have recently rolled out Keycloak on k8s with Istio and ACME cert-manager. I’m going to write an article about it and post here when I find some time.
Thank you!
That looks like the exact problem I'm facing. I'll try it out today!
Thanks again!
The most disappointing problem with asp.net for me was, that there is no backchannel logout. So you can’t easily force-logout users from oidc/keycloak.
Everything else was going pretty smooth, although the authentication documentation for asp.net really sucks.
Yeah I've hit that. So if you log them out in your application that will remove the cookies and they won't show as logged in but the next redirect to Keycloak shows an error.
The documentation sucks for ASP.net and it's far worse for the Safe stack.
You have to understand the stack so you have to read up on the following.
Once you have a good understanding of all of those you can start to understand the half a dozen blog posts that attempt something similar.You can do a logout via redirect though. So you have to call SignOutAsync on the oidc scheme, and then the user will get redirected to a logout page.
Need to enable SaveTokens in session though, because you need the logout token for that.
If you have any issues, please ask and I will post some (short!) code snippets here :)
Ps: I also love f#, but I concluded that it’s not worth using it for asp.net. There are just too many f# specific things you need to figure out first. Just going with c# is the safer bet. But you can still use f# for your service layer and for tests!
Been doing similar stuff and found that ASP.Net stuff wasn’t worth the hassle compared to a custom set of functions on top of Giraffe.
Yeah you're right.
I built my own auth, forms based with blowfish encryption is a few hours. Then I felt like I was doing it wrong. So I looked at OpenID. It's been two weeks and it just working. It'll take me. A few days to document it well enough to be happy I can keep it running.
I made a poor choice and introduced too much complexity.